Privacy policy

1. Information we collect

1.1 When you place an order, you give us the following details for each passenger: gender, age group, first name, last name and, where the airline requires it, date of birth. For the order as a whole, you give us one email address, an optional note, the flight you chose, the validity option you selected and, if you choose one, a scheduled delivery time. We also record the language you placed the order in.

1.2 Your card details go straight to our payment provider and never reach our servers. We keep only the card brand and the last four digits of the card; if you pay with your PayPal account, we keep neither. We also keep the messages our payment provider sends us about your payment. These may include details the provider holds about the person who paid, such as their name.

1.3 We also collect some information automatically. When you visit the Site, we check which country your connection comes from. We use this only to decide whether we must ask for your consent to cookies first, and we do not store it. When you place an order, we save your browser’s user-agent string with the order; this is a short piece of text that describes your browser and device. If Google Analytics has set its identifier in your browser, we save that identifier with the order too. If measurement is switched on (see section 2), Google Analytics records which pages you view and which steps of the order you reach. We do not store your IP address.

1.4 If you arrive from an advertisement, the link you followed may contain a click identifier and campaign details from Google, Meta or TikTok. We keep these, together with the page you first landed on and the website that referred you, and save them with your order.

1.5 If you use our contact form, we receive your email address, your order code if you give one, and your message. Your message is delivered to our support mailbox, where we keep the correspondence.

2. Cookies

2.1 The Site uses cookies and similar browser storage. They fall into two groups:

• “Strictly necessary” cookies keep what you are typing, remember the language you chose and your cookie choice, and remember for the length of your visit whether we need to ask for your consent. They are always on, because the Site does not work without them.
• “Measurement” cookies count how many people reach each step of an order, in Google Analytics. Google Analytics sets its own cookies.

2.2 If you are in the European Economic Area, a banner asks for your consent before measurement starts. Until you agree, Google receives only basic signals that do not set or read any cookies. Everywhere else, measurement is on from the start. Wherever you are, you can change your choice at any time under “Cookie settings” in the footer.

2.3 We do not use advertising cookies, and the Site does not load Meta or TikTok tracking tags.

3. Where we store your data

3.1 We take appropriate security measures to protect your data against unauthorised access, disclosure, alteration or destruction. Connections to the Site are encrypted, and our database backups are encrypted before they leave our systems.

3.2 The Site, our database and our backups are hosted by service providers that store and process data in several countries, possibly outside the country where you live. The same applies to the payment, email and advertising providers named in section 5.

3.3 By giving us your data, you agree to this transfer, storage and processing. We take reasonable steps to make sure your data is kept secure and handled in line with this policy.

4. How we use it

We use your data to:

• place your reservation with the airline and send you the booking reference and the confirmation file;
• process and check your payment, refund it when necessary, and detect fraudulent payments;
• keep you informed about your order and reply when you contact us;
• keep accounting records and meet our legal obligations;
• measure which advertisements lead to orders, and understand how people use the Site so that we can improve it;
• enforce our Terms and Conditions.

We do not send marketing emails.

5. Who we share it with

5.1 We share your data only with:

• the airline or flight supplier that creates your reservation, which receives passenger names, genders, dates of birth where required, and the itinerary. It never receives your email address or phone number; we give it our own contact details instead;
• our payment providers, Stripe and PayPal, which receive the amount and our order reference. You give your card or PayPal details to them directly;
• our email provider, which receives your email address and the messages we send you;
• advertising platforms, so that we can measure our advertising. When an order is delivered, we send Meta and TikTok a hashed (scrambled) copy of your email address, the order value, and any click identifier and browser details we hold. We send Google the same information only if you arrived from a Google ad. These platforms use it to match the sale to their ads and to improve how their ads are delivered;
• Google Analytics, which, when measurement is on, receives the pages you view and the order steps you reach. After an order is paid, and again if it is refunded, our server tells Google Analytics the order code and the amount, but never your name or email address. Google also collects technical details such as your IP address and browser. Google Analytics is not loaded on the pages that show your order. Google explains how it uses this data in How Google uses information from sites or apps that use our services;
• the providers that host the Site, our database and our backups, which store data on our behalf.

5.2 We may also disclose your data to a buyer if we sell or transfer our business or its assets, when the law requires us to, or when we need to enforce our Terms.

5.3 We do not sell your data, and we do not share it for any purpose other than those described in this policy.

6. Consent

6.1 By giving us your data, you consent to its collection, use and sharing as described in this policy.

6.2 If you give us details of other passengers, you must make sure they agree to you sharing their data with us for these purposes. By entering their details, you confirm that they have agreed.

6.3 You can withdraw your consent at any time by writing to support@onwardbookings.com. We will explain what this means for your order; for example, we cannot make a reservation without passenger names. Withdrawing your consent does not affect anything we did before you withdrew it, or our rights under the law.

7. Accuracy

7.1 We rely on the data you give us. Please enter each name exactly as it appears on the passenger’s travel document, and check your email address before you pay. You are responsible for making sure these details are accurate.

8. Access, correction and deletion

8.1 You can ask us for a copy of the data we hold about you, or ask us to correct or delete it. Write to support@onwardbookings.com from the email address you used for the order, and include your order code.

8.2 We will respond within 30 days, free of charge. If we need more time, we will tell you within those 30 days why, and when you can expect our answer.

8.3 When we delete your data from an order, we remove your name and email address from it. We keep the accounting record of the sale, without your name or email address.

8.4 If you are in the European Economic Area, we process your data on these legal bases: to carry out your order; for our legitimate interests in preventing fraud and measuring our advertising; and, for measurement, with your consent. You also have the right to object to processing based on our legitimate interests, to receive your data in a portable format, and to complain to the data protection authority where you live.

9. Advertising choices

9.1 Section 5 explains what we share with advertising platforms. You can limit how they use data about you with the following tools:

• Google’s My Ad Center, and the Google Analytics opt-out add-on, which stops Google Analytics from running in your browser;
• Meta’s ad preferences on Facebook and Instagram;
• TikTok’s Ads and your data page in its privacy centre;
• Your Online Choices in Europe, or the DAA opt-out page in the United States, which let you opt out of many advertising companies at once.

9.2 You can change your choice for “Measurement” at any time under “Cookie settings” in the footer. To object to what we send to Google Analytics or to advertising platforms after an order, as described in section 5, write to support@onwardbookings.com.

10. Links to other sites

10.1 The Site links to other websites, such as those of our payment providers and advertising platforms. Those sites have their own privacy policies, and we are not responsible for them. Please read their policies before you give them any data.

11. How long we keep it

11.1 We keep your data for as long as we need it for your order, our accounting and our legal obligations. After that, we delete it or remove the details that link it to you.

11.2 If you start an order but do not pay for it, we remove your name and email address from the order shortly after the flight you chose is no longer on offer.

11.3 Our technical logs do not include your IP address and are kept for no longer than 30 days. Our database backups are replaced on a rolling basis, so a detail we have deleted may remain in a backup for a short time.

11.4 The payment, email and advertising providers named in section 5 keep the data they receive under their own policies.

12. Changes to this policy

12.1 We may update this policy by publishing a new version on this page with a new “Last updated” date.

13. Contact

13.1 The company responsible for your personal data is GENITUBE LTD, registered at Unit 13 Freeland Park Wareham Road, Lytchett Matravers, Poole, England, BH16 6FA.

13.2 If you have questions, comments or requests about this policy, write to support@onwardbookings.com or use our contact page. We reply within 24 hours.

Last updated: October 2, 2026