Version: 3.1
Effective Date: 18.06.2026
Data Controller: Baltic Shuttle OÜ
Name: Baltic Shuttle OÜ
Registration number: 12019051
Registered office address: Tartu mnt 65-26, Tallinn 10115, Eesti (Estonia)
Email: info@balticshuttle.ee
Website: www.balticshuttle.ee
Online booking website: online.balticshuttle.ee
Baltic Shuttle OÜ is the Data Controller of personal data (hereinafter referred to as the Controller). This Privacy Policy describes what personal data is processed, for what purpose, on what legal basis, and for what retention period.
This Policy applies to all natural persons (hereinafter referred to as the "Data Subject" or "Passenger") whose personal data is processed by Baltic Shuttle OÜ. These include:
Visitors to the information website www.balticshuttle.ee do not transfer any personal data to Baltic Shuttle OÜ: this website does not use analytical tools to collect data about visitors and does not use cookies for tracking or profiling. On the online booking website online.balticshuttle.ee, analytics for collecting traffic data are also not used.
When booking and issuing a ticket for Baltic Shuttle OÜ on the website online.balticshuttle.ee, the following categories of personal data are processed:
| Data Category | Examples | Obligatoriness |
| Identity document | Surname, first name; citizenship; series and number of passport or other identity document; date of birth | Mandatory — ticket issuance is impossible without this data |
| Trip details | Route, date and time of departure, flight/trip number, seat number, ticket number | Mandatory |
| Contact details | Email address, phone number | Mandatory — for sending confirmations and notifications related to the trip |
| Payment data | Information about the payment made (the processing of the payment transaction itself is carried out by the payment provider AS SEB Pank; Baltic Shuttle OÜ only stores the status and amount of the payment) | Mandatory |
Baltic Shuttle OÜ does not process special categories of personal data (data concerning health, biometric data, data revealing racial or ethnic origin, etc.) in the ordinary course of business. If a Passenger independently provides information about their health status (for example, to ensure special conditions of carriage), such data is processed exclusively for the purpose of providing the relevant service based on the explicit consent of the Data Subject.
Purpose: ticket issuance, amendment and cancellation of bookings, settlement of payments, sending confirmations and notifications about the trip.
Legal basis: processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract.
The provision of data listed in Section 3 as "mandatory" is a necessary condition for the conclusion of the transport contract. In case of refusal to provide it, ticket issuance is impossible.
Purpose: transfer of the Passenger's personal data to competent state authorities of the Republic of Estonia for the purposes of border, customs, and transport control, as well as in other cases directly provided for by the applicable EU and Estonian legislation. Data transfer to third countries (outside the EU/EEA) is carried out exclusively for the purpose of performing the transport contract on international routes (for example, for passing border control of third countries) pursuant to Article 49(1)(b) of the General Data Protection Regulation (GDPR), as the transfer is necessary for the performance of a contract.
Legal basis: processing is necessary for compliance with a legal obligation to which the Controller is subject (Article 6(1)(c) GDPR), in accordance with the applicable legislation of the European Union and the Republic of Estonia (including the Public Transport Act, the Customs Act, and the State Borders Act).
Purpose: notifying the Passenger of schedule changes, delays, rescheduling or cancellation of trips, as well as other circumstances directly affecting their trip.
Legal basis: performance of the transport contract; legitimate interest of the Controller and the Passenger in the proper performance of the contract.
Baltic Shuttle OÜ transfers the Passenger's personal data only in the following cases:
| Recipient | Data Category |
| Competent state authorities of the Republic of Estonia (Police and Border Guard Board and other authorized bodies) | Identity document data, trip details |
| Payment provider (payment processor) AS SEB Pank | Payment data |
| Agents and authorized intermediaries of Baltic Shuttle OÜ | Identity document data, trip details |
| Hosting and IT infrastructure service provider of Baltic Shuttle OÜ | Data stored in the information systems of the Controller |
Baltic Shuttle OÜ does not sell or transfer Passengers' personal data to third parties for commercial purposes.
For each transfer of personal data to a processor, the Controller enters into a data processing agreement with them, obliging the processor to comply with the requirements of the GDPR and to apply appropriate technical and organizational security measures.
All personal data of Passengers is stored and processed within the territory of the European Union / European Economic Area (EU/EEA).
Data transfer outside the European Union is carried out exclusively for the purpose of performing the transport contract on international routes (for example, for passing border control of third countries) pursuant to Article 49(1)(b) GDPR and only to the extent necessary to fulfill the relevant legal obligation.
Baltic Shuttle OÜ stores personal data for no longer than is necessary to achieve the purposes specified in Section 4, in accordance with the principle of storage limitation.
| Purpose of Processing | Retention Period |
| Performance of the transport contract | 3 years from the date of service provision (completion of the trip) |
| Accounting and financial records | 7 years from the end of the financial year in which the transaction took place |
| Compliance with transport and border control requirements | Up to 1 year from the date of the trip, unless otherwise established by specific legislation |
Upon expiry of the relevant retention period, personal data is deleted or irreversibly anonymized.
Every Passenger has the following rights regarding their personal data:
Right of access — to obtain confirmation as to whether or not their personal data is being processed, and, where that is the case, access to the personal data along with information on the purposes, grounds, and periods of processing.
Right to rectification — to request the rectification of inaccurate personal data or the completion of incomplete data.
Right to erasure ("right to be forgotten") — to request the erasure of personal data if it is no longer necessary in relation to the purposes for which it was collected, if consent has been withdrawn, if the data has been unlawfully processed, or in other cases provided for by Article 17 GDPR. This right may be limited if the processing is necessary for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims.
Right to restriction of processing — to request a temporary suspension of the processing of personal data, including during the period of considering an objection or verifying the accuracy of the data.
Right to data portability — to receive their personal data in a structured, commonly used, and machine-readable format and to transmit those data to another controller, if the processing is based on consent or on a contract and is carried out by automated means.
Right to object — to object to the processing of personal data carried out on the basis of legitimate interest.
Right to withdraw consent — to withdraw previously given consent to data processing at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Right not to be subject to automated decision-making — Baltic Shuttle OÜ does not apply automated decision-making, including profiling, which would produce legal effects concerning the Passenger or similarly significantly affect them.
To exercise any of the listed rights, the Data Subject can contact the Controller in one of the following ways:
The Controller will review the request and provide a response within one calendar month from the receipt of the request. In case of complexity or a large number of requests, this period may be extended by two further months, of which the Data Subject will be notified.
To identify the Data Subject when processing a request, additional information confirming the identity of the applicant may be required. When submitting a request by email, the Controller has the right to require that the request be digitally signed (Smart-ID, Mobile-ID, ID-card) for unambiguous identification of the identity.
If the Data Subject considers that the processing of their personal data infringes the requirements of the legislation, they have the right to lodge a complaint with a competent data protection authority.
Supervisory Authority of Estonia
Andmekaitse Inspektsioon (AKI)
(Estonian Data Protection Inspectorate)
Address: Tatari 39, 10134 Tallinn, Eesti
Email: info@aki.ee
Website: www.aki.ee
Phone: +372 627 4135
Lodging a complaint with a supervisory authority does not deprive the Data Subject of their right to a judicial remedy.
The services of Baltic Shuttle OÜ are available to passengers of any age. The processing of personal data of minor passengers is carried out on the same legal bases as the processing of data of adults (performance of the transport contract, compliance with legal obligations).
If a minor under the age of 16 acquires a ticket independently through the online booking website, confirmation of the consent of their parent or legal guardian is required. The Controller stores the data of minors within the time periods specified in Section 7, after which it is deleted.
Baltic Shuttle OÜ applies appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction, including:
In the event of a personal data breach (leak) that is likely to result in a risk to the rights and freedoms of the Passenger, Baltic Shuttle OÜ will notify the Estonian Data Protection Inspectorate (AKI) within 72 hours after becoming aware of the incident. If the incident creates a high risk to the rights and freedoms of the Passenger, they will be notified without undue delay.
Baltic Shuttle OÜ has the right to amend this Privacy Policy due to changes in legislation, technology, or business practice.
The new version of the Policy is published on the website www.balticshuttle.ee indicating the date of the last update.
For all questions regarding the processing of personal data and the exercise of Data Subjects' rights, as well as regarding this Policy, please contact:
Baltic Shuttle OÜ
Tartu mnt 65-26, Tallinn 10115, Eesti
Email: info@balticshuttle.ee
Website: www.balticshuttle.ee
Date of Last Update of the Policy: 18.06.2026