GDPR Policy — EU & UK Data Subject Rights

This GDPR Policy applies to individuals located in the European Union, the European Economic Area, or the United Kingdom (“EEA/UK Data Subjects”) who interact with Tresta Flights, operated by US Auto Solutions LLC. It supplements our general Privacy Policyand is intended to comply with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the UK GDPR.

1. Data Controller

For the purposes of the GDPR, the data controller is:

We are a US-based company. When you provide personal data to us from the EEA/UK, that data is transferred to the United States. We rely on Standard Contractual Clauses (SCCs) and other appropriate safeguards under GDPR Chapter V to legitimize such transfers where applicable.

2. Legal Bases for Processing

We process your personal data under the following GDPR legal bases:

• Contract Performance (Art. 6(1)(b)): Processing necessary to fulfil your flight booking request, issue tickets, and manage your reservation.
• Legitimate Interests (Art. 6(1)(f)): Processing for fraud prevention, IT security, and improving our services, where these interests are not overridden by your rights.
• Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable laws, including financial record-keeping and cooperation with law enforcement.
• Consent (Art. 6(1)(a)): Where we send marketing communications or set non-essential cookies, we rely on your consent, which you may withdraw at any time.

3. Data Retention

We retain personal data only for as long as necessary for the purposes outlined in our Privacy Policy. Booking and financial records are typically retained for 7 years to comply with US tax and accounting requirements. Marketing data is retained until you withdraw consent or opt out.

4. Your Rights Under the GDPR

As an EEA/UK Data Subject, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17): Request deletion of your personal data, subject to legal retention obligations.
• Right to Restriction (Art. 18): Request that we restrict processing of your data in certain circumstances.
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format where processing is based on consent or contract.
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes.
• Rights Related to Automated Decision-Making (Art. 22): We do not make solely automated decisions that produce significant legal effects.

5. How to Exercise Your Rights

Submit a Data Subject Request (DSR) by emailing support@trestaflights.com with the subject line “GDPR Data Request”. We will respond within 30 days. We may ask you to verify your identity before processing your request.

6. Right to Lodge a Complaint

If you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU, contact the supervisory authority in your Member State.

7. Cookies and Tracking

For details on cookies used on our site and how to manage your preferences, please see our Cookie Policy.

8. Updates to This Policy

We may update this GDPR Policy periodically. Material changes will be reflected by an updated “Last Updated” date.