Last Updated: 13, January 2026
Effective Date: 13, January 2026

1. Introduction

BOOKNDFLY LIMITED ("we," "us," or "our") operates Bookndfly.com.au (the "Website"). We are committed to protecting your privacy in accordance with multiple legal frameworks:

Australia: Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs)
European Union: General Data Protection Regulation (GDPR)
California, USA: California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
New Zealand: Privacy Act 2020

Company Information:
BOOKNDFLY LIMITED
21 Wye Oak Drive, Schnapper Rock, Auckland, 0632
Data Protection Officer: support@bookndfly.com.au
Phone : +61-180-029-2923

2. Scope and Jurisdictional Rights

2.1 Australian Privacy Rights (APP)

Right to access and correct personal information
Right to make a privacy complaint
Right to anonymity where practicable

2.2 EU/EEA/UK Data Subject Rights (GDPR)

Right to access (Article 15)
Right to rectification (Article 16)
Right to erasure ("right to be forgotten") (Article 17)
Right to restriction of processing (Article 18)
Right to data portability (Article 20)
Right to object (Article 21)
Rights related to automated decision-making (Article 22)

2.3 California Consumer Rights (CCPA/CPRA)

Right to know what personal information is collected
Right to delete personal information
Right to opt-out of sale/sharing of personal information
Right to correct inaccurate personal information
Right to limit use of sensitive personal information
Right to non-discrimination for exercising rights

3. Categories of Personal Information Collected

Category	Examples	Purpose	Legal Basis (GDPR)	CCPA Category
Identifiers	Name, email, IP address	Account creation, bookings	Contract, Consent	A
Commercial	Purchase history, booking details	Service delivery, receipts	Contract, Legal obligation	B
Financial	Payment card information (processed by third parties)	Transaction processing	Contract, Legal obligation	B
Geolocation	Approximate location	Currency display, destination offers	Consent, Legitimate interest	G
Online Activity	Browsing history, interactions	Analytics, improvements	Consent	F
Inferences	Travel preferences, interests	Personalization, recommendations	Consent	K
Sensitive	Dietary requirements, accessibility needs (if provided)	Special accommodations	Explicit consent	C (under CPRA)

4. Data Collection Methods

4.1 Direct Collection

Booking forms
Account registration
Customer support interactions
Newsletter sign-ups
Surveys and feedback

4.2 Automated Collection

Cookies and tracking technologies
Website analytics
Server logs
Mobile app usage data

4.3 Third-Party Sources

Travel suppliers (airlines, hotels)
Payment processors
Marketing partners
Social media platforms

5. International Data Transfers

5.1 Transfer Mechanisms

We use appropriate safeguards for international data transfers:

EU to Australia: Adequacy Decision (Commission Implementing Decision 2023/...)
EU to other countries: Standard Contractual Clauses (SCCs)
Other transfers: Binding Corporate Rules or derogations

5.2 Key Transfer Locations

Data may be transferred to:

Australia: Primary processing location
United States: Analytics, advertising partners (with SCCs)
EU: Customer support (if applicable)
Various: Travel suppliers worldwide

6. Data Processing Purposes and Legal Bases (GDPR)

Processing Purpose	Legal Basis	Retention Period
Booking fulfillment	Contract necessity	7 years after transaction
Account management	Contract necessity	While account active + 2 years
Marketing communications	Consent	Until withdrawal of consent
Legal compliance	Legal obligation	As required by law
Fraud prevention	Legitimate interest	2 years
Website analytics	Consent	26 months

7. Cookie Policy (GDPR/CCPA Compliant)

7.1 Cookie Categories

Essential Cookies (No Consent Required)

Session management
Security features
Shopping cart functionality
Load balancing

Non-Essential Cookies (Consent Required)

Analytics Cookies: Google Analytics, Hotjar
Marketing Cookies: Facebook Pixel, Google Ads
Social Media Cookies: Share buttons, embedded content
Personalization Cookies: Language, currency preferences

7.2 Cookie Consent Management

We use a GDPR/CCPA compliant consent management platform that:

Blocks non-essential cookies until consent
Allows granular consent by category
Maintains consent records for 5 years
Provides easy withdrawal of consent

7.3 Global Privacy Control (GPC)

We honor the Global Privacy Control signal for California residents and other jurisdictions where required.

8. Your Rights and How to Exercise Them

8.1 Australian Residents

Submit requests to: support@bookndfly.com.au
Response time: 30 days

8.2 EU/EEA/UK Residents

Data Protection Officer: support@bookndfly.com.au
EU Representative: [To be appointed if Article 27 applies]
Response time: 1 month (extendable to 3 months if complex)

8.3 California Residents

Do Not Sell or Share My Personal Information

Submit requests via: do-not-sell
Email : support@bookndfly.com.au
Toll-free : +61-180-029-2923 (for CA residents)
Response time: 45 days (extendable to 90 days)

8.4 Verification Process

We verify all requests to ensure security:

Account holders: Through account verification
Non-account holders: Government ID verification
Authorized agents: Proof of authorization required

9. Sale and Sharing of Personal Information (CCPA)

9.1 What We Consider "Sale" or "Sharing"

Under CCPA, we may "sell" or "share" personal information through:

Digital advertising networks
Analytics providers
Social media platforms
Affiliate marketing programs

9.2 Opt-Out Options

California residents can opt-out via:

Website: "Do Not Sell or Share My Personal Information" link
Email : support@bookndfly.com.au
Phone : +61-180-029-2923
GPC: Enabled browser signals

9.3 Opt-Out Preferences

We maintain opt-out preferences for 12 months and request reconfirmation annually.

10. Automated Decision Making and Profiling

10.1 Types of Automated Processing

Price estimation algorithms
Personalized recommendations
Fraud detection systems
Availability checking

10.2 Your Rights

GDPR: Right to human intervention, explanation, and challenge
CCPA: Right to opt-out of automated decision-making technology
Right to request information about the logic involved

11. Data Security Measures

We implement appropriate security measures including:

Encryption in transit and at rest
Regular security assessments
Access controls and authentication
Employee privacy training
Incident response plan
Data protection impact assessments (for high-risk processing under GDPR)

12. Data Breach Notification

We will notify affected individuals and authorities as required:

Australia: OAIC and affected individuals
EU: Supervisory authority within 72 hours, individuals without undue delay
California: Attorney General and affected residents
New Zealand: Privacy Commissioner

13. Children's Privacy

We do not knowingly collect personal information from:

Children under 16 (GDPR)
Children under 13 (COPPA)
Children under 16 (CCPA, unless 13-15 with opt-in)
Children under 15 (Australia)

Parents/guardians may contact us to review or delete children's information.

14. Third-Party Processors

We maintain a register of data processors including:

Payment Processors: Stripe, PayPal
Analytics: Google Analytics (with IP anonymization)
Hosting: AWS, Google Cloud
CRM: Salesforce
Marketing: Mailchimp, HubSpot

All processors are bound by data processing agreements.

15. Changes to This Policy

We will notify you of material changes:

Website notice: 30 days before changes
Email notification: For registered users
Consent renewal: For significant changes affecting legal basis

16. Contact Information and Complaints

16.1 Primary Contacts

Data Protection Officer
BOOKNDFLY LIMITED
21 Wye Oak Drive Schnapper Rock, Auckland 0632
Email : support@bookndfly.com.au
Phone : +61-180-029-2923

16.2 Regulatory Authorities

Australia: Office of the Australian Information Commissioner (OAIC)
EU: Your local supervisory authority
UK: Information Commissioner's Office (ICO)
California: California Attorney General
New Zealand: Office of the Privacy Commissioner

16.3 Response Timeframes

General inquiries: 2 business days
Rights requests: As specified by applicable law
Complaints: 30 days (may extend for complex cases)

17. Jurisdiction-Specific Addenda

17.1 Australian Addendum

We comply with Notifiable Data Breaches scheme and Privacy Act requirements.

17.2 EU Addendum

We have appointed an EU representative as required by Article 27 GDPR.

17.3 California Addendum

We provide financial incentives for data collection only with prior consent and clear terms.

17.4 New Zealand Addendum

We comply with Privacy Act 2020 and cross-border disclosure requirements.