Privacy policy for res.ax

This privacy policy explains how Peruna Deep Consulting Ab (“we”, “us”) processes personal data when you use the website res.ax. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection law.

1. Data controller

The data controller is:

• Peruna Deep Consulting Ab
• Business ID: 3445914-3
• Website: https://res.ax
• Email: [email protected]

2. What personal data we process

Depending on how you use the site, we may process the following categories of data:

• Technical and log data: IP address, browser type, device/operating system, approximate location derived from IP, referrer, requested URL, date and time, and similar server-log information.
• Usage data: pages viewed, searches and filters used (for example route, date and language), clicks on booking links, and similar interaction data.
• Preference data stored in a session cookie: language, selected country/direction and timezone when you set these on the site.
• Contact data: if you email us (for example at [email protected]), we process the content of your message and any contact details you include.
• Advertising and analytics data: identifiers and event data collected via Google Analytics, Ahrefs Analytics and Google AdSense (see section 5).

res.ax is a comparison and information service. When you book a trip you are redirected to the carrier’s or booking partner’s website. We do not process booking forms, payment card data or passenger lists for your ticket purchase.

3. Purposes and legal bases

We process personal data for the following purposes and on the following legal bases (GDPR Art. 6):

• Provide and operate the website (timetables, search, language and timezone preferences) – legitimate interest in running a functional travel information service, and where needed performance of a request you make (Art. 6(1)(f) and 6(1)(b)).
• Security, abuse prevention and troubleshooting of server logs – legitimate interest in protecting the service (Art. 6(1)(f)).
• Respond to messages you send us – legitimate interest / steps prior to a contract at your request (Art. 6(1)(f) and 6(1)(b)).
• Audience measurement and service improvement via analytics tools – legitimate interest in understanding aggregate use of the site; where consent is required under ePrivacy/cookie rules we rely on consent (Art. 6(1)(f) and/or 6(1)(a)).
• Show advertising via Google AdSense – consent and/or legitimate interest as applicable to advertising cookies and similar technologies (Art. 6(1)(a) and/or 6(1)(f)).
• Comply with legal obligations – Art. 6(1)(c).

4. Cookies and similar technologies

We use cookies and similar technologies:

• Necessary session cookie: keeps language and similar preferences during your visit so the site works as expected.
• Google Analytics (measurement ID G-HZGV4JC92E): helps us understand how the site is used.
• Ahrefs Analytics: helps us measure traffic and referrals.
• Google AdSense (publisher ID ca-pub-5607478167825078): shows ads and may use cookies or advertising identifiers for personalised or non-personalised ads according to Google’s settings and applicable law.

You can control or delete cookies in your browser settings. Blocking some cookies may affect site functionality or advertising.

5. Recipients and processors

We do not sell your personal data. Data may be processed by:

• Hosting and infrastructure providers that run res.ax (currently deployed on Fly.io).
• Google Ireland Limited / Google LLC – Google Analytics and Google AdSense.
• Ahrefs Pte. Ltd. – Ahrefs Analytics.
• Authorities when we are legally required to disclose information.
• Professional advisers (for example IT or legal) bound by confidentiality, when needed.

When you follow a booking link, the carrier or booking platform becomes an independent controller for the data you submit on their site. Their privacy policy applies to that processing.

6. Transfers outside the EEA

Some providers (in particular Google and Ahrefs) may process data in countries outside the European Economic Area, including the United States. Where such transfers occur, they are based on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, where applicable, an adequacy decision (for example the EU–US Data Privacy Framework for certified organisations).

7. Retention

We keep personal data only as long as needed for the purposes above:

• Session preferences: for the duration of the browser session (or until the session cookie expires).
• Server logs: typically for a limited operational period needed for security and troubleshooting, unless a longer period is required for a specific incident.
• Email correspondence: for as long as needed to handle your enquiry and for reasonable follow-up or legal claims.
• Analytics and advertising data: according to the retention settings of the respective provider and our configuration.

8. Your rights

Subject to the conditions in the GDPR, you have the right to:

• Access your personal data (Art. 15).
• Rectification of inaccurate data (Art. 16).
• Erasure (“right to be forgotten”) (Art. 17).
• Restriction of processing (Art. 18).
• Data portability (Art. 20).
• Object to processing based on legitimate interest (Art. 21).
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal (Art. 7).

To exercise your rights, contact us at [email protected]. You also have the right to lodge a complaint with the supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), https://tietosuoja.fi.

9. Security

We take appropriate technical and organisational measures to protect personal data, including HTTPS and access controls for administrative functions. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

10. Children

res.ax is not directed at children. We do not knowingly collect personal data from children for marketing purposes.

11. Changes to this policy

We may update this privacy policy when our processing or the law changes. The latest version is always published on this page with an updated date.

12. Contact

Questions about this privacy policy or our processing of personal data: [email protected].