Privacy policy.

We collect the personal data we need to fly you safely and to process your booking-nothing more. We never sell your data, and we don’t share it with marketing networks.

• What we collect: name, email, phone, weight, payment token.
• Why: to confirm your booking and weigh-and-balance your flight.
• How long: as required by aviation law (typically 5 years for flight manifests).
• Your rights: access, correction, deletion, portability, and complaint to a supervisory authority.

Golden Horizon Ballooning Ltd, a company registered in England and Wales ("we", "us"), is the data controller for the information collected through this website and our booking flow. We handle personal data under the UK GDPR and the Data Protection Act 2018. Flights are operated in Morocco, so booking and manifest data is also processed there by our ground and flight crews, under Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data. For any privacy matter, write to contact@ghballooning.com.

To complete a booking we need:

• Identity-full name, date of birth (lead passenger), photo ID at the field.
• Contact-email and phone number.
• Weight-required for basket weight-and-balance.
• Payment-handled by Stripe; we store a token, never your card number.
• Account credentials-if you create an account, your password is stored hashed (we never see it).

For the website we also process technical data: IP address, browser type, anonymised page views. We do not use third-party advertising trackers.

• Contract performance-to confirm your booking and operate your flight.
• Legal obligation-to keep flight manifests for aviation regulators.
• Legitimate interest-fraud prevention, service quality, and direct replies to your enquiries.
• Consent-for the newsletter and any non-essential analytics. Both are opt-in and can be withdrawn at any time.

Because your flight is prepared and operated in Morocco, the personal data we use for it is also protected by Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data, which is supervised by the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

Under that law you have the right to:

• Access-ask whether we hold data about you, and receive it in an intelligible form.
• Rectification-have data that is inaccurate or incomplete corrected, erased or blocked.
• Opposition-object, on legitimate grounds, to your data being processed, and object at no cost to its use for marketing.

To exercise any of them, write to contact@ghballooning.com. If you are not satisfied with our answer you can refer the matter to the CNDP at cndp.ma.

We work with a small number of service providers, each bound by written data-processing agreements:

• Stripe-payment processing.
• Vercel-website hosting.
• Resend / Postmark-transactional email.
• Google Analytics / Microsoft Clarity-site analytics and usage recordings, only if you accept analytics cookies.
• Aviation regulators-flight manifests, when required.

We never sell personal data, never share it with advertising networks, and never use it to profile you.

Your data is used in Morocco, where we fly, and in the United Kingdom, where the company is registered. Some of the providers listed above store or process it in other countries, including member states of the European Union and the United States.

We send abroad only what each provider needs to do its job, under contractual safeguards that keep it protected to the standard described in this policy.

• Flight manifests-5 years (regulatory requirement).
• Account data-for as long as your account exists, plus 90 days after deletion.
• Newsletter subscriptions-until you unsubscribe.
• Server logs-30 days.

You have the right to:

• Access-a copy of the personal data we hold.
• Rectify-correct anything that’s wrong.
• Delete-the "right to be forgotten," subject to retention requirements above.
• Restrict / object-pause or stop certain processing.
• Portability-receive your data in a machine-readable format.
• Complain-to the Information Commissioner's Office (ICO) in the United Kingdom, to the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) in Morocco, or to your local data-protection authority.

Email contact@ghballooning.com and we’ll respond within 30 days.

Bookings can only be made by someone aged 18 or older. We ask the person booking to confirm this at checkout and keep a record of the confirmation; photo ID is checked at the launch field.

Children can fly, but only on a booking made by an adult. Their name and the details needed for the passenger manifest are given to us by that adult, who confirms they are the child’s parent or legal guardian or have that person’s consent. We do not knowingly collect personal data directly from anyone under 18, and our newsletter is not intended for them. If you believe a child has given us their data, write to contact@ghballooning.com and we will delete it.

Nothing beyond the strictly necessary is set until you say so. On your first visit a banner asks which of the four groups below we may use, and your answer is stored for six months.

• Strictly necessary-your session, your basket and secure payment, plus the cookie recording this very choice. These have no opt-out; without them the site cannot take a booking.
• Preferences-remember your language and currency between visits.
• Analytics-anonymised statistics about which pages are visited, and recordings of how pages are used (clicks, scrolling and mouse movement, with anything you type masked), so we can improve them. These are collected by Google Analytics and Microsoft Clarity.
• Marketing-measure our advertising and show you relevant offers elsewhere.

You can change or withdraw your answer at any time from the Cookies link in the footer-withdrawing is exactly as easy as accepting.