Privacy Policy

The Fly Easy is the trading name of Cheap Tickets Ltd, a company registered in England and Wales (Company No. 17398247) with its registered office at Piccadilly Business Centre, Unit C Aldow Enterprise Park, Blackett Street, Manchester, M12 6AE, United Kingdom. Cheap Tickets Ltd acts as a data controller in respect of the personal data it processes, as defined under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our website, mobile applications, or any of our services, including flight search, hotel booking, car hire, and holiday package reservations. We process personal data lawfully, fairly, and in a transparent manner, in accordance with our obligations under applicable data protection legislation.

By using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, we respectfully ask that you do not use our website or services. We reserve the right to update this policy from time to time, and the latest version will always be available on this page. We encourage you to review this policy periodically to stay informed about how we handle your data.

Booking Information. When you make a reservation through The Fly Easy, we collect personal data necessary to fulfil your travel arrangements. This includes your full name, email address, telephone number, passport details (including passport number, nationality, and expiry date), date of birth, and any special requests or requirements you provide (such as dietary preferences, accessibility needs, or frequent flyer numbers). This information is required by airlines, hotels, and car rental providers to complete your booking.

Payment Information. All payment transactions are processed through Stripe, a PCI DSS Level 1 certified payment processor. We do not store, process, or have access to your full credit or debit card details. Stripe processes your payment information in accordance with its own privacy policy and security standards. We retain only the last four digits of your card number and a transaction reference for booking management and refund purposes.

Technical Data. When you visit our website, we automatically collect certain technical information including your IP address, browser type and version, operating system, device type, screen resolution, and language preferences. This data is collected through cookies and similar tracking technologies and is used to ensure the website functions correctly, to diagnose technical issues, and to optimise the user experience across different devices and browsers.

Usage Data. We collect information about how you interact with our website, including the pages you visit, search queries you perform, dates and times of your visits, click patterns, time spent on pages, and the journey you take through our site. This data helps us understand user behaviour, identify areas for improvement, and develop new features and services that better meet the needs of our customers.

Communication Data. When you contact our customer support team via email, live chat, telephone, or through our support ticketing system, we collect the content of those communications along with metadata such as the date, time, and method of contact. We may also record telephone calls for training, quality assurance, and dispute resolution purposes, and you will be informed of any such recording at the start of the call.

We use your personal data for the following purposes: to process and manage your travel bookings, including transmitting your booking details to the relevant airlines, hotels, car rental companies, and other suppliers as necessary to fulfil your reservation; to send you booking confirmations, itinerary updates, schedule changes, travel alerts, and other essential communications related to your reservations; and to provide customer support, including responding to your enquiries, resolving disputes, processing refunds, and assisting with any issues that may arise before, during, or after your trip.

We also use your personal data to improve our website and services, including analysing usage patterns to enhance user experience, developing new features and functionality, and conducting internal research and analytics; to send you marketing communications about travel deals, special offers, promotions, and new services, but only where you have given your explicit consent to receive such communications, and you may opt out of marketing at any time by clicking the unsubscribe link in any marketing email or by contacting us directly; and to comply with our legal and regulatory obligations, including tax and accounting requirements, anti-money laundering regulations, and any court orders or legal processes served upon us.

We process your personal data on the following lawful bases: the performance of a contract to which you are a party (i.e., processing your booking); compliance with our legal obligations; our legitimate interests in running and improving our business; and your consent, where applicable, such as for marketing communications and optional cookies. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

With Third-Party Suppliers. To fulfil your travel bookings, we share necessary personal data with our third-party suppliers, including Expedia (for flights, hotels, and car hire), Travel Bureau Online (TBO) (for flights and hotels), the Travel Agent Affiliate Program (TAP) (for flights), and Duffel (for flight search and booking). These suppliers act as independent data controllers or processors in respect of the data they receive. We share only the minimum personal data required to complete each reservation, which may include your full name, email address, telephone number, passport details, travel dates, and any special requests you have provided.

With Payment Processors. All payment transactions are securely processed by Stripe, Inc. Stripe processes payments in compliance with PCI DSS standards and applicable data protection laws. We do not share your full payment card details with Stripe beyond what is necessary to process each transaction. Stripe's privacy policy governs the handling of your payment data.

With Service Providers. We engage trusted third-party service providers to assist in operating our business, including website hosting and security services provided by Cloudflare, web analytics services including Google Analytics, customer relationship management tools, and live chat and support platforms. These service providers are bound by contractual obligations to use your data only for the purposes for which it was provided and to implement appropriate technical and organisational security measures.

With Authorities. We may disclose your personal data to law enforcement agencies, regulatory bodies, tax authorities, or other governmental organisations where required by law, regulation, court order, or legal process. We may also disclose data where necessary to protect the rights, property, or safety of The Fly Easy, our customers, or the public.

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share aggregated and anonymised data, which cannot be used to identify you, with third parties for research, analytics, and industry benchmarking purposes.

When you make a booking through The Fly Easy, the personal data you provide is shared with the relevant third-party supplier responsible for fulfilling that portion of your reservation. Our current suppliers include Expedia, which provides flights, hotel, and car hire inventory; Travel Bureau Online (TBO), which provides flight and hotel inventory; the Travel Agent Affiliate Program (TAP), which provides flight inventory; and Duffel, which provides a flight search and booking API. The specific supplier(s) with whom your data is shared will depend on the nature of your booking and the inventory source used to fulfil it.

Each third-party supplier has its own privacy policy governing the collection, use, storage, and disclosure of your personal data. We strongly encourage you to review the privacy policy of each supplier before completing your booking. The Fly Easy is not responsible for the privacy practices of third-party suppliers, although we work to ensure that our supplier agreements include appropriate data protection obligations. Data shared with suppliers may include, as applicable: your full name, email address, telephone number, passport number, nationality, date of birth, travel dates, destination, special requests (such as dietary requirements or accessibility needs), and payment confirmation references.

We require that our suppliers handle your personal data in accordance with applicable data protection laws, including the UK GDPR and the Data Protection Act 2018, where they are subject to such legislation. Where suppliers are located outside the United Kingdom, we take reasonable steps to ensure that appropriate safeguards are in place to protect your data, such as entering into standard contractual clauses approved by the relevant supervisory authority or verifying that the supplier is subject to binding data protection obligations in their jurisdiction.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Booking data, including your name, contact details, passport information, and transaction records, is retained for a minimum of six years from the date of your booking in order to comply with UK tax and accounting obligations under the Value Added Tax Act 1994 and the Companies Act 2006. This retention period also supports our legitimate interests in defending potential legal claims and resolving disputes.

Marketing data, including your email address and consent records for marketing communications, is retained until you unsubscribe from our marketing list or until you withdraw your consent. Technical data, including IP addresses, browser information, and usage analytics, is retained for a period of twelve months from the date of collection, after which it is either deleted or irreversibly anonymised. Customer support records, including correspondence, live chat transcripts, and support tickets, are retained for a period of three years from the date of the last interaction to assist with ongoing support, quality assurance, and dispute resolution.

At the end of the applicable retention period, your personal data is securely deleted or irreversibly anonymised so that it can no longer be used to identify you. Where deletion is not immediately possible due to technical limitations, your data will be isolated from further processing and securely deleted at the earliest opportunity. You may request the deletion of your personal data at any time, subject to our legal retention obligations as described above.

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data: the right of access, which allows you to request a copy of the personal data we hold about you; the right to rectification, which allows you to request the correction of inaccurate or incomplete personal data; the right to erasure (also known as the "right to be forgotten"), which allows you to request the deletion of your personal data, subject to certain legal exceptions; the right to restrict processing, which allows you to request that we limit the way in which we use your data; the right to data portability, which allows you to receive a copy of your personal data in a structured, commonly used, and machine-readable format; and the right to object to processing, which allows you to object to our use of your personal data in certain circumstances, including for direct marketing purposes.

You also have the right to withdraw your consent at any time where we rely on your consent as the lawful basis for processing your data. Withdrawing consent will not affect the lawfulness of processing carried out prior to the withdrawal. To exercise any of these rights, or if you have any questions or concerns about how we handle your personal data, please contact our Data Protection Officer at [email protected]. We will respond to your request within one calendar month of receipt. If your request is complex or we receive a high volume of requests, we may extend this period by a further two months, and we will notify you of any such extension.

We may need to verify your identity before processing your request to ensure that your personal data is not disclosed to an unauthorised person. You will not be charged a fee for exercising your rights unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request, in accordance with applicable legislation.

Our website uses cookies and similar tracking technologies to enhance your browsing experience, remember your preferences, and analyse website traffic. Cookies are small text files placed on your device when you visit a website. They serve various purposes, from ensuring the basic functionality of our site to enabling personalised experiences and measuring the effectiveness of our marketing efforts. We categorise cookies into the following types: essential cookies, which are strictly necessary for the website to function properly, including session cookies, security cookies, and load-balancing cookies, and these cookies cannot be disabled; analytics cookies, including Google Analytics, which collect anonymised information about how visitors use our website, including the number of visitors, the pages they visit, and the sources through which they arrived, and this data helps us improve our website and services; and marketing cookies, which are used to deliver relevant advertisements and track the performance of marketing campaigns, and these cookies are only set with your explicit consent.

We use Cookiebot to manage your cookie consent preferences. When you first visit our website, Cookiebot will present you with a consent banner that allows you to accept or reject non-essential cookies. You can change your cookie preferences at any time by clicking the "Manage cookie settings" link in the footer of any page on our website. For more detailed information about the specific cookies we use and their purposes, please refer to our Cookie Policy.

Please note that disabling certain cookies may affect the functionality of our website and limit your ability to use some features. You can also manage cookies through your browser settings, although this may require you to adjust your preferences each time you visit our site. For more information on managing cookies in your browser, please consult your browser's help documentation.

The Fly Easy is based in the United Kingdom, and your personal data is primarily stored and processed within the UK. However, some of our third-party suppliers and service providers are located in countries outside the UK, including the United States, the European Union, and other jurisdictions. When we transfer your personal data outside the UK, we ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws.

Where personal data is transferred to countries that have been deemed by the UK Government to provide an adequate level of data protection, no additional safeguards are required. Where transfers are made to countries that have not been deemed adequate, we rely on standard contractual clauses (SCCs) approved by the relevant supervisory authority, binding corporate rules, or other recognised transfer mechanisms to ensure that your data is afforded an equivalent level of protection. We conduct due diligence on our suppliers and service providers to verify the adequacy of their data protection practices before entering into data processing agreements.

You may request a copy of the standard contractual clauses or other transfer mechanisms used to protect your data by contacting our Data Protection Officer at [email protected]. We will provide you with the relevant information within a reasonable time.

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or damage. All data transmitted between your browser and our website is encrypted using Transport Layer Security (TLS), commonly known as SSL encryption, which ensures that your data cannot be intercepted or read by unauthorised parties during transit.

All payment processing is carried out through Stripe, which is certified as a PCI DSS Level 1 service provider, the highest level of certification available in the payments industry. Stripe's security infrastructure includes encryption of card data at rest and in transit, tokenisation, fraud detection systems, and regular security audits and penetration testing. We do not store full credit or debit card details on our servers at any time.

We conduct regular security assessments and vulnerability scans of our systems and infrastructure, and we maintain an incident response plan to address any data breaches promptly and in accordance with our legal obligations under the UK GDPR. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach and will notify you without undue delay where the breach poses a high risk to your rights and freedoms.

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16 without the explicit consent of a parent or legal guardian. If we become aware that we have collected personal data from a child under 16 without the requisite parental consent, we will take steps to delete that information as soon as possible. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us at [email protected] and we will take appropriate action.

Where a booking is made for a minor under the age of 16, the personal data provided in connection with that booking (such as the minor's name, date of birth, and passport details) is processed on the basis that the parent or guardian making the booking has the authority to provide that data and has obtained any necessary consent. Parents and guardians are responsible for ensuring that they have the legal authority to provide personal data on behalf of the minor and for reviewing this Privacy Policy to understand how we process their child's data.

We comply with all applicable laws and regulations relating to the collection and processing of children's personal data, including the provisions of the UK GDPR and the Children's Code (Age Appropriate Design Code) issued by the Information Commissioner's Office (ICO). If you have any concerns about how we handle children's data, please do not hesitate to contact our Data Protection Officer.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this policy, we will notify you by email (if you have provided your email address) and/or by displaying a prominent notice on our website prior to the changes taking effect. We encourage you to review this page periodically to stay informed about how we protect your personal data.

The date at the top of this policy indicates when it was last updated. Your continued use of our website and services following the posting of any changes to this policy constitutes your acceptance of those changes, except where consent is required by law, in which case we will obtain your consent before the changes take effect. We will not use your personal data for new purposes that are incompatible with the purposes for which it was originally collected without first informing you and, where required, obtaining your consent.

Previous versions of this policy will be archived and are available upon request. If you have any questions about any changes to this policy, please contact our Data Protection Officer at [email protected].

If you have any questions, concerns, or complaints about this Privacy Policy or the way in which we handle your personal data, please contact our Data Protection Officer using the details below:

Email: [email protected]
Phone: +1-833-391-3663
Address: Cheap Tickets Ltd (trading as The Fly Easy), Piccadilly Business Centre, Unit C Aldow Enterprise Park, Blackett Street, Manchester, M12 6AE, United Kingdom

We will endeavour to resolve any complaint within a reasonable timeframe and in accordance with our obligations under applicable data protection legislation. If you are not satisfied with our response or believe that our processing of your personal data does not comply with data protection law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection issues. You can contact the ICO at:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
United Kingdom
Website: ico.org.uk
Telephone: 0303 123 1113