Privacy policy

This policy explains what personal information Empty Leg UK collects, why we collect it, who we share it with and what rights you have. It was last reviewed in September 2026.

Who is responsible for your data

Where your charter brokerage contract is with Empty Leg CY, registration number HE 496460, Krinou 3, Agios Athanasios, Lemesos 4103, Cyprus, that company is also a controller of the data needed to arrange and perform your flight. Both companies apply this policy.

What we collect

• Details you give us. Your name, telephone number, email address, company name if you give one, and the content of your messages to us.
• Flight details. Routes, dates, number of passengers, aircraft preferences and any requirements you tell us about, such as pets, baggage or catering.
• Passenger information required to fly. For international flights this includes full names, dates of birth, nationality and passport details of everyone on board. We collect this because a flight cannot legally depart without it.
• Payment information. Billing details and the record of payments made. Card details are handled by our payment provider and are not stored by us.
• Technical information. Your IP address and basic browser information recorded in our server logs, and the cookies described in our cookies policy.

Why we use it, and our legal basis

• To answer your enquiry and prepare a quote. Legal basis: steps taken at your request before entering a contract.
• To arrange and perform your flight. Legal basis: performance of a contract with you.
• To meet legal obligations. Border and customs formalities, aviation security requirements and the retention of accounting records. Legal basis: legal obligation.
• To run and protect our business. Keeping records of enquiries, handling complaints, preventing fraud and securing our systems. Legal basis: our legitimate interests.

We do not send marketing emails and we do not run advertising campaigns based on your data. If that changes we will ask for your consent first, and you will be able to withdraw it at any time.

Who we share it with

We share only what is necessary, and only with:

• aircraft operators and their handling agents, so that the flight can be arranged and flown;
• border, customs and aviation authorities, where the law requires passenger information to be submitted;
• our customer relationship management system and our email provider, which hold our correspondence with you;
• WhatsApp, if you choose to contact us that way, in which case your message is also handled under that service's own terms;
• our payment provider, for the settlement of invoices;
• our accountants and auditors, for the preparation of statutory records;
• professional advisers or authorities, where we are legally required to disclose information.

We do not sell your personal information, and we do not pass it to marketing companies or data brokers.

Where your data is held

Our website and its backups are hosted by UKNode Ltd, a hosting provider registered in the United Kingdom, on infrastructure located in a data centre in Manchester. Website data, backups and server logs remain in the United Kingdom.

Some transfers abroad are unavoidable in aviation. If your flight departs from or arrives at a foreign airport, passenger details are passed to the operator, its handling agent and the authorities of that country. Where a transfer is outside the United Kingdom we rely on the appropriate safeguards permitted by UK data protection law, or on the transfer being necessary for the performance of your contract.

How long we keep it

We keep records relating to enquiries, bookings and flights for six years, which reflects the period for which UK accounting and tax records must be retained and the period during which a claim could be brought. After that they are deleted or anonymised.

Your rights

Under UK data protection law you have the right to ask us for a copy of the personal information we hold about you, to have inaccurate information corrected, to ask us to delete information where we no longer need it, to object to or restrict certain processing, and to receive your information in a portable format.

Write to privacy@empty-leg.co.uk and we will respond within one month. There is no charge. We may need to confirm your identity before acting, to make sure we are not disclosing your details to someone else.

Some information we cannot delete on request, for example passenger records that must be kept for tax or aviation compliance reasons. If that applies we will tell you which information it is and why.

Security

Access to our systems is restricted to staff who need it for their work. Data is transmitted over encrypted connections and stored on servers in the United Kingdom. No transmission over the internet can be guaranteed completely secure, and you send information to us at your own risk, but we take reasonable technical and organisational measures to protect it.

Cookies

This site uses a small number of cookies. What they are and how to control them is set out in our cookies policy.

Complaints about your data

If you are unhappy with how we have handled your personal information, write to privacy@empty-leg.co.uk and we will investigate. You also have the right to complain directly to the Information Commissioner's Office, the UK data protection regulator, and you do not need our permission to do so.

Changes to this policy

We update this policy when our practices change. The version published here is the one that applies, and the review date is shown at the top of the page.