Privacy Policy
Last updated: March 2026
1. Data Controller
The data controller responsible for processing your personal data through the Penny Flights website (penny.flights) is:
Palliser Industries
Email: privacy@penny.flights
2. Information We Collect
Penny Flights is designed to minimise data collection. We do not require account registration and do not collect names, email addresses, or payment information. The data we process includes:
2.1 Search Data
When you perform a flight search, we process your search parameters (origin, destination, dates, number of passengers) to query our data providers and return results. This data is processed in real time and is not stored on our servers beyond the duration of your session.
2.2 Technical and Device Data
We may automatically collect certain technical information, including your IP address, browser type, device type, operating system, and referring URLs. This data is used for service functionality, security, and analytics purposes.
2.3 IP-Based Geolocation
We use the ipapi.co service to determine your approximate geographic location based on your IP address. This is used solely to set default search parameters (such as your nearest departure airport) and display localised content. No precise location data is collected or stored.
2.4 Local Storage Preferences
We use your browser’s localStorage to save your preferences, including language selection and cookie consent status. This data remains on your device and is not transmitted to our servers.
3. Legal Basis for Processing
Under the General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:
- Legitimate interest (Article 6(1)(f) GDPR): Processing technical data to ensure the security and proper functioning of the Service, and processing search queries to deliver the core service functionality.
- Consent (Article 6(1)(a) GDPR): For the use of non-essential cookies, including analytics and affiliate tracking cookies. You may withdraw your consent at any time.
- Contract performance (Article 6(1)(b) GDPR): Processing search parameters necessary to provide you with flight comparison results.
4. Third-Party Data Sharing
We share data with the following third parties only as necessary to provide the Service:
Kiwi.com (Booking Partner)
When you click through to book a flight, your search parameters are transmitted to Kiwi.com. From that point, Kiwi.com’s own privacy policy governs the processing of your data. We encourage you to review their policy before completing a booking.
Travelpayouts (Affiliate Tracking)
Travelpayouts may place cookies on your device for the purpose of tracking affiliate referrals and attributing commissions. This processing is based on your consent and you may opt out at any time through your cookie preferences.
ipapi.co (Geolocation)
Your IP address is sent to ipapi.co to determine your approximate location for service customisation. This is a one-time lookup per session and no persistent data is stored by ipapi.co on our behalf.
5. Cookies
We use cookies and similar technologies to provide essential functionality and, with your consent, for analytics and affiliate tracking. Cookies are categorised as follows:
- Necessary cookies: Required for basic functionality, including cookie consent storage and language preferences via localStorage.
- Functional cookies: Used to remember your search preferences and enhance your experience.
- Analytics and marketing cookies: Used by our affiliate partners (Travelpayouts) for tracking referrals. These are only set with your explicit consent.
For detailed information about the cookies we use and how to manage them, please refer to our Cookie Policy.
6. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:
- Search data: Processed in real time and not persisted beyond the active session.
- Technical/server logs: Retained for up to 90 days for security and diagnostic purposes.
- Cookie consent preferences: Stored in your browser’s localStorage until you clear it or withdraw consent.
- Affiliate tracking data: Retention periods are governed by the respective third-party partner’s policies.
7. Your Rights Under GDPR
Under the General Data Protection Regulation, you have the following rights regarding your personal data:
Right of Access
You have the right to request a copy of the personal data we hold about you.
Right to Rectification
You have the right to request correction of any inaccurate personal data.
Right to Erasure
You have the right to request deletion of your personal data, subject to legal retention requirements.
Right to Restriction of Processing
You may request that we limit the processing of your personal data in certain circumstances.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
Right to Object
You have the right to object to the processing of your personal data based on legitimate interests, including profiling.
To exercise any of these rights, please contact us at privacy@penny.flights. We will respond to your request within 30 days. You also have the right to lodge a complaint with your local data protection authority.
8. International Data Transfers
Your data may be processed by third-party services located outside the European Economic Area (EEA). Where such transfers occur, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to protect your personal data in accordance with GDPR requirements.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted connections (HTTPS), access controls, and regular security assessments. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
10. Children’s Privacy
The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us at privacy@penny.flights and we will take steps to delete such information.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this policy periodically.
12. Contact Us
For any questions or concerns regarding this Privacy Policy or our data practices, or to exercise your data protection rights, please contact us: