Legal & Policies
GDPR Policy
EU GDPR, UK GDPR, and Swiss FADP privacy notice
Last updated: September 28, 2026 · BookAeroFare.com
1. Who we are
The data controller is People Information, LLC, doing business as Book Aero Fare (bookaerofare.com).
People Information, LLC
2101 W San Juan Ave Suite 2, Phoenix, AZ 85015, USA
Privacy: privacy@bookaerofare.com
Bookings & support: support@bookaerofare.com
Phone: +1 (800) 903-1468 (24/7, Arizona time)
We have not appointed a Data Protection Officer because our core activity is travel agency services, not large-scale monitoring or processing of special-category data as a business model. Privacy requests go to privacy@bookaerofare.com.
We are established in the United States. We do not currently appoint an EU or UK Article 27 representative. If that changes, this page will be updated. You can always write to us at the address and email above.
2. Personal data we process
We collect data you give us, data created when you use the site, and data needed to ticket a flight with the airline.
| Category | Examples |
|---|---|
| Identity | Name, date of birth, gender, nationality, passport or other travel-document details where the itinerary requires them |
| Contact | Email, phone, billing address |
| Booking | Route, dates, cabin, passenger list, quoted fare, Book Aero Fare reference, airline PNR after we ticket |
| Payment | Card last four digits, card brand, and a token stored with our payment processor. We do not store the full card number or CVV |
| Communications | Emails, contact-form messages, and call notes. If a call is recorded, we say so on the call |
| Technical | IP address, browser type, device, pages viewed, and security logs from our host and CDN |
| Cookies | Necessary cookies to run the site. Analytics and ads cookies only if you accept on the cookie banner |
Passport and nationality are used to issue an airline ticket, not to infer special-category characteristics. Please do not send health or other special-category data unless we ask for it for a specific airline request (for example a medical waiver). If you do, we process it only to submit that request, with your consent or as needed to protect vital interests.
3. Why we process it and the legal basis
| Purpose | Legal basis |
|---|---|
| Take a booking request, vault the card, ticket on our GDS, charge when the ticket is issued, and email the airline PNR | Art. 6(1)(b) contract |
| Customer support, changes, cancellations, and upgrades you ask us to submit to the airline | Art. 6(1)(b) contract |
| Tax, accounting, aviation security, and Seller of Travel rules (we do not sell travel to residents of CA, FL, WA, HI, or IA) | Art. 6(1)(c) legal obligation |
| Fraud prevention, keeping the site secure, and defending legal claims | Art. 6(1)(f) legitimate interests |
| Google Analytics and Google Ads cookies, conversion tags, and remarketing | Art. 6(1)(a) consent — only after you accept optional cookies |
| Marketing emails we do not need for the booking itself | Art. 6(1)(a) consent, which you can withdraw |
For a contract, you must provide the identity, contact, and payment details we ask for. If you do not, we cannot submit the booking. Optional cookies are not required to search fares or submit a request.
4. Who we share data with
We share personal data only as needed to run Book Aero Fare. We do not sell your personal data.
- Airlines and Amadeus GDS — a Book Aero Fare agent tickets your itinerary. The airline is a separate controller of the ticket and PNR.
- NMI / Network Merchants — stores the card token and charges it when we issue the ticket.
- Duffel — used only to display live fares. We do not create a Duffel order from this website.
- Resend — sends booking-received and ticket-issued emails.
- Vercel and Neon — host the website and booking database.
- Cloudflare — DNS, CDN, and security.
- Google LLC — analytics and ads, only if you accept optional cookies.
- Professional advisers, insurers, or authorities when the law requires it.
5. International transfers
People Information, LLC is in the United States. If you are in the EEA, UK, or Switzerland, your data is transferred to the US and may be processed by the vendors listed above, some of which are also outside the EEA.
Where a transfer needs a safeguard, we rely on the mechanism the vendor provides: the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, and — where the vendor is certified — the EU-US / UK-US Data Privacy Framework. Airline and GDS transfers also follow the contract of carriage for your ticket.
6. How long we keep data
- Booking and payment records: up to 7 years after the trip (tax and accounting).
- Card vault: until the ticket is issued and charged, or until we cancel the request and delete the stored card.
- Fare-search session data: only as long as needed to complete the request (typically hours, not months).
- Support emails and call notes: up to 2 years, unless a longer period is required for a dispute.
- Call recordings (if made): up to 90 days.
- Optional cookies / marketing: until you withdraw consent or the cookie expires.
- Security logs: typically up to 12 months.
You may ask us to delete data sooner. We will do so unless we must keep it for a legal obligation or to establish, exercise, or defend a legal claim.
7. Your rights
Subject to GDPR / UK GDPR limits, you may:
Access (Art. 15)
Ask whether we process your data and receive a copy, including purposes and recipients.
Rectification (Art. 16)
Ask us to correct inaccurate or incomplete data without undue delay.
Erasure (Art. 17)
Ask us to delete data when it is no longer needed, consent is withdrawn, or processing was unlawful.
Restriction (Art. 18)
Ask us to store but not use the data while a dispute or claim is pending.
Portability (Art. 20)
Receive data you provided in a structured, machine-readable format, where processing is based on consent or contract and is automated.
Object (Art. 21)
Object to legitimate-interest processing. You may always object to direct marketing.
Automated decisions (Art. 22)
We do not make solely automated decisions that produce legal or similarly significant effects. A person reviews ticketing.
Withdraw consent
Where we rely on consent (optional cookies or marketing), you can withdraw it at any time. That does not affect processing already done.
Email privacy@bookaerofare.com with the subject “GDPR request.” Tell us which right you want to use and enough detail to find your records (name, email, booking reference if you have one). We may need to verify your identity. We respond within one month. If the request is complex, we may take up to two further months and will tell you why. The first request is free unless it is excessive or unfounded.
To turn off optional cookies, use Decline optional cookies on our banner, or clear site data for bookaerofare.com and choose again. See the Cookie Policy.
8. Children travelling as passengers
The website is not directed at children. An adult may include a child’s details as a passenger. That adult is responsible for providing accurate information and for any consent the law requires. We do not knowingly use children’s data for marketing.
9. Complaints
Please contact privacy@bookaerofare.com first so we can try to fix the issue. You also have the right to complain to a supervisory authority in your country of residence, place of work, or where you think the infringement happened:
- EEA: your national data protection authority. The list is at edpb.europa.eu.
- UK: Information Commissioner's Office — ico.org.uk.
- Switzerland: Federal Data Protection and Information Commissioner — edoeb.admin.ch.
10. Changes
We will post updates on this page and change the “Last updated” date. If a change is material, we will provide a more prominent notice where appropriate.
Related pages: Privacy Policy · Cookie Policy · CCPA Notice · Fulfillment Policy · Advertiser Disclosure.