Privacy Policy
This Privacy Policy explains how we, an independent UK-based travel agency, collect, use, share and protect your personal information when you use our website, mobile services, customer support channels and booking management tools. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who we are (Data Controller)
We ("we", "us", "our") are the data controller responsible for your personal information. You can contact our Data Protection Office at privacy@qatar-flights.example with any privacy-related questions or to exercise your rights.
2. Information we collect
We collect: (a) identity and contact data — your name, date of birth, gender, nationality, passport or ID details, email address, postal address and phone number; (b) booking and travel data — itinerary, frequent-flyer numbers, seat and meal preferences, special assistance requests, baggage and check-in details; (c) payment data — your card type, last four digits, billing address and payment confirmation tokens (full card numbers are processed by our PCI-DSS certified payment partners and are never stored on our servers); (d) technical data — IP address, browser type, operating system, device identifiers, cookies and similar technologies; (e) marketing preferences and communications history; (f) any information you choose to provide via forms, live chat, email or phone.
3. How we collect your data
We collect personal data directly from you when you search for or book a flight, manage an existing booking, complete online check-in, contact our support team, sign up to our newsletter, or interact with our advertisements. We also receive data from airlines, GDS providers, payment processors, fraud-prevention partners, and analytics and advertising platforms (including Google and Microsoft) when you give the relevant consent.
4. Lawful bases for processing (UK GDPR Article 6)
We rely on the following lawful bases: (a) performance of a contract — to issue tickets, process payments and deliver the travel services you request; (b) legal obligation — to comply with aviation, immigration, anti-money-laundering, tax and consumer-protection laws; (c) legitimate interests — to operate, secure and improve our website, prevent fraud, and provide customer support; (d) consent — for non-essential cookies, marketing emails, push notifications and certain personalised advertising.
5. How we use your data
We use your personal data to: search for and confirm flight bookings; issue tickets and receipts; pass passenger information to airlines, airports and government authorities (including Advance Passenger Information); manage check-in, baggage, seating and special requests; provide customer support; process refunds and changes; send service emails about your booking; comply with our legal obligations; detect and prevent fraud; and — only with your consent — send marketing communications and personalised offers.
6. Sharing your data
We share data only with parties that need it to deliver your booking or to support our lawful business operations: airlines and airline alliances; GDS and ticketing partners; airport authorities, border-control and immigration agencies; payment-service providers and card networks; fraud-prevention services; cloud hosting and IT-infrastructure providers; analytics and advertising partners (only with your consent); professional advisors (lawyers, accountants, auditors); and regulators or law-enforcement bodies where required by law. We never sell your personal data to third parties.
7. International transfers
Some of our partners (including airlines, technology providers and advertising platforms) are based outside the United Kingdom. When we transfer your data internationally we rely on UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), Standard Contractual Clauses or other lawful safeguards as required by UK GDPR.
8. Data retention
We keep your personal data only for as long as necessary for the purposes described above and to meet our legal, accounting and reporting obligations. Booking and payment records are retained for up to 7 years to comply with UK tax and consumer-protection law. Marketing data is kept until you withdraw consent. Website analytics data is typically anonymised within 26 months.
9. Your rights under UK GDPR
You have the right to: (a) be informed about how we use your data; (b) access a copy of your data; (c) request correction of inaccurate data; (d) request erasure (right to be forgotten); (e) restrict processing; (f) object to processing, including direct marketing; (g) data portability; (h) withdraw consent at any time. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
10. Cookies and similar technologies
We use cookies, pixels and similar technologies to operate our website, remember your preferences, measure performance and — with your consent — show relevant advertising on Google Ads, Microsoft Advertising and other partner networks. You can manage your preferences at any time using our cookie consent banner. Please see our Cookie Policy for full details.
11. Security
We use industry-standard technical and organisational measures, including TLS encryption in transit, encryption at rest, strict access controls, multi-factor authentication for staff, vulnerability scanning, penetration testing and 24/7 security monitoring.
12. Children's privacy
Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from children except as part of a booking made by a responsible adult.
13. Changes to this Policy
We may update this Privacy Policy to reflect changes in our practices or applicable law. The latest version is always available on this page; material changes will be highlighted at the top.
14. Contact us
Questions or requests? Email our Data Protection Office at privacy@qatar-flights.example or write to: Data Protection Office, London, United Kingdom.
Last updated: 1 May 2026.