Privacy policy

Version 1.1 · 9 November 2026

This policy explains what personal information Hangar Box collects, why, who we share it with, and your rights. It applies to our website, bookings, purchases, "Sell your kit", our register-interest form, and messages you send us.

1. Who we are

Hangar Box is run by Hangar Box Ltd, a company registered in England and Wales (company number 17569313), whose registered office is 27 Old Gloucester Street, London WC1N 3AX. We are the controller of your personal information under UK data protection law.

Contact us at: Hangar Box Ltd, 27 Old Gloucester Street, London WC1N 3AX. Email [email protected], phone 07356 018812, website hangarbox.co.uk.

2. What we collect

• Contact details: your name, email address, phone number, and delivery and billing addresses.
• Booking details: what you hire or buy, the dates, where it is delivered (for example your flight school, club or FBO) and any school code you use.
• Payment details: payments are handled by Stripe. We only see limited details, such as the last four digits of your card, its expiry date and whether a payment succeeded.
• Identity checks: for high-value items, a photo ID and proof of address. If you ask us to, we keep a copy on file for your next booking.
• Flying details, only when an item needs them: for beacon hire, the pilot's name, an emergency contact, the aircraft registration and the planned route; for radio hire, your radio licence details; for training kits, your flight school if you tell us.
• Emergency contacts: if you give us someone else's details as an emergency contact, please let them know.
• Messages: emails, WhatsApp and social media messages you send us, and notes of phone calls. We do not record calls.
• Selling your kit: photos, serial numbers, and your bank details so we can pay you.
• Photos and reviews: photos of you with our kit, or reviews, that you send us or tag us in.
• Register-interest form: the details you enter, such as your name and email address. The form is run by Microsoft Forms.
• Website: our website host, Cloudflare, processes technical information such as your IP address to keep the site secure. Our pages also load fonts from Google Fonts, which means your browser connects to Google's servers.

We need your contact, delivery and payment details to take a booking, and your contact and bank details to buy your kit. If you do not give them, we cannot hire or sell to you, or buy from you.

3. Where we get it from

Most of the information comes from you. We also get some from other people:

• a hirer may give us an emergency contact's name and phone number for a beacon hire;
• a flight school may refer a student to us, or tell us a student's name and contact details for a delivery to the school;
• for flight school partnerships, we use the names, work email addresses and phone numbers that schools publish on their own websites, and their details on the UK Civil Aviation Authority's public lists of training organisations; and
• Stripe tells us whether a payment succeeded.

4. Why we use it, and our lawful basis

5. Who we share it with

We only share what each one needs, and we never sell your information. We may share it with:

• Stripe, to take payments (Stripe also uses some details to prevent fraud, under its own privacy policy);
• an identity verification service, if we use one for high-value hires;
• Mettle (NatWest) and FreeAgent, for banking and accounts;
• Microsoft, for email and our register-interest form;
• Cloudflare, which hosts our website;
• Royal Mail, Parcelforce and other couriers, to deliver and return kit;
• ForeFlight, SkyDemon or Pooleys, only if your kit includes an app subscription or online books and we set it up for you: we share your name and email address so it can be put in your name;
• the UK Beacon Registry, for beacon hires;
• Meta, when you message us on WhatsApp, Instagram or Facebook;
• UK Postbox, which receives and scans post sent to our business address;
• our accountant, insurer and insurance broker, for accounts and claims;
• your flight school, club or FBO, if you ask us to deliver there (so they can receive the kit for you), or if you use a school code: we tell the school how many bookings were made with its code, and only share your name if you have agreed;
• manufacturers and stolen-property registers, to check the serial numbers of kit you sell us;
• debt recovery services, solicitors and the courts, if we need to recover money or kit owed to us; and
• the police or other authorities, where the law requires it, or to help recover stolen kit.

If we start using other services, such as a booking system like Booqable or an email marketing service, we will add them to this list.

When you use our social media pages, the platform's own privacy policy applies too. For the statistics Facebook gives us about our page, Meta and Hangar Box are joint controllers.

6. Transfers outside the UK

Some of our providers, such as Microsoft, Stripe, Cloudflare, Google, Meta and ForeFlight, may store or process information outside the UK. Where they do, they use safeguards approved under UK law, such as UK adequacy regulations or the International Data Transfer Agreement. Contact us if you would like more details of these safeguards.

7. How long we keep it

• Booking, payment and accounting records: for at least 5 years after the 31 January tax return deadline for the tax year they relate to, as HMRC requires. That is usually 6 to 7 years.
• Bank details for "Sell your kit": deleted once we have paid you. The payment record stays in our accounts.
• Identity documents: deleted 6 months after your hire ends, which covers the time in which damage, loss or card disputes usually come to light. We keep a note that we checked your identity with your booking records. If you ask us to keep your ID on file so your next booking is quicker, we keep it until you ask us to delete it, and for no more than 2 years after your last booking.
• Beacon trip details: removed once the hire ends.
• Marketing emails: until you unsubscribe.
• Flight school contacts: while we are working with the school, or until the person asks us to stop contacting them.
• Register-interest form: until we launch, then for up to 12 months, unless you become a customer or ask us to delete it sooner.
• Messages: up to 2 years, or longer if they relate to a booking or a dispute.
• Photos and reviews we share: until you ask us to take them down.

8. Your rights

You have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct anything that is wrong;
• ask us to delete your information, where we do not need to keep it;
• ask us to limit how we use it;
• object at any time to us using your information on the basis of our legitimate interests, and to direct marketing, which we will always stop (use the unsubscribe link or tell us);
• ask for information you gave us in a format you can take elsewhere, where we use it under a contract or your consent; and
• withdraw your consent, where we rely on it.

To use any of these rights, email [email protected]. It is free, and we will reply within one month.

9. Automated decisions

We do not make decisions about you using only automated processing. Stripe may automatically decline a payment it believes is fraudulent; if that happens, contact us and we will help.

10. Complaints

If you are unhappy with how we use your information, please contact us first so we can put it right. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.

11. Keeping it safe

We use providers with strong security, protect our accounts with two-step verification and unique passwords, and limit who can see your information.

12. Under 18s

Bookings must be made by someone aged 18 or over. If you are a student pilot under 18, a parent or guardian should book for you.

13. Cookies

Our website does not use advertising or tracking cookies. Our host, Cloudflare, may set strictly necessary cookies to keep the site secure. If we add analytics or other cookies, we will update this policy and ask for your consent where the law requires it.

14. Changes to this policy

We may update this policy. The latest version is always on our website, with the date it was last changed.