Effective date: July 25, 2026
1. Who We Are
PenguFly.com (the “Site”) is a personal, non-commercial travel information project about flights, destinations and travel tips, operated by a private individual (the “Operator”, “we”). We do not sell air tickets or any other services — all bookings are made on partner websites (see Section 5). For any privacy-related questions, contact us at info@pengufly.com.
This Privacy Policy explains what personal data we collect, why, and what rights you have. It is designed to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable US state privacy laws, including the California Consumer Privacy Act (CCPA/CPRA).
2. What Data We Collect
2.1. Account registration and comments
Commenting requires an account. When you register, we collect your username and email address. When you comment, we store the comment text, the date, and your IP address and browser user-agent string (for spam and abuse protection). Your email address is never published and is not used for marketing.
An anonymized string created from your email address (a “hash”) may be provided to the Gravatar service (Automattic Inc.) to check whether you use it. The Gravatar privacy policy is available at automattic.com/privacy. After approval of your comment, your profile picture is visible to the public next to it.
2.2. Email inquiries
If you email us, we process your email address, name (if provided) and the content of your message — solely to reply to you.
2.3. Cookies and analytics
The Site uses Google Analytics 4 (via the Google Site Kit plugin) to collect aggregated statistics: pages viewed, approximate location (city level), device and browser type, and traffic source. We use this data only to understand what content is useful and to improve the Site.
Visitors from the EEA, the UK and Switzerland: Google Consent Mode is enabled with a “denied” default for these regions — analytics cookies are not set on your device unless you give consent. How Google uses data: policies.google.com/technologies/partner-sites. You can additionally install the Google Analytics opt-out browser add-on or block cookies in your browser settings — the Site will remain fully accessible.
2.4. What we do NOT collect
We do not collect or process payment card data, government ID data, precise geolocation, or any special categories of personal data. Ticket and hotel bookings happen entirely on partner websites — those transactions are governed by the partners’ own privacy policies, not ours.
3. Purposes and Legal Bases (GDPR Art. 6)
- Consent (Art. 6(1)(a)) — publishing your comments, analytics cookies where consent is required;
- Legitimate interests (Art. 6(1)(f)) — site security, spam prevention, aggregated usage statistics;
- Contract-like necessity (Art. 6(1)(b)) — maintaining your account at your request.
4. Data Sharing and International Transfers
We do not sell personal data and do not share it with third parties for their marketing. Data is disclosed only to technical service providers necessary to run the Site:
- Hosting — the Site is hosted on servers located in the Russian Federation. By using the Site you acknowledge that the data listed above is processed on those servers.
- Google LLC (analytics) — data may be processed in the United States. Google is certified under the EU-U.S. Data Privacy Framework.
- Automattic Inc. (Gravatar) — see Section 2.1.
5. Partner Booking Services
The Site contains links and search widgets of partner booking services (flight and hotel search services operating on the Travelpayouts affiliate platform). When you follow such a link and make a booking, you provide your data directly to the respective service; its own privacy policy applies. We never receive your payment details, passport data or booking documents — at most, we receive anonymous statistics that a booking was made.
6. Data Retention
Comments and account data are kept until you delete your account or ask us to remove them. Email correspondence is kept only as long as needed to handle your inquiry. Analytics data is retained according to Google Analytics settings (14 months) in aggregated form.
7. Your Rights
7.1. If you are in the EEA, UK or Switzerland (GDPR)
You have the right to: access your personal data (Art. 15); rectify it (Art. 16); have it erased (“right to be forgotten”, Art. 17); restrict processing (Art. 18); data portability (Art. 20); object to processing (Art. 21); and withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local data protection supervisory authority.
7.2. If you are a California resident (CCPA/CPRA)
In the preceding 12 months we have collected only these categories of personal information: identifiers (username, email, IP address) and internet activity (pages visited, via analytics). We do not sell and do not share personal information as defined by the CCPA, and we do not use sensitive personal information. You have the right to know, correct and delete your personal information, and the right not to be discriminated against for exercising these rights.
7.3. How to exercise your rights
Email info@pengufly.com from the address associated with your account or comment. We will respond within 30 days. We may ask you to confirm control of that email address — nothing more is needed for verification.
8. Security
The Site is served over HTTPS. Access to data is limited to the persons maintaining the Site. Administrative access is protected with two-factor authentication, and the Site undergoes regular automated security checks.
9. Children’s Privacy
The Site is not directed to children under 13 (or under 16 in the EEA), and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.
10. Do Not Track and Global Privacy Control
Since we do not sell or share personal data and do not run cross-site tracking of our own, there is nothing additional to opt out of; for visitors from consent-mode regions analytics cookies are off by default (see Section 2.3).
11. Changes to This Policy
We may update this Policy from time to time. The new version takes effect when published on this page. The current version is always available at pengufly.com/privacy-policy.
