Privacy notice
Version 2026-10-22, last updated 22 October 2026.
Who we are
FlipAir is run by Flip Air Ltd, Unit 2 & 6, Mill St E, Savile Town, Dewsbury, West Yorkshire, WF12 9AQ. We decide how your personal information is used (we are the "controller"). Flip Air Ltd is registered in England and Wales, company number 16958413. Registered office: Unit 2 Mill Street East, Dewsbury, England, WF12 9AQ.
For anything about your information, email admin@flip-air.co.uk or call 01924 430504. We have not appointed a data protection officer; these contacts reach the people responsible.
What we collect, why, and for how long
| What | Why we use it | Legal basis | How long we keep it |
|---|---|---|---|
| Booking details: your name, email address and phone number; the date, time and type of visit; how many people are coming; extras; payment status; any cancellation, refund or change. | To take and manage your booking, send your confirmation, let you in, and handle changes, cancellations and refunds. | Contract (your booking). Keeping the records afterwards is a legal obligation (accounting). | 6 years after the booking, as UK accounting law requires. |
| Card payments: you type your card details into Global Payments' secure fields. They go straight to Global Payments; we never see or store your full card number. We keep the payment reference and amount. For 3-D Secure, our website sends Global Payments your email address, your internet address and details of your browser (such as its type, screen size, language and time zone). Your browser may also connect directly to your card issuer. Global Payments and your card issuer use these details to check it is really you. | To take payment, check it is really you (3-D Secure), and refund you when needed. | Contract; legal obligation (payment and fraud rules). | Payment references stay with the booking (6 years). |
| Prize box ("spin for a discount"): a random key your browser keeps in a cookie (we store only a scrambled copy), your result, and a scrambled one-way code made from your internet connection's address (never the address itself). When you claim: that you confirmed you are 18 or over and when; for a discount we email, the email address you type and a tidied-up copy used only to allow one claim per address, and whether our email to it was delivered; the discount and code you got. If an address claims again from another browser, we record that the later spin was for an address that had already claimed. If you tick the offers box, a record of that tick and, where we ask you to confirm, of your confirmation. | To show you the same result when you come back, to give you the discount code you claimed, to make sure an emailed code only works for the address it was sent to and that each address claims once, and to stop automated or bulk abuse. | Contract (the code you were promised); legitimate interests (a fair promotion, preventing abuse). | The browser key and the connection code are deleted when claims close (for a code shown on screen, when that code ends). The rest is kept up to 12 months after the promotion closes, then deleted or made anonymous. A code used on a booking stays with that booking's records. |
| Offers by email, only if you tick the box: your email address, the exact words you agreed to, when and where you agreed, and when you unsubscribed. | To email you FlipAir offers, discount codes and event news. | Your consent. You can withdraw it at any time with the unsubscribe link in every email, or by contacting us. Withdrawing never cancels a discount code. | Until you unsubscribe. After that we keep the record of your agreement and your unsubscribe as proof, and a short "do not email" entry so you are never added again by mistake. |
| Messages you send us: cancellation requests, emails and phone calls. | To answer you and sort out your booking. | Contract; legitimate interests (customer service). | With the booking they relate to, or up to 2 years otherwise. |
| Website security: technical records of requests to our website (internet address, browser type, pages requested) and reports of blocked scripts. | To keep the website and payments secure and to investigate problems. | Legitimate interests (security). | A short time, normally no more than 90 days. |
We keep backup copies of our booking system so we can restore it after a fault. Our nightly backups are encrypted. Those kept on the server that runs our booking system are deleted automatically after six months at most. Those stored with Cloudflare are deleted automatically after 90 days. We also keep a copy taken just before each of our last ten updates to the website, on the same server.
Children
Bookings are made by adults. When you book online we ask how many children are coming, not their names or details.
Discount codes from the prize box are for adults. Anyone can spin without giving any details; to claim a discount you confirm you are 18 or over, and we ask for that before we take an email address. If we learn we hold a child's email address, we delete it.
Who helps us, and where your information goes
We do not sell your information and we do not share it for other companies' marketing. These companies process it for us, under contract and only on our instructions:
- Global Payments (UK): card payments and 3-D Secure.
- Resend, Inc. (United States): sends our emails (booking confirmations, discount codes and, if you agreed, offers) and holds our mailing list of people who agreed to offers.
- Contabo: hosts the server and database that run our website and booking system.
- Cloudflare, Inc. (a US company): stores our encrypted backup copies in the European Union.
- Microsoft (Microsoft 365): our email inboxes, if you email us.
Our web pages also load an icon font from Google Fonts (Google LLC, United States). When a page opens, your browser fetches the font from Google's servers, which means Google receives your internet address and basic browser details. We do not send Google anything else.
Where a provider is in the United States, the transfer is protected by safeguards approved under UK law. Ask us for details.
We may also share information where the law requires it, for example with the police or a court.
Cookies and browser storage
We do not use advertising or analytics cookies. If you use the prize box, we set one cookie. It holds a random key that links this browser to your spin (and, once you claim, to your discount); it holds no name or email address itself. Only our website can read it, and it lasts until claims close or, for a code shown on screen, until that code ends. Our website also keeps a few small notes in your own browser so it works the way you would expect: that you have already seen the opening-hours pop-up, and that you have already seen the prize box invitation, so we do not ask you again. Those notes never leave your browser. You can clear all of these at any time in your browser settings; if you clear the prize box cookie, the prize box forgets your spin.
Your rights
You have the right to:
- get a copy of the information we hold about you;
- have it corrected if it is wrong;
- have it deleted, where we have no legal reason to keep it;
- ask us to restrict or stop using it;
- object to how we use it, including the right to stop direct marketing at any time, which always succeeds;
- receive information you gave us in a format you can take elsewhere;
- withdraw your consent at any time (this does not affect what we did before).
To use any of these rights, email admin@flip-air.co.uk. We will reply within one month.
If you are unhappy with how we have used your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113.
Changes to this notice
If we change how we use your information, we will update this page and its version number. Each offers agreement we record notes the version you were shown.