martin is eating a cookie

Cookie policy

Our website uses cookies to understand how people use it in order to improve your website experience. By klicking on the "Accept"-button below you consent to our use of cookies as defined in our cookie policy. You have the right of withdrawal at any time. Details about our cookies and the possibility to change the settings can be found via the "Change cookie settings"-button. To read our full data policy please click here.

Privacy Notice for the

HR-PAY Plus Onboarding Application

Last updated: July 2026

1. Controller and contact details

The controller within the meaning of the EU General Data Protection Regulation (“GDPR”) is:

Hahn Air Lines GmbH
An der Trift 65
63303 Dreieich
Germany
www.hahnair.com

Contact our privacy team / Data Protection Officer (DPO): datenschutz@hahnair.com

2. Scope / context

This privacy notice applies to the processing of personal data in connection with the HR-PAY Plus Onboarding Application form through which travel agencies can express their interest in the programme (e.g., “HR-PAY Plus” / virtual card-based solution) and initiate the referral/onboarding process.


3. What personal data do we process?

We process the information you provide via the form, in particular:

Mandatory fields (as per the form):

  • Company’s legal name
  • Entity type
  • Affiliation
  • IATA number
  • Contact person full name
  • Contact person email address
  • Contact person role at the business
  • “How did you hear about this product?” (source/channel)
  • Confirmations: acceptance of the Terms & Conditions; acknowledgement of this privacy notice

Voluntary fields (if included in the form and not marked as mandatory):

  • Secondary contact email address

We do not process special categories of personal data within the meaning of Art. 9 GDPR.


4. Purposes of processing

We process the data for the following purposes:

1. Handling your request / eligibility check

  • assessing whether the agency meets the participation requirements (e.g., IATA-related information, general suitability for the programme)
  • contacting you to clarify questions and manage the process

2. Coordinating the referral and onboarding process with partners

  • sharing the necessary data with Glyde (headquarters: South Africa) for bank-side onboarding and the provision of accounts/financial products
  • where required, sharing data with UATP (Universal Air Travel Plan) for account opening/product provision and programme execution
  • receiving status/outcome information from partner onboarding (e.g., “onboarding completed”), where necessary

3. Programme administration and account set-up (commercial purposes relating to programme operation)

  • internal programme administration, process control, and coordination of next steps
  • set-up/administration of the programme and the UATP account (where applicable)
  • internal documentation/audit trail evidencing that a request was received and processed
  • avoiding duplicate processing and ensuring quality control

4. Internal analysis / process optimisation

  • analysing the field “How did you hear about this product?” for channel and process optimisation (where possible, in aggregated form)

5. Security and misuse prevention

  • preventing abusive/fraudulent requests and protecting our systems and processes

6.Product- and process-related communications (non-marketing)

  • communicating status updates regarding the referral/onboarding and organisational information related to programme use (e.g., process steps, technical/operational information)

No newsletter/marketing use (current status):
At present, we do not use the data collected via the form for newsletters or other promotional marketing communications. Should this change in the future, we will inform you in advance and—where required—obtain separate consent.


5. Legal bases

We process personal data on the following legal bases:

  • Art. 6(1)(b) GDPR (steps prior to entering into a contract / pre-contractual measures):
    where processing is necessary to handle your request and to conduct the referral/onboarding process as preparation for possible programme participation/business relationship.
  • Art. 6(1)(f) GDPR (legitimate interests):
    where necessary for efficient programme administration, internal documentation/audit trail, IT/process security, fraud/misuse prevention, and (to an appropriate extent) channel-related analysis/process optimisation.
    Our legitimate interest is to process requests in a structured manner, operate the programme securely, and manage the organisation/handling efficiently. Your interests are safeguarded through data minimisation, access restrictions and defined retention periods.

6. Recipients of the data / roles

We only disclose personal data to the extent necessary for the purposes described above.

Internal recipients:
Relevant departments within Hahn Air Lines (e.g., Commercial/Sales, Partner/Programme Management, Operations, Compliance/Legal/Privacy, IT).

External recipients (partners) – typically independent controllers:

  • Glyde (South Africa): bank-side onboarding and provision of financial products.
  • UATP (Universal Air Travel Plan): account opening/product provision and processing in the context of the programme.

These partners generally process the data under their own responsibility (e.g., banking/payment-related onboarding, account opening and product operation). Their respective privacy notices apply in addition.

Technical service providers / hosting (processors):
The form is provided via Microsoft and is hosted/processed within the EU/EEA. Where Microsoft acts as a service provider in this context, it does so on the basis of a data processing agreement (Art. 28 GDPR).


7. International data transfers (outside the EU/EEA)

As Glyde is based in South Africa and UATP or its service providers may carry out processing outside the EU/EEA, personal data may be transferred to third countries.

We ensure that such transfers only take place where the requirements of Art. 44 et seq. GDPR are met, in particular by using appropriate safeguards such as:

  • EU Standard Contractual Clauses (SCCs) and, where necessary, supplementary measures; and/or
  • where applicable, adequacy decisions; and/or
  • where applicable, certification/framework mechanisms (e.g., the EU–U.S. Data Privacy Framework for certified U.S. recipients).

Upon request, we can provide further information about the safeguards used (contact: datenschutz@hahnair.com).


8. Retention / deletion

We store personal data only for as long as necessary for the purposes described above.

  • If no onboarding takes place: we will delete or anonymise the data generally within 6 months after completion of processing or the last contact, unless statutory retention obligations apply or longer storage is required for the establishment, exercise or defence of legal claims.
  • If onboarding/programme participation takes place: data will be stored for the duration of the business relationship and in accordance with our internal retention periods; deletion takes place once the purpose no longer applies and statutory retention periods have expired.

9. Requirement to provide data

The data marked as mandatory in the form is required to process the request and initiate the referral/onboarding process. Voluntary information may be omitted at any time.


10. Automated decision-making / profiling

Hahn Air Lines does not conduct automated decision-making within the meaning of Art. 22 GDPR (including profiling) in connection with the referral form.
Please note: partners such as Glyde may carry out their own regulatory checks as a bank; these fall under their own responsibility and privacy notices.


11. Your rights

Subject to the legal requirements, you have the following rights:

  • right of access (Art. 15 GDPR)
  • right to rectification (Art. 16 GDPR)
  • right to erasure (Art. 17 GDPR)
  • right to restriction of processing (Art. 18 GDPR)
  • right to data portability (Art. 20 GDPR)
  • right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
  • right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, please contact: datenschutz@hahnair.com


12. Updates to this privacy notice

We may update this privacy notice from time to time, in particular if processes, recipients, or legal requirements change. The current version published on our website applies.


13. Data received from partners

Where necessary, we receive information from our partners (e.g., Glyde/UATP) regarding the status/outcome of onboarding (e.g., “completed”). We process this information for programme administration and documentation/audit trail purposes (legal basis: Art. 6(1)(f) GDPR and/or Art. 6(1)(b) GDPR, depending on the context).