Privacy policy

1. Who is responsible for your data

AeroVia Travels Ltd, trading as AeroVia Travels is the controller of the personal data described in this policy. Its registered office is at Cardiff Business Technology Centre, Senghennydd Road, Cardiff, Wales, CF24 4AY, United Kingdom. For any privacy question or request, contact us at bookings@aeroviatravels.co.uk.

2. The data we collect

• Passenger details: title, name, date of birth and gender, as airlines require them to issue a ticket.
• Travel document details, such as passport number, nationality and expiry date, only where the airline requires them for the flight.
• Contact details: email address and phone number.
• Booking details: flights, extras, prices paid, booking references and any requests you send us.
• Payment information: we receive confirmation of payment and limited card details (such as card type and last four digits) from our payment provider. We never see or store your full card number or security code.
• Messages you send us through the contact form, by email, phone or WhatsApp.
• Technical data: IP address, device and browser type, used to keep the site secure and working.

If you give us details of other passengers, please make sure they know you are doing so and have seen this policy.

3. How we use it and our lawful basis

• To make and manage your booking, take payment, send confirmations and handle changes, cancellations and refunds: this is necessary to perform our contract with you.
• To answer enquiries and provide support: necessary for our contract with you, or to take steps at your request before one.
• To keep accounting and tax records and respond to lawful requests: necessary to comply with our legal obligations.
• To prevent fraud, protect the site and improve our service: our legitimate interests, which we balance against your rights.
• To measure how the site is used with analytics cookies: only with your consent, which you can withdraw at any time.

We do not sell personal data, and we do not send marketing unless you have asked for it.

4. Who we share it with

• The airline or airlines operating your flights, and the booking technology provider that connects us to them (Duffel), so your ticket can be issued.
• Our payment provider (Stripe), which processes card payments and carries out fraud checks.
• Service providers that host the site and database and deliver our emails, acting on our instructions.
• Authorities such as border, security, tax or law enforcement bodies where the law requires it. Airlines may be required to give passenger data to authorities in the countries you travel to or through.
• Professional advisers where needed, and a buyer of the business if it is ever sold.

5. Transfers outside the UK

Booking a flight means your data must go to the airline, which may be based outside the UK, and some of our providers process data outside the UK. Where data leaves the UK we rely on UK adequacy regulations, on approved contractual safeguards, or on the transfer being necessary to perform the contract for your travel.

6. How long we keep it

• Booking and payment records: six years after the end of the tax year of the booking, to meet accounting and tax obligations.
• Travel document details: deleted or anonymised once your travel is complete and any claim period has passed.
• Enquiries that do not lead to a booking: up to 24 months.
• Security logs: up to 12 months.

7. Keeping it secure

Data is encrypted in transit, access is limited to people who need it, and sensitive fields such as passport numbers are encrypted when stored. No system can be guaranteed completely secure. If a breach is likely to affect your rights we will tell you and the regulator as the law requires.

8. Your rights

Under UK data protection law you have the right to ask for a copy of your data, to have it corrected, to have it erased in some circumstances, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent where we rely on it. To use any of these rights, contact us at bookings@aeroviatravels.co.uk. We will reply within one month.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to deal with your concern first.

9. Children

Bookings must be made by an adult. We process children's data only as passengers on a booking made by an adult responsible for them.

10. Cookies

Our cookie policy explains the cookies and similar storage this site uses.

11. Changes to this policy

We may update this policy. The date at the top shows when it was last changed.