Last updated: July 2026
This Privacy Policy explains how Golafly Travel ("we", "our", "us") collects, uses and protects your personal data when you use travel.golafly.com and our booking services. Golafly Travel is operated by Golafly Ltd, which acts as the data controller for the processing described here. This policy covers the Travel platform only.
• Account data: name, email address, phone number, country and communication preferences. - Traveller details: names and dates of birth of travellers on a booking; passport or ID details where an airline or authority requires them for ticketing. - Booking data: itineraries, stay reservations, eSIM plans, booking references and support history. - Payment data: processed by our payment providers. We receive only tokenized references and the last four digits of the card — never full card numbers. - Device & usage data: IP address, browser type, pages visited and interactions, collected through cookies and similar technologies.
We process your data to: - Complete and manage your bookings (contract performance) - Send booking confirmations, e-tickets, eSIM QR codes and travel updates - Provide customer support and resolve disputes - Operate the Golafly Rewards programme - Personalise offers and content, where you have consented - Prevent fraud and comply with legal obligations (tax, aviation and border regulations)
We share personal data only as needed to deliver the service you booked: - Airlines — traveller names and documents required for ticketing and check-in - Properties — guest names and stay details for your reservation - eSIM network operators — the details needed to provision your data plan - Payment processors — to process and, where applicable, refund payments - Authorities — where required by law (for example, advance passenger information) We never sell your personal data, and providers may use the data we pass on only to deliver the booked service.
We use essential cookies to keep the site working (sessions, security, theme preference) and analytics cookies to understand how the platform is used. You can control non-essential cookies from your browser settings; blocking essential cookies may prevent checkout from working.
Under the GDPR and equivalent laws, you can: - Access a copy of the personal data we hold about you - Correct inaccurate data - Request deletion of your data ("right to be forgotten") - Receive your data in a portable format - Object to or restrict certain processing, including marketing To exercise any of these rights, email travel@golafly.com. We respond within 30 days. You may also complain to your local data protection authority.
We keep booking records for as long as needed to provide the service and meet legal obligations (typically up to 7 years for financial records). Account data is deleted or anonymised when you close your account, except where retention is legally required.
Data is encrypted in transit (TLS) and at rest. Access to personal data is limited to staff who need it, under confidentiality obligations. Payments use 3-D Secure authentication through certified processors.
Because travel is global, your data may be transferred to providers outside your country — for example, to the airline or network operator of your destination. Where data leaves the UK or EEA, we rely on adequacy decisions or standard contractual clauses.
We may update this policy as the platform evolves. Material changes are announced by email or on the site before they take effect. The "Last updated" date at the top always reflects the current version.
For privacy questions or to exercise your rights: Email: travel@golafly.com Golafly Travel is operated by Golafly Ltd, 128 City Road, London EC1V 2NX, United Kingdom.
Questions about your data? Write to travel@golafly.com or visit the Help Center — we respond within 24 hours.