Privacy Policy

AVEM AERO OÜ

Last updated: 9 October 2026

1. Data Controller

The controller of your personal data is:

Company name	AVEM AERO OÜ
Registry code	14485975
Registered address	Jõe tn 4c, Kesklinna linnaosa, 10151 Tallinn, Republic of Estonia
Email	info@avem.aero
Website	https://avem.aero

2. Scope

This Privacy Policy applies to personal data collected through:

Our website at https://avem.aero, including all subpages;
Contact and inquiry forms on our website;
Forms and questionnaires downloaded from our website and returned to us by email (for example, the Aircraft Profile Questionnaire);
Email subscription and newsletter services;
Direct email, telephone, or other communication with us;
Business relationships in connection with our aviation services (GSA representation, charter brokerage, OCC services, and flight support).

Our services are directed at businesses and aviation industry professionals. This website is not intended for individuals under the age of 13. This Policy does not apply to third-party websites linked from our website.

3. Personal Data We Collect

3.1 Data you provide directly

Category	Examples	Source
Identity data	Full name, job title, company name	Contact forms, emails, contracts
Contact data	Email address, phone number, business address	Contact forms, emails, contracts
Communication data	Content of messages, inquiries, and correspondence	Contact forms, emails
Operational data	Completed questionnaires and supporting documents (aircraft documentation, weight and balance reports, approvals), names, positions, contact details and signatures of operator staff	Questionnaires and documents sent to us by email
Subscription data	Email address, subscription preferences	Newsletter subscription form
Transaction data	Invoice details, payment information, bank details	Business contracts, invoices

3.2 Data collected automatically

Category	Examples	Technology
Technical data	IP address, browser type and version, operating system, device type	Web server logs, analytics
Usage data	Pages visited, time spent on pages, click patterns, referring URL	Google Analytics, Weblium Analytics
Cookie data	Session identifiers, preference settings	Cookies, local storage (see Section 5)

3.3 Obligation to provide data

Providing your personal data through our forms is voluntary. However, without certain data (such as your name and email address), we may be unable to respond to your inquiry or provide our services.

3.4 Data we receive from others

We may receive your name, job title and business contact details from your employer or another business partner, for example when you are named as a contact person in a questionnaire, contract or operational correspondence. We use this data only for the purposes described in Section 4.

4. Purposes and Legal Bases for Processing

Purpose	Data used	Legal basis (GDPR)
Responding to inquiries	Identity, contact, communication data	Art. 6(1)(b) — pre-contractual measures at your request Art. 6(1)(f) — our legitimate interest in responding to general inquiries
Providing our services GSA representation, charter brokerage, OCC services, flight support	Identity, contact, operational, transaction data	Art. 6(1)(b) — performance of a contract or pre-contractual measures at your request Art. 6(1)(f) — our legitimate interest in communicating with the business contacts of our clients
Sending newsletters	Subscription data (email, name)	Art. 6(1)(a) — your consent, which you may withdraw at any time
Website analytics	Technical data, usage data	Art. 6(1)(a) — consent (via cookie preferences)
Website security	Technical data	Art. 6(1)(f) — our legitimate interest in maintaining a secure website
Legal compliance Accounting, tax reporting, regulatory requirements	Identity, contact, transaction data	Art. 6(1)(c) — compliance with legal obligations under Estonian and EU law

Right to object (Article 21 GDPR): Where we process your data based on legitimate interest, you have the right to object at any time on grounds relating to your particular situation. To exercise this right, contact us at info@avem.aero.

5. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. In accordance with Directive 2002/58/EC as amended by Directive 2009/136/EC (ePrivacy Directive), we obtain your consent before placing non-essential cookies on your device.

5.1 Categories of cookies

Category	Purpose	Consent required
Strictly necessary	Essential website functionality, session management, cookie consent preferences	No
Analytics	Understanding website traffic and user behaviour	Yes

5.2 Analytics technologies in use

Technology	Provider	Purpose
Google Analytics 4	Google Ireland Limited	Website traffic analysis, audience insights
Weblium Analytics	Jetimpex, Inc. (Weblium)	Built-in website usage statistics

You can manage your cookie preferences at any time through your browser settings. Disabling certain cookies may affect website functionality.

6. Data Sharing

We do not sell your personal data. We share personal data only when necessary for the purposes described in this Policy.

6.1 Data processors

The following third parties process personal data on our behalf under data processing agreements:

Processor	Service	Location
Google LLC / Google Ireland Limited	Google Workspace (email, calendar, document storage), Google Analytics	EU/EEA, United States*
Jetimpex, Inc. (Weblium)	Website hosting and analytics	United States*
Retention Yes sp. z o.o. (Yespo)	Email marketing and newsletter distribution	EU/EEA (Poland)

* See Section 7 for international transfer safeguards.

6.2 Other recipients

We may share your personal data with:

Legal and regulatory authorities — when required by applicable law or court order;
Professional advisors — auditors, lawyers, and accountants, as necessary;
Aviation business partners and system providers — airlines, ground handling agents, flight planning system providers (such as Air Support A/S, the provider of PPS Flight Planning) and other service providers, to the extent strictly necessary for performing the services you requested.

7. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA). We ensure that such transfers comply with Chapter V of the GDPR through the following safeguards:

Recipient	Country	Transfer mechanism
Google LLC	United States	EU–US Data Privacy Framework — Adequacy Decision (EU) 2023/1795
Jetimpex, Inc. (Weblium)	United States	Standard Contractual Clauses — Decision (EU) 2021/914

Where we share data with aviation business partners outside the EEA to perform the services you requested (for example, ground handling agents at your destination), the transfer is necessary for the performance of a contract in your interest (Art. 49(1)(b)–(c) GDPR) or is covered by Standard Contractual Clauses where applicable.

You may request a copy of the relevant transfer safeguards by contacting us at info@avem.aero.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

Data category	Retention period	Basis
Contact form inquiries	12 months after the inquiry is resolved	Legitimate interest
Aircraft profile questionnaires and supporting documents	Duration of the service contract plus 7 years; if no contract is concluded, 12 months after receipt	Contract; legitimate interest; Estonian Accounting Act (Raamatupidamise seadus, § 12)
Newsletter subscription data	Until you unsubscribe, plus 30 days for technical processing	Consent
Contractual and transaction data	Duration of the contract plus 7 years	Estonian Accounting Act (Raamatupidamise seadus, § 12)
Analytics data	26 months	Consent
Server logs	6 months	Legitimate interest in security

After the applicable retention period, personal data is securely deleted or anonymised.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

Right	Description
Access (Art. 15)	Obtain confirmation of whether we process your data and request a copy
Rectification (Art. 16)	Request correction of inaccurate or incomplete data
Erasure (Art. 17)	Request deletion of your data, subject to legal retention obligations
Restriction (Art. 18)	Request restriction of processing in certain circumstances
Data portability (Art. 20)	Receive your data in a structured, machine-readable format
Objection (Art. 21)	Object to processing based on legitimate interest or for direct marketing
Withdraw consent (Art. 7(3))	Withdraw consent at any time, without affecting prior processing

How to exercise your rights: Send your request to info@avem.aero with the subject line "Privacy Request". We will respond within one calendar month (Article 12(3) GDPR). In complex cases, this period may be extended by a further two months, and we will inform you accordingly.

Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. In Estonia, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee.

We do not use automated decision-making or profiling that produces legal effects concerning you.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. In the event of a personal data breach posing a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, inform you in accordance with Articles 33 and 34 of the GDPR.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. When we do, we will update the "Last updated" date at the top of this page and post the revised Policy on our website. We encourage you to review this Policy periodically.