Legal

Privacy Policy

This policy explains what personal data FlyFleet collects, why we use it, who we share it with, how long we keep it, and the rights you have. It covers the FlyFleet website, the booking/account system and driver verification.

Last updated: 21 September 2026.

1. Who is responsible for your data

The data controller is FLYF1EET LTD, a company registered in England & Wales (company number 17055998), registered office 11 Vivian Avenue, London, England, NW4 3UT. For any privacy question or request, contact us at flyf1eet@hotmail.com.

2. The personal data we collect

Contact & identity: your name, email address and telephone number.
Address: your delivery/service address and postcode where relevant.
Booking & rental information: the vehicle, dates, prices, payment status and history of your bookings.
Driver verification: your driving-licence details, date of birth, proof of address, and the identity/verification documents you upload (including a selfie/identity image and licence images).
Vehicle information: the vehicle registration you enter and the vehicle details returned by our lookup provider.
Payment status: whether the reservation fee and security deposit are paid or held (and, for the deposit, released or refunded). We do not store your full card details — card payments are handled by our payment processor (see section 4).
Account & security information: your account credentials (passwords are stored only as salted hashes), session information, and security/audit records including IP address used for rate-limiting and abuse prevention.
Cookies: strictly necessary cookies only (see section 8).

3. Why we use it, and our lawful bases

To take and manage your booking and rental (contact you, take the reservation fee, arrange collection/delivery, provide the vehicle) — lawful basis: performance of a contract with you.
To verify that you are eligible to drive (licence, age and identity checks) — lawful basis: performance of a contract and our legitimate interests in preventing fraud and protecting our vehicles. We review verification documents manually; we do not use them for automated biometric identification.
To take payment and manage deposits/refunds — lawful basis: performance of a contract.
To keep accounting, tax and business records — lawful basis: legal obligation and legitimate interests.
To keep the service secure (authentication, rate-limiting, audit logs, fraud prevention) — lawful basis: legitimate interests in protecting our customers and business.
To handle fines, tickets, tolls, penalties, damage and disputes arising from a rental — lawful basis: performance of a contract, legal obligation, and legitimate interests (and establishing/defending legal claims).

We do not use your data for advertising or marketing profiling, and we do not sell your data.

4. Who we share it with (processors)

We use a small number of service providers who process personal data on our behalf, under contract and only for the purposes above:

Payments — Stripe. Card payments and refunds are processed by Stripe; Stripe handles your card details directly (we do not see or store them).
Email — Resend. Transactional emails (booking, verification, password reset) are sent through Resend.
Hosting & database — Render. Our application, database and the storage of your verification documents are hosted on Render (database region: Frankfurt, EEA).
Car-photo storage — Cloudflare R2. Used only for vehicle (fleet) photos, not for your verification documents.
Vehicle lookup — VehicleMatic. When a registration is entered, it is sent to VehicleMatic to return vehicle details.
Address/postcode lookup. Delivery distance is calculated using a postcode geocoding service when you request delivery.

We may also disclose data where required by law, or to the police or an authority, and to insurers or authorities in connection with fines, penalties, damage, accidents or vehicle seizure.

5. International transfers

Some of our providers may process personal data outside the UK. Where that happens, we rely on an appropriate safeguard recognised under UK data protection law — such as UK "adequacy" regulations, the UK International Data Transfer Agreement (or the Addendum to the EU Standard Contractual Clauses), or another lawful transfer mechanism — so that your data receives an equivalent level of protection.

6. How long we keep it (retention)

Data protection law does not set a single, universal retention period; it requires that data is kept no longer than necessary for the purpose. The periods below are FlyF1eet's own retention policy, set according to the purpose of each type of data, and we review them periodically.

Booking, account, contract and payment records: kept for as long as reasonably required for contractual, accounting, tax, fraud-prevention and legal-claim purposes. Financial and business records are kept for the period required by UK tax and accounting law (generally six years).
Driver verification documents (driving-licence images, proof of address, selfie/identity images, and date-of-birth verification information): kept for 12 months after the end of the relevant rental/booking relationship, then securely deleted — unless a longer period is genuinely required for an active dispute, a fraud investigation, a legal claim, or a regulatory/legal obligation.
Abandoned or unsuccessful verification where no rental takes place: kept for 90 days, then securely deleted, unless there is a documented reason to retain it longer.

To be clear, verification documents are held for shorter periods than ordinary booking/financial records. When personal data is no longer required, we securely delete or anonymise it.

7. Your rights

Under UK data protection law you have the right to:

access the personal data we hold about you;
have inaccurate data corrected (rectification);
have data erased where applicable — note we may be unable to erase data we are required to keep for legal, tax, contractual or legal-claim purposes;
restrict processing in certain circumstances;
object to processing based on our legitimate interests;
data portability where applicable;
withdraw consent where we rely on consent as the lawful basis (we do not rely on consent for the core processing above); and
complain to the Information Commissioner's Office (ICO) at ico.org.uk — we'd ask that you contact us first so we can try to help.

To exercise any of these rights, email flyf1eet@hotmail.com.

8. Cookies

We use strictly necessary cookies only. We do not use analytics, advertising or tracking cookies. The necessary cookies are:

a session cookie that keeps you signed in to your account or the owner dashboard; and
a security (CSRF) cookie that protects forms and actions against cross-site request forgery.

These are required for the site to work and to keep it secure, so they do not require consent. They are removed when you sign out or when they expire.

9. How we protect your data

Verification documents are stored privately, outside the public web, and are retrieved only over authenticated, access-controlled links — they are not publicly accessible. Passwords are stored only as salted hashes, connections are encrypted in transit, and access is limited to what is needed to operate the service.

10. Changes to this policy

We may update this policy from time to time; the "last updated" date above shows when it last changed.