The protection of your personal data is important to us. This privacy policy informs you about the data we collect, how we process it, and what rights you have.

1. Data Controller

The party responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

2. General Information on Data Processing

2.1 Scope of Processing of Personal Data

We generally only process personal data of our users insofar as this is necessary to provide a functional website as well as our content and services. Processing is regularly carried out only with the user's consent or where processing is permitted by law.

2.2 Legal Bases

The processing of personal data is based on the following legal bases:

• Art. 6(1)(a) GDPR: Consent of the user
• Art. 6(1)(b) GDPR: Performance of a contract and pre-contractual measures
• Art. 6(1)(f) GDPR: Legitimate interests (e.g., security, analytics)
• Art. 6(1)(c) GDPR: Legal obligation

2.3 Data Deletion and Storage Duration

Personal data will be deleted as soon as the purpose of storage no longer applies. Storage may continue beyond this if provided for by European or national legislation. Data will also be deleted when statutory retention periods expire.

3. Website Provision and Log Files

3.1 Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected:

• IP address of the user (anonymised)
• Date and time of access
• Pages accessed
• Browser type and version
• Operating system used
• Referrer URL (previously visited page)
• Volume of data transferred

3.2 Legal Basis and Purpose

Processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the technical provision and optimisation of the website as well as ensuring IT security.

3.3 Storage Duration

The data is deleted as soon as it is no longer necessary for the purpose of its collection. This is generally the case after 7 days.

4. User Account and Registration (Dealers)

4.1 Description and Scope

Dealers have the option to register on our website. The following data is collected during registration:

• Name / Company name
• Email address
• Password (stored in encrypted form)
• Time of registration

The following additional information may optionally be provided:

• Company address
• Phone number
• Additional contact details

4.2 Legal Basis and Purpose

Registration is carried out on the basis of Art. 6(1)(b) GDPR for the performance of a contract or pre-contractual measures. The purpose is to provide a dealer account for managing aircraft listings.

4.3 Storage Duration

The data is deleted when the user deletes their account or after 3 years of inactivity. Statutory retention periods remain unaffected.

5. Cookies

5.1 Technically Necessary Cookies

Our website uses cookies. Cookies are small text files that are stored in the browser. We exclusively use technically necessary cookies for:

• Session management (login status)
• CSRF protection
• Cookie consent storage

Legal basis: Art. 6(1)(f) GDPR (technical necessity)
Storage duration: Session-based or up to 1 year (cookie consent)

5.2 Optional Cookies (with Consent)

Only with your explicit consent do we use:

• Analytics cookies (e.g., Google Analytics) to improve our services
• Preference cookies to save your settings

You can withdraw your consent at any time via our cookie settings.

6. Contact Form and Email Contact

6.1 Description and Scope

When contacting us by email or contact form, the following data is stored:

• Email address
• Name (if provided)
• Content of the message
• Time of contact

6.2 Legal Basis and Purpose

Processing is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry) or Art. 6(1)(b) GDPR for pre-contractual enquiries.

6.3 Storage Duration

The data is deleted once the conversation has ended and no statutory retention obligations exist, at the latest after 2 years.

6.4 IP Address in Forms

When submitting contact forms, we store your IP address for protection against misuse and for tracing in the event of spam. This data is anonymised after 90 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in abuse prevention)

6a. Newsletter

6a.1 Description and Scope

You can subscribe to our newsletter to be informed about news and offers. The following data is collected upon registration:

• Email address
• Time of registration
• IP address (for documentation of consent)

6a.2 Double Opt-In Procedure

Registration is carried out using the so-called double opt-in procedure. After entering your email address, you will receive a confirmation email. You will only be added to our mailing list after clicking the confirmation link. This procedure serves as proof of your consent.

6a.3 Legal Basis

Legal basis: Art. 6(1)(a) GDPR (explicit consent)

6a.4 Unsubscription and Withdrawal

You can unsubscribe from the newsletter at any time. An unsubscribe link is included in every newsletter email. After unsubscription, your data will be deleted unless statutory retention obligations apply.

6a.5 Storage Duration

Your email address is stored until you unsubscribe. The documentation of consent (IP address, timestamp) is retained for 3 years in order to demonstrate lawful registration.

7. Integration of External Services

7.1 Google Fonts (Local)

We use Google Fonts, which are stored locally on our server. No connection to Google servers is established, and therefore no personal data is transmitted to Google.

7.2 YouTube Videos (Embedded)

We embed YouTube videos using the enhanced privacy mode. In this mode, data is only transmitted to YouTube when you play the video. This is carried out on the basis of your consent (Art. 6(1)(a) GDPR).

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy policy: https://policies.google.com/privacy

7.3 Google Maps (Where Required)

To display dealer locations, we use Google Maps. When pages containing Google Maps are accessed, data is transmitted to Google.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in user-friendly presentation)
Provider: Google Ireland Limited
Privacy policy: https://policies.google.com/privacy

7.4 Google reCAPTCHA (Bot Protection)

We use the reCAPTCHA service by Google to protect our forms from automated requests (bots) and spam. reCAPTCHA analyses the behaviour of the website visitor based on various characteristics.

When using reCAPTCHA, the following data is transmitted to Google:

• IP address of the user
• Referrer URL
• Information about the operating system
• Cookies and mouse movements/keyboard inputs
• Time spent on the website
• Device information and browser settings

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protection against abusive use and spam)
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Data transfer: USA (based on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR)
Privacy policy: https://policies.google.com/privacy
Terms of service: https://policies.google.com/terms

7.5 OpenStreetMap

For displaying location maps, we use OpenStreetMap, a free and privacy-friendly mapping service. When a map page is accessed, map data is loaded from OpenStreetMap servers.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in user-friendly presentation)
Provider: OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom
Privacy policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy

7.6 Bunny Fonts (CDN)

For the display of fonts, we use the GDPR-compliant service Bunny Fonts. Bunny Fonts is a privacy-friendly alternative to Google Fonts and does not store any personal data of users.

Provider: BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia (EU)
Privacy policy: https://bunny.net/privacy

8. Web Analytics

8.1 Google Analytics (with Consent Only)

With your consent, we use Google Analytics to analyse user behaviour. The following data is collected:

• Page views and time spent on pages
• Device and browser information
• Approximate geographic origin (country/region)
• Anonymised IP address

Legal basis: Art. 6(1)(a) GDPR (consent)
Provider: Google Ireland Limited
Data transfer to third countries: USA (based on Standard Contractual Clauses)
Withdrawal: You can withdraw your consent at any time via the cookie settings

9. Your Rights as a Data Subject

You have the following rights regarding your personal data:

9.1 Right of Access (Art. 15 GDPR)

You have the right to obtain information about the personal data we process about you.

9.2 Right to Rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate data.

9.3 Right to Erasure (Art. 17 GDPR)

You have the right to request the erasure of your data, provided that no statutory retention obligations exist.

9.4 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request the restriction of processing of your data.

9.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive your data in a structured, commonly used and machine-readable format.

9.6 Right to Object (Art. 21 GDPR)

You have the right to object to the processing of your data at any time on grounds relating to your particular situation.

9.7 Right to Withdraw Consent (Art. 7(3) GDPR)

You have the right to withdraw a given consent at any time with effect for the future.

9.8 Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

Competent supervisory authority:
Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover
Website: www.lfd.niedersachsen.de

10. Data Security

We use technical and organisational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorised persons. These include:

• SSL/TLS encryption of the entire website
• Encrypted storage of passwords (Bcrypt)
• Regular security updates
• Access restrictions to personal data
• Regular backups

11. Data Transfer to Third Countries

Some of the services we use are based outside the European Union (EU) or the European Economic Area (EEA), particularly in the USA. Data transfers are carried out on the basis of the following legal grounds:

• Standard Contractual Clauses (SCCs): Pursuant to Art. 46(2)(c) GDPR, we have entered into Standard Contractual Clauses with the respective providers.
• Adequacy decision: For certain countries, an adequacy decision by the European Commission exists.
• Consent: For analytics services, data transfer only takes place with your explicit consent.

Affected services: Google Analytics, Google reCAPTCHA, Google Maps

12. No Disclosure to Third Parties

Airvalon is an information and presentation platform. We do not sell aircraft and do not process payments. Your data will only be disclosed to third parties:

• With your explicit consent
• Where this is necessary for compliance with legal obligations
• To technical service providers (hosting, analytics) within the scope of data processing agreements

Dealers presented on Airvalon do not receive any personal data from visitors unless you contact them directly via the provided contact details.

13. Contact for Privacy Inquiries

If you have any questions about data protection, wish to exercise your rights, or have questions about data processing, please contact: