Privacy Policy

1. Who is responsible for your data

The controller of your personal data is FLYTORIDE (Pty) Ltd., a company incorporated in South Africa, registration number 2023/193067/07, postal address P.O. Box 224, Pinehaven 1739, South Africa (“FLYTORIDE”, “we”, “us”).

We offer our tours to people in the European Union, so this processing is subject to the GDPR under its Article 3(2), even though we are established outside the EU.

Our representative in the Union, designated under Article 27 of the GDPR, is FLYTORIDE Czech s.r.o., Hlásnice 83, 785 01 Hlásnice, Czech Republic (company registration number 29611547). You may contact our representative on any matter concerning the processing of your personal data, in addition to or instead of contacting us directly.

You can reach us at andrew@flytoride.com or vendy@flytoride.com, or by phone on +420 604 608 207.

We have not appointed a Data Protection Officer — our processing does not meet the criteria in Article 37 of the GDPR that would require one.

2. What we collect and why

Tour and service enquiries. When you send an enquiry through the booking form, the contact form or a service form, we collect your name, e-mail address, phone number, the message you write, and the details of what you are asking about — the tour, the departure date, any extras you selected and the indicative price shown to you. We use this to answer you and to prepare an offer. Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).

Newsletter. If you subscribe, we collect your e-mail address and use it to send occasional news about tours and departures. Legal basis: your consent (Article 6(1)(a) GDPR). Every message contains an unsubscribe link and you can withdraw at any time.

Analytics and advertising. If — and only if — you allow it in the cookie banner, we collect data about how you use the site and about actions such as viewing a tour or sending an enquiry. Legal basis: your consent (Article 6(1)(a) GDPR). Details in sections 4 and 5.

Technical data. Our hosting provider processes your IP address and browser information in order to serve the site and to protect it against abuse. We also read the country your request arrives from, purely to pre-select the right international dialling code in phone fields — this is not stored and is not sent anywhere. Legal basis: our legitimate interest in operating a secure website (Article 6(1)(f) GDPR).

We do not knowingly collect data from children, and the site is not aimed at them. We do not carry out automated decision-making or profiling that produces legal effects for you.

3. Cookies and what we store in your browser

We store a small amount of data in your browser. Some of it is necessary for the site to work — your language, your consent decision, the contents of your basket and a transport quote you have configured. This does not require consent.

Anything used for analytics or advertising loads only after you allow it. Nothing in those categories is loaded before you decide, nothing is pre-ticked, and refusing is one click, exactly like accepting.

A full, itemised list of what we store, who provides it and how long it lasts is on our cookies page. You can change or withdraw your choice there at any time. When you refuse a category, we also delete the cookies that category had already left in your browser.

4. Google Analytics and Google Ads

With your consent we use Google Tag Manager to load Google Analytics 4 and Google Ads conversion measurement. These tell us how many people visit the site, which pages they read and which advertisements led them here.

The container is configured for Google Consent Mode, so the choice you make in the banner is passed on to Google and controls what those tools are allowed to measure.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

5. Meta Pixel and the Conversions API

With your consent we use the Meta Pixel to measure the performance of our advertising on Facebook and Instagram, and to show our advertisements to people who have shown an interest in our tours.

We record when you open the site, when you view a tour, when you open a booking form and when you successfully send an enquiry. Alongside the measurement made in your browser, we also send the same events from our server using Meta's Conversions API, because browsers increasingly block the browser-side measurement. Both routes carry the same event identifier so that one action is not counted twice.

What we send. With the server-side event we transmit your e-mail address, phone number and name in a hashed form (SHA-256) — Meta receives an irreversible fingerprint, not the values themselves — together with your IP address, browser identification and Meta's own cookie identifiers. Meta uses these to match the event to a user account.

Nothing in this section happens unless you have allowed marketing cookies. If you refuse, neither the browser measurement nor the server-side transmission takes place.

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. For this processing we and Meta act as joint controllers as regards the collection and transmission of the data; Meta's further processing is carried out by Meta alone under its own data policy.

6. Who else receives your data

We do not sell your personal data and we do not share it for anyone else's marketing.

We use the following providers, who process data on our behalf or as independent controllers where stated:

• Vercel Inc. — hosting and delivery of this website.
• FLYTORIDE internal administration (app.flytoride.com) — every form on this site delivers into our own system, which then notifies our team by e-mail. This is where your enquiry is stored and worked on.
• Google Ireland Limited — analytics and advertising measurement (section 4), and the Google Places service we use to display public reviews of our business.
• Meta Platforms Ireland Limited — advertising measurement (section 5).
• SerpApi, LLC — used to retrieve our publicly listed reviews. It does not receive your personal data.

We may also disclose data where the law requires it, or where it is necessary to establish, exercise or defend legal claims.

7. Transfers outside the European Economic Area

We are established in South Africa, so your data is processed there. Some of the providers listed above are based in the United States or transfer data there.

South Africa is not covered by a European Commission adequacy decision. Transfers of your data outside the European Economic Area — to us and to those providers — are made under the European Commission's Standard Contractual Clauses, and, for providers certified under it, under the EU–US Data Privacy Framework.

We are happy to tell you which safeguard applies to a specific provider if you ask.

8. How long we keep it

Enquiries that do not lead to a booking: two years from your last contact with us, so that we can pick up the conversation if you come back to us.

Bookings and contracts: for as long as the contract runs and afterwards for the period required by accounting and tax law.

Newsletter: until you unsubscribe.

Analytics and advertising data: for the retention period set in the relevant tool — see our cookies page for the individual expiry times.

9. Your rights

Under the GDPR you have the right to ask us for access to your personal data, to have inaccurate data corrected, to have data erased, to have processing restricted, to receive your data in a portable form, and to object to processing carried out on the basis of our legitimate interest.

Where processing is based on your consent, you can withdraw that consent at any time. Withdrawing it does not affect the lawfulness of what we did before you withdrew it. For cookies, the withdrawal is one click on our cookies page.

Write to andrew@flytoride.com and we will respond within one month.

If you believe we are handling your data unlawfully, you can complain to the data protection supervisory authority of the EU or EEA country where you live, where you work, or where the problem arose. For visitors in the Czech Republic that is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.cz.

10. Changes to this policy

We update this policy when what we do with data changes — for example when we add a measurement tool or a new provider. The date of the current version is shown at the top of the page.