Privacy Notice
This notice explains how flyMeUp collects and uses your personal data when you ask us to check a flight and pursue a compensation claim, and your rights under the UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and, for passengers in the EEA, the EU GDPR.
1. Who we are
flyMeUp is the data controller. Registered entity: [REGISTERED COMPANY NAME], company no. [COMPANY NUMBER], [REGISTERED ADDRESS]. Data protection contact: [email protected].
2. The data we collect
- Your name, email address and (optionally) phone number.
- Flight details: number, date, route and what went wrong.
- If you scan a boarding pass, its barcode data — decoded on your device; only the resulting data is sent, and only if you submit.
- A record of the authorisation you gave and when.
- Technical data such as your IP address, needed to deliver and secure the website.
3. Why we use it, and our lawful basis
- To assess and pursue your claim — performance of our agreement with you (UK GDPR Art 6(1)(b)).
- To check flight eligibility and prevent fraud — our legitimate interests (Art 6(1)(f)). The eligibility check is advisory; a person reviews it before any decision.
- To meet legal obligations — where the law requires it (Art 6(1)(c)).
4. Who we share it with
The operating airline (to make your claim); where necessary regulators, courts and our legal advisers; our payment provider (to pay your compensation); and our IT service providers acting under contract (cloud hosting, email and flight-data services). We do not sell your data.
5. Where your data is stored (international transfers)
Your case data is stored within the European Economic Area. Where a service provider processes data outside the UK/EEA, we rely on appropriate safeguards (UK adequacy, the UK International Data Transfer Agreement/Addendum, or Standard Contractual Clauses).
6. How long we keep it
We keep claim records for the duration of your claim and a limited period afterwards (generally up to 6 years, aligned with the limitation period for contract claims), then delete them. Incomplete or abandoned enquiries are deleted sooner. See our retention schedule for details.
7. Your rights
You have the right to access, rectify, erase, restrict, port or object to the processing of your data, and to withdraw the authorisation you gave us. To exercise any right, email [email protected]. We may keep data we still need to pursue or defend an active legal claim.
8. Complaints
If you're unhappy with how we handle your data, please contact us first at [email protected] — we will acknowledge within 30 days. You can also complain to the UK Information Commissioner's Office at ico.org.uk.
9. Cookies
We use a small number of functional cookies only — see our Cookie Notice.
10. Changes
We may update this notice; the “last updated” date above shows the current version.
This template is provided for implementation and must be reviewed and completed by a qualified data protection adviser before launch.