01Scope and Acceptance

This Policy applies to all visitors to our website, our customers and prospective customers, and customers or prospective customers of our affiliates and partners who interact with our platform. By accessing our website, registering for an account, or using any of our services, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein, to the extent such consent is the applicable legal basis for that processing (see Clause 5 below).

Our services are not directed at, and we do not knowingly collect personal data from, individuals under eighteen (18) years of age or who otherwise lack the legal capacity to enter into a binding contract under Nigerian law. If you do not agree with any part of this Policy, you must not access our website or use our services.

02Who We Are (Data Controller)

Fly Me Travels and Tours is the data controller responsible for your personal data for the purposes of the NDPA. Our contact details, and those of our Data Protection Officer (where applicable, in line with NDPA thresholds), are set out in Clause 20 (Contact Us) below.

03Information We Collect

We collect personal data that you provide directly to us, data generated through your use of our website, and data obtained from third parties in connection with your bookings. This may include:

• Identification and contact details: full name, email address, phone number, postal address, date of birth, and passport or other travel-document details necessary to complete a booking.
• Payment information: card or bank details and billing address, processed through our payment service providers.
• Business details: company name, registration number and tax identification/VAT number, where you book on behalf of an organisation.
• Account credentials: your user ID and password.
• Social media information: details you choose to link or share from a connected social media account.
• Usage and device information collected automatically, including your IP address, browser type and version, device and operating system, pages visited, referral source, and the dates and times of your visits ("Usage Information").
• Cookies and similar tracking technologies, as described in Clause 7 below.
• Information you provide voluntarily, such as when you respond to a survey, enter a promotion, or contact our Customer Care Team.

04How We Collect Information

We collect the information described above:

• when you register for an account or make a booking;
• when you use our reservation tools or any other feature of the website;
• during any online session, including through your web browser;
• through cookies and similar technologies deployed on our website; and
• when you upload or download content, respond to a survey, or take part in a promotion.

05Legal Basis for Processing

In accordance with the NDPA, we only process your personal data where we have a valid legal basis to do so. Depending on the context, we rely on one or more of the following:

• Performance of a contract — to process your booking, issue travel documents, and provide customer support in connection with a Contract to which you are party.
• Consent — for optional processing such as marketing communications and certain non-essential cookies, which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal.
• Legal obligation — where processing is necessary for us to comply with an obligation under Nigerian law, including anti-money laundering, tax and regulatory requirements.
• Legitimate interests — for purposes such as fraud prevention, network and information security, and improving our website and services, provided such interests are not overridden by your rights and interests as a data subject.
• Vital interests — in the rare circumstance where processing is necessary to protect your life or physical safety or that of another person, for example, during a medical or security emergency while travelling.

06How We Use Your Information

We use your personal data to:

• process your bookings and transactions and issue confirmations, tickets and travel vouchers;
• provide customer support and respond to your enquiries;
• send administrative messages, service updates and booking-related communications;
• send you marketing communications, where you have consented or where permitted under applicable law, and which you may opt out of at any time;
• personalise content and remember your preferences to improve your experience on our website;
• monitor and analyse website usage and performance metrics; and
• administer promotions, surveys and other activities you choose to participate in.

07Cookies and Similar Technologies

Our website uses cookies (small text files placed on your device) and similar technologies, such as web beacons, to recognise your browser, remember your preferences, and understand how our website is used. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device until deleted or expired).

Some cookies or widgets on our website are placed by third parties, such as advertising or analytics partners. We do not control these third-party cookies, and their use is governed by the privacy policy of the relevant third party. Cookies used on our website do not contain executable code such as viruses.

You may configure your browser to refuse cookies or to alert you when a cookie is set; however, disabling cookies may affect the functionality or display of certain parts of our website.

08Sharing and Disclosure of Personal Data

We may share your personal data, strictly on a need-to-know basis, with:

• airlines, hotels, car hire companies, insurers and other Third-Party Providers, solely to fulfil your travel arrangements;
• payment processors and financial institutions, to process your payment and prevent fraud;
• our employees and contractors, to the extent necessary for them to perform their duties;
• our service providers who support our business operations (for example, technology hosting, marketing, and fraud-prevention providers), under contractual terms that restrict them to using your data only to provide services to us;
• credit bureaux and financial partners, where necessary to report account information or to comply with applicable card-scheme rules, as permitted by law;
• regulators and law enforcement agencies, where disclosure is required by a valid court order, subpoena, or other lawful request, or to protect the safety of any person or the public; and
• an acquirer or successor entity in the event of a merger, acquisition or sale of assets, as described in Clause 14 below.

We do not sell your personal data to third parties. Where we disclose aggregate or anonymised statistics to advertisers or business partners, such statistics do not identify you personally.

09Cross-Border Transfer of Personal Data

We may transfer your personal data to, and store it on, servers located outside Nigeria, including where our Third-Party Providers or service providers operate internationally. Any such transfer will be carried out in accordance with the cross-border data transfer requirements of the NDPA, which require that the receiving country or organisation ensures an adequate level of data protection, or that appropriate safeguards (such as binding contractual clauses) are in place, or that you have given specific consent to the transfer after being informed of the possible risks.

10Data Retention

We retain your personal data only for as long as reasonably necessary to fulfil the purposes described in this Policy, including to satisfy any legal, accounting, or reporting requirements under Nigerian law, or for as long as you have consented to its retention. Where retention is no longer necessary, we will securely delete, anonymise, or otherwise dispose of your personal data. Your continued use of our website or services constitutes your acknowledgment of our retention practices as set out in this Policy.

11Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, loss or destruction, consistent with the security obligations imposed on data controllers and processors under the NDPA. These measures include firewalls, encryption of data in transit and at rest where appropriate, restricted physical and system access controls, and limiting access to personal data to personnel who require it to perform their duties. Our hosting provider maintains a secure server environment with appropriate security safeguards.

While we take reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is entirely secure, and we cannot guarantee absolute security.

12Call Recording

Calls to our Customer Care Centre may be monitored or recorded for quality assurance, training, dispute resolution, and record-keeping purposes. By calling our Customer Care Centre, you consent to such monitoring and recording.

13Your Rights as a Data Subject

Subject to the exceptions and conditions set out in the NDPA, you have the right to:

• be informed of the personal data we hold about you and the purposes of processing;
• access a copy of your personal data;
• request correction or rectification of inaccurate or incomplete personal data;
• request erasure of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies;
• restrict or object to certain processing of your personal data, including processing for direct marketing purposes;
• request the transfer of your personal data to another controller, where technically feasible (data portability); and
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

You may exercise these rights by logging into your account, where applicable, or by contacting us using the details in Clause 20 below. We may need to verify your identity before acting on your request. You also have the right to lodge a complaint with the Nigeria Data Protection Commission ("NDPC") if you believe your personal data has been processed in violation of the NDPA.

You may opt out of marketing communications at any time by clicking the unsubscribe link included in our marketing emails, or by adjusting your cookie preferences in your browser settings.

14Change of Ownership

If we undergo a change of ownership, merger, acquisition, or sale of some or all of our assets, we may transfer your personal data to the successor or acquiring entity, subject to that entity's continued compliance with this Policy and applicable Nigerian data protection law. We will notify you of any such transfer through a notice on our website or by email. If you object to your personal data being transferred to a new owner, you may request that we delete it, subject to any legal obligation to retain it.

15Automated Decision-Making

We do not currently make decisions that produce legal or similarly significant effects concerning you based solely on automated processing, including profiling, without human involvement. Where this changes, we will update this Policy accordingly and, where required by the NDPA, provide you with information about the logic involved and your right to obtain human intervention.

16Third-Party Links

Our website may contain links to third-party websites, including those of airlines, hotels, and other Third-Party Providers. We are not responsible for, and this Policy does not apply to, the privacy practices of any third-party website. We encourage you to review the privacy policy of any third-party website you visit.

17Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission without undue delay and, where feasible, within the timeframe prescribed by the NDPA, and will notify affected data subjects where the breach is likely to result in a high risk to their rights and freedoms.

18Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. Where we make material changes, we will post a notice on our website or notify you by email prior to the change taking effect. Your continued use of our website or services after such notice constitutes your acceptance of the revised Policy. If you do not agree with a change, you should stop using our services and may exercise your rights under Clause 13 above.

19Regulatory Contact and Complaints

If you have concerns about how we handle your personal data that we have not resolved to your satisfaction, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC). We may also disclose your personal data where required by law, regulation, or a lawful governmental or regulatory audit.

20Contact Us

For any privacy-related questions, requests, or complaints, please contact us at: