What we collect, who sees it, and what you can do about it.
Arranging a flight means handling personal details, some of them sensitive, and passing some of them to the operator who flies you. This page sets out exactly what we hold, on what basis, who else sees it, how long we keep it, and how to make us stop.
The Zonda Group Ltd is the data controller for everything described here. Last updated 7 October 2026.
Five situations, and what each one involves.
When you ask for a quote
Your name, email address, phone number if you give it, who the booking is for, and the trip: airports, dates, number of passengers and anything else you tell us. We use it to get quotes from operators and to reply to you. Operators see the trip details, not your contact details, until you decide to book. Lawful basis: steps taken at your request before entering a contract, and our legitimate interest in responding to someone who has contacted us.
When you book
For each passenger: full name, date of birth, nationality, and passport or identity document details where the operator or border authorities require them, plus contact details for the lead passenger. We pass these to the operator so it can carry out the flight, and the operator passes what the law requires to handling agents and to border and immigration authorities. Lawful basis: performance of a contract, and legal obligation where authorities require the information.
When a passenger has particular needs
If you tell us about mobility assistance, medical equipment or a medical condition so that the operator can prepare for it, that is health information. We use it only with your explicit consent, pass it only to the operator, and only for that flight.
When we contact you first
Your name, business role and business contact details, collected from a public source such as your employer's website, a professional network, a public register or a published business directory. We tell you which one in the first message. Lawful basis: legitimate interests, being the interest in offering a professional service to a business. Reply "stop" and we will not contact you again.
When you visit this site
A page view count, and nothing that identifies you. We use aggregate, cookieless analytics. No cookies are set and no individual is identified.
The list matters more than the assurances.
- We do not sell, rent or share your personal data for anyone else's marketing.
- We do not pass passenger details to anyone except the operator flying you, and through it the handling agents and authorities that require them.
- We do not keep passport or identity document details once the trip is complete.
- We do not make automated decisions about you that produce legal or similarly significant effects.
- We do not track you across other websites.
The operator, and six service providers under contract.
When you book, the operator receives the passenger details it needs and becomes responsible for them as a controller in its own right, under its own privacy notice. We send you the operator's name with the quote, before anything is shared.
| Service provider | What for | Where |
|---|---|---|
| Cloudflare | Serves this website. Sees the IP address of every visitor in the course of delivering the page | United States, served from a UK or EU edge |
| Formspree | Delivers quote request forms to us | United States |
| Zoho | Our email and document storage, including booking records | European Union |
| Calendly | Scheduling, if you book a call | United States |
| GitHub | Our internal business records. Passport and identity document details are never stored there | United States |
| Anthropic | Drafts our correspondence and maintains internal records under our instruction. It is not given passport or identity document details and is not used to make decisions about you | United States |
Transfers outside the United Kingdom rely on the UK International Data Transfer Addendum or on UK adequacy regulations. Ask us for the detail and we will send it.
We will disclose information if the law requires it. Nothing else.
Retention.
| What | Kept for |
|---|---|
| Quote requests that do not become bookings | 12 months from last contact |
| Passport and identity document details | Until the trip is complete, then deleted |
| Health information given for a flight | Until the trip is complete, then deleted |
| Booking records, invoices and correspondence | 6 years from the end of the trip, for tax and legal records |
| A record that you asked not to be contacted | Indefinitely, solely so we can honour it |
What you can require of us.
You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it over in a portable form. You can object to our use of legitimate interests, including for direct approaches, and you can withdraw consent where we relied on it. Withdrawing consent for health information before a flight means the operator will not have it.
Write to us at hello@thezondagroup.co.uk. We respond within one month. For details already passed to an operator, we will tell you which operator holds them and pass your request on.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.
We will say so.
We will update this page when our processing changes, and revise the date at the top. We will not quietly widen what we do with your data and leave you to notice.