Privacy Policy
Last updated: February 2026
FolkAir (“we”, “us”, “our”) is operated by OnComp Ltd, a company registered in England and Wales with its registered office in London, UK. We are committed to protecting your personal data and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Privacy Policy explains how we collect, use, store, and share your personal data when you use the FolkAir platform at folkair.com.
1. Data Controller
2. What Data We Collect
Account Information
- Name, email address, and password
- Role selection (venue manager, supplier, agent, attendee)
- Region/location preferences
- Profile information (business name, bio, photos, contact details)
Service & Booking Data
- Service listings, pricing, availability, and calendar data
- Booking details, contracts, and assignment information
- Messages and communications between users
- Reviews and ratings
Payment Data
- Payment method details (processed securely by Stripe — we do not store full card numbers)
- Transaction history, invoices, and payout information
Technical & Usage Data
- IP address, browser type, device information, and operating system
- Pages visited, features used, and interaction patterns
- Referral source and session duration
- Location data (when you use map or area-based features)
3. Legal Basis for Processing
- Contract performance — to provide and manage your FolkAir account, process bookings, facilitate payments, and deliver our platform services.
- Legitimate interests — to improve our platform, prevent fraud, ensure security, and communicate service updates.
- Consent — for marketing communications, non-essential cookies, and analytics. You can withdraw consent at any time.
- Legal obligation — to comply with tax, accounting, and regulatory requirements.
4. How We Use Your Data
- Create and manage your account
- Connect venues, suppliers, agents, and event organisers
- Process bookings, contracts, and payments
- Send booking confirmations, notifications, and service messages
- Display supplier and venue profiles in search results
- Provide location-based features
- Analyse usage to improve platform features and performance
- Detect and prevent fraud, abuse, and security incidents
- Comply with legal and regulatory obligations
- Send marketing communications (only with your consent)
5. Third-Party Services
We share personal data with trusted third-party providers:
Stripe
Payment processing. See Stripe's Privacy Policy.
Google Maps Platform
Location services and venue mapping. See Google's Privacy Policy.
Elasticsearch
Search indexing for supplier, venue, and event discovery.
Google Analytics / Tag Manager
Usage analytics (only with cookie consent). See Google's Privacy Policy.
We do not sell your personal data to any third party.
6. Cookies & Similar Technologies
- Strictly necessary cookies — required for the platform to function. No consent required.
- Analytics cookies — help us understand usage. Set only with consent.
- Marketing cookies — used for relevant advertising. Set only with consent.
You can manage cookie preferences through our consent banner or browser settings.
7. Data Retention
- Account data — retained while active. Erased/anonymised within 30 days of deletion.
- Booking/transaction records — retained for 7 years (HMRC requirements).
- Communications — retained for account duration plus 12 months.
- Analytics data — aggregated and anonymised within 26 months.
8. International Data Transfers
Where third-party providers process data outside the UK, we ensure appropriate safeguards including UK adequacy regulations, Standard Contractual Clauses (SCCs), or equivalent ICO-approved measures.
9. Your Rights
Under UK GDPR, you have the right to:
- Access — request a copy of your personal data.
- Rectification — request correction of inaccurate data.
- Erasure — request deletion of your data.
- Restrict processing — limit how we use your data.
- Data portability — receive your data in a machine-readable format.
- Object — object to processing for legitimate interests or direct marketing.
Contact [email protected] to exercise your rights. We will respond within one month.
10. Data Security
- Encryption in transit (TLS/HTTPS) and at rest
- Secure authentication and access controls
- Regular security assessments and monitoring
- Staff training on data protection
11. Children's Privacy
FolkAir is not intended for individuals under 18. We do not knowingly collect data from children.
12. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of significant changes on the platform or by email.
13. Complaints
You have the right to lodge a complaint with the ICO:
