1. Data Controller

The controller of your personal data is:

Company name	AVEM AERO OÜ
Registry code	14485975
Registered address	Jõe tn 4c, Kesklinna linnaosa, 10151 Tallinn, Republic of Estonia
Email	info@avem.aero
Website	https://avem.aero

2. Scope

This Privacy Policy applies to personal data collected through:

• Our website at https://avem.aero, including all subpages;
• Contact and inquiry forms on our website;
• Email subscription and newsletter services;
• Direct email, telephone, or other communication with us;
• Business relationships in connection with our aviation services (GSA representation, charter brokerage, OCC services, and flight support).

Our services are directed at businesses and aviation industry professionals. This website is not intended for individuals under the age of 13. This Policy does not apply to third-party websites linked from our website.

3. Personal Data We Collect

3.1 Data you provide directly

Category	Examples	Source
Identity data	Full name, job title, company name	Contact forms, emails, contracts
Contact data	Email address, phone number, business address	Contact forms, emails, contracts
Communication data	Content of messages, inquiries, and correspondence	Contact forms, emails
Subscription data	Email address, subscription preferences	Newsletter subscription form
Transaction data	Invoice details, payment information, bank details	Business contracts, invoices

3.2 Data collected automatically

Category	Examples	Technology
Technical data	IP address, browser type and version, operating system, device type	Web server logs, analytics
Usage data	Pages visited, time spent on pages, click patterns, referring URL	Google Analytics, Weblium Analytics
Cookie data	Session identifiers, preference settings	Cookies, local storage (see Section 5)

3.3 Obligation to provide data

Providing your personal data through our forms is voluntary. However, without certain data (such as your name and email address), we may be unable to respond to your inquiry or provide our services.

4. Purposes and Legal Bases for Processing

Purpose	Data used	Legal basis (GDPR)
Responding to inquiries	Identity, contact, communication data	Art. 6(1)(b) — pre-contractual measures at your request Art. 6(1)(f) — our legitimate interest in responding to general inquiries
Providing our services GSA representation, charter brokerage, OCC services, flight support	Identity, contact, transaction data	Art. 6(1)(b) — performance of a contract
Sending newsletters	Subscription data (email, name)	Art. 6(1)(a) — your consent, which you may withdraw at any time
Website analytics	Technical data, usage data	Art. 6(1)(a) — consent (via cookie preferences)
Website security	Technical data	Art. 6(1)(f) — our legitimate interest in maintaining a secure website
Legal compliance Accounting, tax reporting, regulatory requirements	Identity, contact, transaction data	Art. 6(1)(c) — compliance with legal obligations under Estonian and EU law

5. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. In accordance with Directive 2002/58/EC as amended by Directive 2009/136/EC (ePrivacy Directive), we obtain your consent before placing non-essential cookies on your device.

5.1 Categories of cookies

Category	Purpose	Consent required
Strictly necessary	Essential website functionality, session management, cookie consent preferences	No
Analytics	Understanding website traffic and user behaviour	Yes

5.2 Analytics technologies in use

Technology	Provider	Purpose
Google Analytics 4	Google Ireland Limited	Website traffic analysis, audience insights
Weblium Analytics	Jetimpex, Inc. (Weblium)	Built-in website usage statistics

You can manage your cookie preferences at any time through your browser settings. Disabling certain cookies may affect website functionality.

6. Data Sharing

We do not sell your personal data. We share personal data only when necessary for the purposes described in this Policy.

6.1 Data processors

The following third parties process personal data on our behalf under data processing agreements:

Processor	Service	Location
Google LLC / Google Ireland Limited	Google Workspace (email, calendar), Google Analytics	EU/EEA, United States*
Jetimpex, Inc. (Weblium)	Website hosting and analytics	United States*
Retention Yes sp. z o.o. (Yespo)	Email marketing and newsletter distribution	EU/EEA (Poland)

* See Section 7 for international transfer safeguards.

6.2 Other recipients

We may share your personal data with:

• Legal and regulatory authorities — when required by applicable law or court order;
• Professional advisors — auditors, lawyers, and accountants, as necessary;
• Aviation business partners — airlines, ground handling agents, and other service providers, to the extent strictly necessary for performing the services you requested.

7. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA). We ensure that such transfers comply with Chapter V of the GDPR through the following safeguards:

Recipient	Country	Transfer mechanism
Google LLC	United States	EU–US Data Privacy Framework — Adequacy Decision (EU) 2023/1795
Jetimpex, Inc. (Weblium)	United States	Standard Contractual Clauses — Decision (EU) 2021/914

You may request a copy of the relevant transfer safeguards by contacting us at info@avem.aero.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

Data category	Retention period	Basis
Contact form inquiries	12 months after the inquiry is resolved	Legitimate interest
Newsletter subscription data	Until you unsubscribe, plus 30 days for technical processing	Consent
Contractual and transaction data	Duration of the contract plus 7 years	Estonian Accounting Act (Raamatupidamise seadus, § 12)
Analytics data	26 months	Consent
Server logs	6 months	Legitimate interest in security

After the applicable retention period, personal data is securely deleted or anonymised.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

Right	Description
Access (Art. 15)	Obtain confirmation of whether we process your data and request a copy
Rectification (Art. 16)	Request correction of inaccurate or incomplete data
Erasure (Art. 17)	Request deletion of your data, subject to legal retention obligations
Restriction (Art. 18)	Request restriction of processing in certain circumstances
Data portability (Art. 20)	Receive your data in a structured, machine-readable format
Objection (Art. 21)	Object to processing based on legitimate interest or for direct marketing
Withdraw consent (Art. 7(3))	Withdraw consent at any time, without affecting prior processing

We do not use automated decision-making or profiling that produces legal effects concerning you.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. In the event of a personal data breach posing a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, inform you in accordance with Articles 33 and 34 of the GDPR.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. When we do, we will update the "Last updated" date at the top of this page and post the revised Policy on our website. We encourage you to review this Policy periodically.

12. Contact Us

For any questions or requests regarding this Privacy Policy or your personal data, contact us:

Email	info@avem.aero
Post	AVEM AERO OÜ, Jõe tn 4c, Kesklinna linnaosa, 10151 Tallinn, Republic of Estonia

We encourage you to contact us first so that we may address your concern directly.