Privacy policy.

We collect the personal data we need to fly you safely and to process your booking-nothing more. We never sell your data, and we don’t share it with marketing networks.

• What we collect: name, email, phone, weight, payment token.
• Why: to confirm your booking and weigh-and-balance your flight.
• How long: as required by aviation law (typically 5 years for flight manifests).
• Your rights: access, correction, deletion, portability, and complaint to a supervisory authority.

Golden Horizon Ballooning Ltd, a company registered in England and Wales ("we", "us"), is the data controller for the information collected through this website and our booking flow. We handle personal data under the UK GDPR and the Data Protection Act 2018. Flights are operated in Morocco, so booking and manifest data is also processed there by our ground and flight crews. For any privacy matter, write to contact@ghballooning.com.

To complete a booking we need:

• Identity-full name, date of birth (lead passenger), photo ID at the field.
• Contact-email and phone number.
• Weight-required for basket weight-and-balance.
• Payment-handled by Stripe; we store a token, never your card number.
• Account credentials-if you create an account, your password is stored hashed (we never see it).

For the website we also process technical data: IP address, browser type, anonymised page views. We do not use third-party advertising trackers.

• Contract performance-to confirm your booking and operate your flight.
• Legal obligation-to keep flight manifests for aviation regulators.
• Legitimate interest-fraud prevention, service quality, and direct replies to your enquiries.
• Consent-for the newsletter and any non-essential analytics. Both are opt-in and can be withdrawn at any time.

We work with a small number of service providers, each bound by written data-processing agreements:

• Stripe-payment processing.
• Vercel-website hosting.
• Resend / Postmark-transactional email.
• Aviation regulators-flight manifests, when required.

We never sell personal data, never share it with advertising networks, and never use it to profile you.

• Flight manifests-5 years (regulatory requirement).
• Account data-for as long as your account exists, plus 90 days after deletion.
• Newsletter subscriptions-until you unsubscribe.
• Server logs-30 days.

You have the right to:

• Access-a copy of the personal data we hold.
• Rectify-correct anything that’s wrong.
• Delete-the "right to be forgotten," subject to retention requirements above.
• Restrict / object-pause or stop certain processing.
• Portability-receive your data in a machine-readable format.
• Complain-to the Information Commissioner's Office (ICO) in the United Kingdom, or to your local data-protection authority if you are outside the UK.

Email contact@ghballooning.com and we’ll respond within 30 days.

Nothing beyond the strictly necessary is set until you say so. On your first visit a banner asks which of the four groups below we may use, and your answer is stored for six months.

• Strictly necessary-your session, your basket and secure payment, plus the cookie recording this very choice. These have no opt-out; without them the site cannot take a booking.
• Preferences-remember your language and currency between visits.
• Analytics-anonymised statistics about which pages are visited, so we can improve them.
• Marketing-measure our advertising and show you relevant offers elsewhere.

You can change or withdraw your answer at any time from the Cookies link in the footer-withdrawing is exactly as easy as accepting.