Below you will find information about who controls your data, for what purposes and on what legal bases we process it, to whom we transfer it, and what rights you have.
The controller of personal data processed in connection with the use of the bookaballoon.com portal is Maciej Szymczuk conducting business under the name Book a Balloon, NIP 9661876768, REGON 387074085, ul. Horodniany 36, 16-001 Kleosin. Contact for data protection matters: office@bookaballoon.com, Book a Balloon, Horodniany 36, 16-001 Kleosin. In connection with a specific balloon flight, data may be transferred to the Flight Operator indicated in the offer or booking. The Operator may act as an independent data controller with respect to the organisation and execution of the flight and their own legal obligations.
Book a Balloon is a portal enabling users to search for, book, and purchase balloon flights, as well as contact flight operators. The seller or provider of the flight service is the Operator indicated in the relevant offer, unless the offer states otherwise. The portal may also handle quote requests, vouchers, tethered display events, and the operator panel.
We process the following categories of personal data depending on the person:
| Category of person | Example data |
|---|---|
| User visiting the portal | IP address, cookie identifiers, device and browser data, technical logs, information about activity on the portal |
| Buyer or person booking a flight | first name, last name, email, phone number, booking data, booking code, payment status, invoicing data, correspondence |
| Flight passenger | first name, last name, flight organisational data, passenger weight if necessary for the safe organisation of the flight and preparation of the manifest |
| Person sending a query to an operator or about a tethered display | first name, email, phone number, message content, event data, location, date, number of participants, data needed to prepare a quote |
| Operator, pilot, crew member | operator account data, contact details, role, pilot licence data, flight assignments, pilot logbook data, operator billing data, fleet and document data |
| User subject to analytics or marketing | cookie identifiers, purchase events, traffic sources, campaigns, advertising identifiers, consent information |
We process personal data for the following purposes and on the following legal bases:
| Purpose | Legal basis | Retention period |
|---|---|---|
| Use of the portal, security, session management, abuse prevention | Art. 6(1)(f) GDPR — legitimate interest of the controller; no consent required for necessary cookies | session duration or period necessary for abuse prevention |
| Creation and management of a user or operator account | Art. 6(1)(b) GDPR — performance of the account agreement | for the duration of the account, then until the limitation period for claims expires |
| Accepting and handling bookings, purchasing a flight, payment, voucher, contact regarding dates and weather | Art. 6(1)(b) GDPR — performance of a contract or pre-contractual actions | for the duration of performance, then until the limitation period for claims expires |
| Transferring data to the relevant Flight Operator to fulfil the booking | Art. 6(1)(b) GDPR — performance of the booking agreement; alternatively Art. 6(1)(f) GDPR — legitimate interest in transferring data to the service provider | for the duration of the booking and flight |
| Preparing the passenger manifest, flight operational plan, and safe balloon balancing, including processing of passenger weight | Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR — safe organisation and execution of the flight | for the period necessary to execute and document the flight |
| Handling quote requests, enquiries to operators, and tethered display events | Art. 6(1)(b) GDPR — pre-contractual actions or Art. 6(1)(f) GDPR — handling communications and forwarding the enquiry to the relevant operator | 12 months from last contact |
| Sending confirmations, transactional messages, SMS, and organisational emails | Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR — efficient booking management | for the duration of the booking |
| Issuing and storing invoices, tax and accounting settlements | Art. 6(1)(c) GDPR — legal obligation | 5 years from the end of the tax year (tax regulations) |
| Complaints, incident handling, establishing, pursuing, or defending claims | Art. 6(1)(f) GDPR and, to the extent of legal obligations, also Art. 6(1)(c) GDPR | until the limitation period for claims expires |
| Analytics, advertising effectiveness measurement, remarketing, Google Analytics, Google Ads, Google Tag Manager, marketing cookies, and referral attribution | Art. 6(1)(a) GDPR — consent; with respect to writing/reading information from a terminal device, also consent required under the Electronic Communications Act | until consent is withdrawn or the cookie/identifier expires |
| Direct marketing by email, SMS, telephone, or similar, where conducted | Art. 6(1)(a) GDPR — consent; additionally, Electronic Communications Act provisions on marketing communications | until consent is withdrawn |
| Crew data, pilots, pilot logbook, licences, and settlements in the operator panel | depending on the function: the Operator as controller and Book a Balloon as processor under a data processing agreement; for managing the operator's own account — Art. 6(1)(b) or (f) GDPR | in accordance with the agreement with the operator and the DPA |
The portal does not envisage collecting special categories of data within the meaning of Article 9 GDPR, such as health data. Passenger weight is collected only when it is necessary for the safe preparation of the flight, balancing the balloon, and preparing the passenger manifest. You should not enter additional health information, medical restrictions, or other special category data in the forms unless a specific feature expressly requires it and is covered by a separate information notice.
Personal data may be transferred to the following recipients or categories of recipients:
| Recipient / category of recipient | Purpose of sharing |
|---|---|
| Flight Operator | execution of the flight, contact with passengers, preparation of the manifest and operational plan |
| Stripe | online payment processing and payment status management |
| Supabase / Supabase Storage | database, data and document storage, application infrastructure |
| Twilio / Twilio SendGrid | sending SMS, transactional emails, confirmations, and notifications |
| Vercel | hosting, portal infrastructure, and analytics where consent has been given |
| Google Analytics / Google Tag Manager / Google Ads | analytics, conversion measurement, advertising, remarketing — after obtaining consent for the relevant cookies |
| Google Cloud | cloud/OCR services, where actually used in a given feature |
| Upstash | rate limiting, security, and abuse prevention |
| Sentry / Healthchecks.io | error monitoring and technical task monitoring; configuration should minimise personal data |
| Open-Meteo | weather data for flight planning; in accordance with the technical description, without transferring passenger personal data |
| Accounting firms, lawyers, auditors, public authorities | settlements, legal obligations, claims, inspections |
Some service providers used by the portal may process data outside the European Economic Area, in particular in the United States. This applies in particular to providers of analytics, advertising, payment, communication, and infrastructure tools. Where data is transferred outside the EEA, the controller applies the mechanisms required by the GDPR, in particular European Commission adequacy decisions, the EU-US Data Privacy Framework where the provider is certified, or standard contractual clauses.
We retain personal data for the following periods: • User account data — for the duration of the account, then until the limitation period for claims or accountability actions expires. • Booking and flight purchase data — for the duration of the booking, then until the limitation period for claims expires. • Payment and accounting data — for the period required by tax and accounting regulations, usually 5 years from the end of the tax year. • Manifest data, operational plan, and passenger weight — for the period necessary to execute and document the flight; longer only where data is needed for an incident, complaint, or claim. • Quote requests and leads — for the duration of the enquiry, then for 12 months from the last contact, unless a contract was concluded or the data is needed to defend a claim. • Referral visits and attribution data — for 12 months necessary for campaign settlement/analysis, then in aggregated or anonymised form. • Cookie/analytics/marketing data — until consent is withdrawn or the cookie/identifier expires. • Operator, pilot, and crew data — in accordance with the agreement with the operator and the DPA; data is deleted or returned in accordance with the operator's instructions, unless Book a Balloon has its own legal basis for further retention.
The data subject has the right to access their data, obtain a copy of their data, rectify their data, erase their data, restrict processing, port their data, object to processing based on legitimate interest, and withdraw consent at any time where processing is based on consent. To exercise these rights, please contact the controller at: office@bookaballoon.com. The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO).
Purchasing or booking a flight does not require giving marketing consent. Messages necessary for the handling of a booking, payment, rescheduling, weather updates, the manifest, or the execution of the flight may be sent within the scope of contract performance or legitimate interest. Consent is required for newsletters, email/SMS/telephone marketing communications, and for cookies and similar technologies used for analytics, advertising, remarketing, or attribution where they are not necessary for the operation of the portal.
The portal does not make decisions regarding users based solely on automated processing that would produce legal effects or similarly significantly affect users. Following consent to marketing or analytics cookies, user activity may be used for marketing profiling, advertising effectiveness measurement, and remarketing.
The controller applies technical and organisational measures designed to protect data against unauthorised access, loss, alteration, or disclosure. Access to data should be restricted to persons who need it for the handling of bookings, payments, flight execution, system security, settlements, or claims management.
This privacy policy may be updated in connection with changes to the portal, changes to providers, features, legislation, or data processing practices. The current version of the policy is available at bookaballoon.com.