Who is responsible for your data
[OWNER NAME OR COMPANY NAME AND NUMBER], [POSTAL ADDRESS], is the controller of your personal data on Fly To Roots. ICO registration number: [ICO REGISTRATION NUMBER]. For anything about your data, email [CONTACT EMAIL].
What we collect and why
| When | What | Why | Lawful basis |
|---|---|---|---|
| Searching | Your town or postcode (or chosen airports), destination, dates, number and type of passengers, bags and search options. We don't ask for your name to search. | To find flights and work out door-to-door costs. A record of each search (without your IP address or name) helps us run, fix and improve the service. | Legitimate interests |
| Your IP address when you search | Your IP address, passed with the search to one of our flight price partners, as their service requires. | So the partner can return prices and apply its fair-use limits. We don't store it in our search records. | Legitimate interests |
| Booking clicks | A random reference number plus the trip you clicked (route, dates, price, number of passengers). | To check which bookings earned us commission. It doesn't identify you. | Legitimate interests |
| Compensation follow-up emails | Your email address and the flights on the trip you opted in for. | To send one email after your trip about checking for compensation. Your email address is deleted once it's sent or you unsubscribe. | Consent (you can withdraw it at any time) |
| Your account (refund calculator) | Your email address, an account ID, when you joined and last signed in. | To sign you in with an email link and give you the members' tools. | Contract (providing the service you asked for) |
| Marketing emails | Your email address and when you agreed, only if you ticked the box. | To send cheap fares and travel tips. Every email has an unsubscribe link. | Consent (you can withdraw it at any time) |
| Analytics | Pages you visit, how you use the site, your device and browser, and approximate location (Google Analytics, with cookies). Used only for statistics; no advertising or profiling. | To understand how the site is used and improve it. | Legitimate interests; opt out any time with Cookie settings |
| Contacting us | Whatever you include in your message. | To reply and keep a record of the conversation. | Legitimate interests |
We don't sell your personal data, and we don't use it for automated decisions that significantly affect you.
When you book or claim elsewhere
When you click through to an airline, travel agent or Compensair, you give your details to them, not to us. They are responsible for that data under their own privacy policies. Compensair's claim form on our claim page is loaded from Compensair's website, so what you type there goes straight to them.
Who we share data with
We use these types of service provider. They process data only to provide their service to us. You can ask us for their names.
| Type of provider | What for | What they receive |
|---|---|---|
| Website hosting | Running the website (servers may be in the US). | Pages, searches and short-lived server logs, which include IP addresses. |
| Database and sign-in | Storing data and sending sign-in emails. | Search records, booking clicks, follow-ups, accounts and marketing choices. |
| Email delivery | Sending the emails you ask for (may be in the US). | Email addresses and email content. |
| Flight price and booking partners | Finding flight prices and booking links. | Search details; one partner also receives your IP address. |
| Postcode lookup | Finding your nearest airports. | The town or postcode you type. |
| Analytics (Google Analytics) | Visitor statistics (may be in the US). Advertising features and data sharing for Google's own purposes are off. | Usage data, device details and an online identifier, unless you opt out. |
We may also share data if the law requires it, or to protect our rights or the safety of others.
International transfers
Some providers process data outside the UK, for example in the US or the EU. Where they do, we rely on UK adequacy regulations (including the UK extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Agreement or Addendum.
How long we keep it
- Follow-up email addresses: deleted once the email is sent or you unsubscribe.
- Search records and booking clicks (which don't include your name, email or IP address): up to 24 months.
- Accounts: until you ask us to delete yours.
- Marketing consent: until you unsubscribe, plus a record that you did so we don't email you again.
- Server logs kept by our host: a short period, for security and troubleshooting.
Your rights
You can ask us to:
- give you a copy of your personal data;
- correct it, or delete it;
- restrict or object to how we use it (including any marketing, at any time);
- send it to you or another organisation in a reusable format;
- stop processing based on your consent (withdrawing consent doesn't affect what we did before).
Email [CONTACT EMAIL]. We'll reply within one month. It's free.
If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.
Cookies
We use essential cookies to make the site work, and Google Analytics cookies for visitor statistics, which you can opt out of. See our cookie policy.
Children
The site is meant for adults booking travel. Accounts and email sign-ups are for people aged 18 or over.
Security
Data is sent over encrypted connections, access to our database is restricted, and sign-in uses one-time email links rather than passwords.
Changes
We'll update this notice when what we do changes, and change the date at the top.