Privacy Policy
Last updated: November 05, 2025
1. Data Controller
The controller of your personal data is:
AERO BAY ART Sp. z o.o.
Jelna 41
37-310 Nowa Sarzyna
Poland
VAT: PL8161716311
KRS: 0001033267
REGON: 525148644
Contact:
Email: pa***@********rt.com
Phone: +48 723 621 635
Website: aerobayart.com
2. General Information
We respect your privacy. We never sell or share your personal information with third parties for marketing purposes. Information collected through our site is used solely to complete transactions and provide services. Your data is secured via SSL (Secure Socket Layer) Technology.
This privacy notice describes how and why we might collect, store, use, and/or share your information when you use our services, including when you:
- Visit our website at aerobayart.com
- Purchase aircraft parts
- Sell us aircraft parts (buyback services)
- Contact us for quotes or inquiries
- Engage with us in other related ways, including sales or marketing
3. What Information Do We Collect?
3.1. Information You Provide
We collect personal information that you voluntarily provide when registering, placing orders, requesting quotes, or contacting us:
- Names
- Email addresses
- Phone numbers
- Mailing and shipping addresses
- Billing addresses
- Usernames and login credentials
- Contact preferences
- Invoice data (for businesses: company name, VAT ID, registered address)
- Payment data (processed by our payment processor)
Sensitive Information: We do not process sensitive information (special categories of data).
Payment Data: Payment card data is processed and stored by our payment processor in accordance with their privacy policies. We do not store full card numbers.
3.2. Information Automatically Collected
When you use our website, we automatically collect:
- IP address
- Browser type and version
- Operating system
- Language preferences
- Device name and characteristics
- Referring URLs
- Country and approximate location (based on IP)
- Date and time of visit
- Pages visited and actions taken
- Diagnostic data and error reports
3.3. Location Data
We may collect location data about your device (precise or imprecise). You can opt out of location sharing in your device settings, but this may affect certain features.
4. How Do We Process Your Information?
| Purpose | Legal Basis (GDPR) | Retention Period |
|---|---|---|
| Order fulfillment and sales contracts | Art. 6(1)(b) – Contract performance | 5 years from end of transaction year |
| Aircraft parts buyback services | Art. 6(1)(b) – Contract performance | 5 years from end of transaction year |
| Invoicing and accounting | Art. 6(1)(c) – Legal obligation | 5 years from end of tax year |
| User account management | Art. 6(1)(b) – Contract performance | Until account deletion + 3 years |
| Responding to quote requests | Art. 6(1)(b) and (f) – Contract/Legitimate interest | 2 years from last contact |
| Handling complaints and returns | Art. 6(1)(b) and (c) – Contract/Legal obligation | Until resolved + 6 years (limitation period) |
| Direct marketing (with consent) | Art. 6(1)(a) – Consent | Until consent withdrawal |
| Newsletter and promotional communications | Art. 6(1)(a) – Consent | Until consent withdrawal |
| Targeted advertising | Art. 6(1)(a) – Consent | Until consent withdrawal |
| Analytics and service improvement | Art. 6(1)(f) – Legitimate interest | 26 months |
| Fraud prevention | Art. 6(1)(f) – Legitimate interest | 6 years |
| Establishing/defending legal claims | Art. 6(1)(f) – Legitimate interest | Until expiry of limitation period (max. 6 years) |
| Compliance with legal obligations | Art. 6(1)(c) – Legal obligation | As required by law |
5. When and With Whom Do We Share Your Information?
Your data may be shared with the following categories of recipients:
| Recipient Category | Purpose | Examples |
|---|---|---|
| Payment processors | Transaction processing | PayPal, Stripe, Przelewy24 |
| Shipping and logistics companies | Order delivery | DHL, UPS, FedEx, InPost |
| IT service providers | Hosting, technical support | SEOHOST Sp. z o.o., Seohost.pl |
| Analytics tools | Traffic analysis | Google Analytics |
| Marketing tools | Advertising campaigns | Google Ads, Facebook Ads |
| Government authorities | Legal obligations | Tax authorities, courts, law enforcement |
Business Transfers: In connection with any merger, sale of company assets, financing, or acquisition, your information may be transferred to the new owner.
All processors acting on our behalf operate under data processing agreements compliant with Art. 28 GDPR.
6. International Data Transfers
Some of our service providers (e.g., Google Analytics, payment platforms) may process data outside the European Economic Area. In such cases, we implement appropriate safeguards:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions
- Certifications and binding corporate rules
You have the right to obtain a copy of the safeguards used by contacting us.
7. Cookies and Tracking Technologies
7.1. What Are Cookies?
Cookies are small text files stored on your device when you use our website. We also use similar technologies like web beacons and tracking pixels.
7.2. Types of Cookies
| Cookie Type | Purpose | Retention | Legal Basis |
|---|---|---|---|
| Necessary | Site functionality, cart, session, security | Session to 1 year | Legitimate interest |
| Functional | Remembering preferences, language, currency | Up to 1 year | Consent |
| Analytics | Statistics, traffic analysis (Google Analytics) | Up to 26 months | Consent |
| Marketing | Ad personalization, remarketing | Up to 13 months | Consent |
7.3. Managing Cookies
You can manage cookie settings:
- Through the cookie banner displayed on first visit
- In your browser settings
Note: Disabling necessary cookies may affect site functionality.
8. Your Privacy Rights (GDPR)
Under GDPR, you have the following rights:
| Right | Description |
|---|---|
| Access | Obtain information about processed data and receive a copy |
| Rectification | Request correction of inaccurate or completion of incomplete data |
| Erasure | Request deletion of data in certain circumstances (“right to be forgotten”) |
| Restriction | Request restriction of data processing |
| Data Portability | Receive data in a structured format (CSV, JSON) |
| Object | Object to processing based on legitimate interest |
| Withdraw Consent | At any time, without affecting lawfulness of prior processing |
| Not be subject to automated decisions | Request that decisions not be made solely automatically |
How to exercise your rights?
Contact us: pa***@********rt.com
We will respond within 30 days. In complex cases, the deadline may be extended by an additional 60 days, and we will inform you accordingly.
Identity Verification
Before fulfilling your request, we may ask you to verify your identity to ensure the data relates to the correct person.
Right to Complain
You have the right to lodge a complaint with a supervisory authority:
President of the Personal Data Protection Office (PUODO) (Poland)
ul. Stawki 2, 00-193 Warsaw
Tel.: +48 22 531 03 00
Email: ka********@******ov.pl
www.uodo.gov.pl
For other EU/EEA countries: https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm
9. Withdrawing Consent and Opting Out of Marketing
Withdrawing Consent
If we process your data based on consent, you can withdraw it at any time by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.
Opting Out of Marketing
You can opt out of marketing communications by:
- Clicking the “unsubscribe” link in our emails
- Contacting us: pa***@********rt.com
After opting out, we may still send transactional messages (e.g., order confirmations, shipping updates).
10. Automated Decision-Making and Profiling
We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
We may use profiling for marketing purposes (e.g., ad personalization), but always based on your consent and without significant impact on your rights.
11. Data Security
We implement appropriate technical and organizational measures:
- SSL/TLS encryption for all transmissions
- Secure password storage (hashing)
- Regular software updates
- Restricted access to data for authorized personnel only
- Regular backups
- Security monitoring
Important: Despite our efforts, no Internet transmission is 100% secure. You use our services at your own risk.
12. Information from Minors
Our services are not directed to individuals under 18 years of age. We do not knowingly collect data from children. If you become aware that a child has provided us with personal data, please contact us immediately at pa***@********rt.com.
13. Do-Not-Track (DNT) Features
We do not currently respond to DNT browser signals as there is no uniform technological standard. If such a standard is adopted, we will update this policy.
14. Updates to This Notice
We may update this privacy notice. We will notify you of material changes:
- By email (if we have your address)
- By posting a prominent notice on our website
The date of the last update is always indicated at the beginning of this document.
15. Contact Us
For matters related to personal data protection:
AERO BAY ART Sp. z o.o.
Jelna 41
37-310 Nowa Sarzyna
Poland
Email: pa***@********rt.com
Phone: +48 723 621 635
16. How to Review, Update, or Delete Your Data
To review, update, or delete your personal information, contact us: pa***@********rt.com
You can also log in to your account and update your data directly.
This privacy policy was prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Polish data protection law.