Privacy policy

1. Who is responsible for your data

British Flights is the data controller for the personal data described in this policy. That means we decide why and how it is processed, and we are accountable for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

You can contact us about anything in this policy on 020 0000 0000, by email at info@british.manageflights.co.uk, or by post at London, United Kingdom.

2. What data we collect

We collect only what we need to arrange and service a flight booking:

• Identity data — the passenger name as it appears in the passport, and the title you use.
• Contact data — your email address, telephone number and postal address where relevant.
• Booking data — origin and destination airports, travel dates, cabin class, number of travellers, booking references, ticket numbers, and any frequent-flyer number you give us.
• Special requirements — meal preferences, mobility or medical assistance requests, and similar, but only where you volunteer them so that we can arrange them with the airline.
• Correspondence — the content of enquiries, emails and notes from calls, so we have a record of what was agreed.
• Technical data — your IP address is recorded when you submit a form, purely as an anti-spam and rate-limiting measure.

We do not collect card or bank details through this website. There is no online payment on this site and no form here asks for payment information, passport numbers or dates of birth.

3. Special category data

Information about mobility needs, medical assistance or certain dietary requirements can amount to special category data under UK GDPR because it may reveal something about your health or beliefs. Where you give us this information so that we can arrange assistance or a special meal, we process it on the basis of your explicit consent, and we share it only with the airline and airport services that need it to provide what you have asked for.

4. Why we process it, and our lawful bases

• To arrange and service your booking — lawful basis: performance of a contract with you, or taking steps at your request before entering into one.
• To respond to enquiries — lawful basis: legitimate interests, namely answering people who contact us about our services.
• To keep accounting and transaction records — lawful basis: legal obligation under UK tax and company law.
• To prevent spam and abuse of our forms — lawful basis: legitimate interests in keeping our systems usable and secure.
• To arrange assistance or special meals — lawful basis: explicit consent, which you can withdraw at any time.

5. Who we share it with

Arranging a flight necessarily means passing your details to other organisations:

• Airlines operating the flights you book — they need passenger names and contact details to issue and manage the ticket.
• Global distribution systems and consolidators — the reservation platforms through which airline inventory is booked and tickets are issued.
• Airports and ground handling agents, where you have requested assistance.
• Our IT and email providers, who host this website and our correspondence under contract.
• Government authorities, where the destination or transit country legally requires advance passenger information, or where we are otherwise required by law to disclose.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

6. International transfers

Air travel is international by nature, so your data will often be transferred outside the UK — for example to an airline based in the country you are flying to, or to a reservation system hosted abroad. Where we transfer personal data outside the UK we rely on UK adequacy regulations where they apply, or on the International Data Transfer Agreement or equivalent safeguards where they do not. Where a transfer is necessary to perform your booking contract, that necessity is itself the basis for the transfer.

7. How long we keep it

• Booking and transaction records — six years after the end of the tax year in which you travelled, to meet HMRC record-keeping requirements.
• Enquiries that did not lead to a booking — up to 12 months, then deleted.
• General correspondence — up to 24 months unless it relates to a live booking or a complaint.
• Anti-spam records including IP addresses — a matter of minutes, then discarded.

8. How we protect it

Access to booking records is limited to staff who need it. Our website is served over HTTPS, form submissions are protected against cross-site request forgery and automated abuse, and correspondence is held in accounts protected by access controls. No system is perfectly secure, but we take the protection of your data seriously and will tell you and the Information Commissioner's Office promptly if a breach occurs that is likely to present a risk to you.

9. Your rights

Under UK GDPR you have the right to:

• Be informed about how your data is used — which is what this policy is for.
• Access a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected or incomplete data completed.
• Erasure — ask us to delete your data, where we have no overriding obligation to keep it.
• Restrict processing in certain circumstances, such as while accuracy is disputed.
• Data portability — receive data you gave us in a machine-readable format.
• Object to processing carried out on the basis of legitimate interests.
• Rights relating to automated decision-making and profiling — we do not carry out automated decision-making that produces legal or similarly significant effects.

To exercise any of these, contact us at info@british.manageflights.co.uk. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

Note that we cannot delete data we are legally required to retain, such as transaction records within the statutory retention period, and that deleting data attached to a live booking may make it impossible for us to service that booking.

10. Cookies

This website sets only the cookies needed to make it work, plus a record of your cookie preference. Full details are in our cookie policy.

11. Complaining to the regulator

If you are unhappy with how we have handled your personal data, please raise it with us first so we have the chance to put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.

12. Changes to this policy

We may update this policy as our services or the law change. The date at the top of this page shows when it was last revised.