Privacy Policy

1. Introduction

Royal Air ("we," "us," or "our") operates Aviastore.net, a B2B aviation marketplace connecting buyers, sellers, brokers, and aviation professionals worldwide. We are committed to protecting your personal information and being fully transparent about how we collect, use, store, and safeguard it.

This Privacy Policy applies to all users of Aviastore.net, including registered members, guests, and visitors (collectively "you" or "users"). By accessing or using Aviastore.net, you confirm that you have read and understood this Privacy Policy and consent to the practices described herein.

This Privacy Policy forms part of our Terms of Service, available at aviastore.net/terms, and should be read together with them. In the event of any inconsistency between this Privacy Policy and the Terms of Service with respect to the processing of personal data, this Privacy Policy shall prevail.

Aviastore.net is intended exclusively for business use by aviation industry professionals acting in a commercial or professional capacity. If you are not acting in such a capacity, you are not authorised to use this platform.

2. Data Controller

The data controller responsible for your personal information is:

Royal Air is incorporated in the Arab Republic of Egypt and operates Aviastore.net as a global B2B aviation marketplace.

3. Information We Collect

A. Information You Provide Directly

When you register, create a listing, submit an enquiry, respond to an RFQ, make a payment, or otherwise interact with Aviastore.net, we collect information including but not limited to:

• Full name and job title of authorised representatives
• Company name, legal registration number, and country of incorporation
• Business email address and telephone number
• Billing address and payment information (processed exclusively via PayPal)
• Aircraft, parts, or service listing details, including technical specifications, certifications, and supporting documentation
• Identity and business verification documents, including company registration certificates, aviation licences, and proof of authority
• Aviation regulatory documents uploaded to listings, including FAA Form 8130-3, EASA Form 1, Certificates of Conformity, and related records
• Communications, messages, and RFQ responses exchanged through the platform
• Charter and empty leg listing details, including operational information and Air Operator Certificate (AOC) details where applicable

B. Information Collected Automatically

When you use Aviastore.net, we automatically collect certain technical and usage data, including:

• IP address, browser type, browser version, and operating system
• Device type and screen resolution
• Pages visited, search queries submitted, and features used
• Time spent on the platform and session duration
• Referring URLs and exit pages
• Cookies and similar tracking technologies (see Section 6)

C. Information Received from Third Parties

We may receive information about you from third parties in the following circumstances:

• Sanctions and Compliance Screening: We receive data from official sanctions databases, including the U.S. Treasury OFAC SDN list, HM Treasury UK sanctions lists, EU consolidated sanctions lists, and UN sanctions lists, to verify that users and transactions are not subject to applicable trade restrictions.
• Identity and Document Verification: We may receive verification results from third-party providers used to confirm user business credentials and authorised representatives.
• Payment Data: We receive payment status and transaction confirmation data from PayPal. We do not receive or store full card or bank account details.
• Publicly Available Information: We may collect publicly available business information, including company registry data, aviation authority records, and publicly listed contact information, for verification and platform administration purposes.

4. Legal Basis for Processing

We process your personal information on the following legal bases, in accordance with applicable data protection law including the Egyptian Personal Data Protection Law (Law No. 151/2020) and applicable English data protection standards:

• Performance of a Contract: Processing necessary to create and manage your Account, provide access to the platform, facilitate transactions, and process payments. This is the primary basis for most data we collect.
• Legal Obligation: Processing required to comply with applicable law, including our obligations under international sanctions regulations, export control laws, anti-money laundering regulations, and data retention requirements imposed by law.
• Legitimate Interests: Processing necessary for our legitimate business interests, including fraud prevention, platform security, and improving the platform, provided that such interests are not overridden by your rights and interests.
• Consent: Where we send optional marketing communications or use non-essential cookies. You may withdraw consent at any time by contacting [email protected].

5. How We Use Your Information

We use your personal and business information for the following purposes:

• Account Registration and Management: To create, verify, and manage your Account and maintain accurate records of your business credentials and authorised representatives.
• Identity and Business Verification: To verify your identity, business registration, authority to act, and aviation credentials.
• Sanctions and Compliance Screening: To screen users, associated entities, and transactions against applicable Sanctions Lists, including the OFAC SDN list and equivalent international lists. Where a match is identified, we may restrict, suspend, or terminate access and report to relevant authorities as required by law.
• Marketplace Operations: To facilitate listings, RFQs, enquiries, communications, and transactions between buyers, sellers, and brokers.
• Charter and Empty Leg Services: To enable licensed charter operators and brokers to publish and manage charter and empty leg listings.
• Payment Processing: To process subscription fees and other applicable charges through PayPal and maintain accurate billing records.
• Export Control Compliance: To support compliance with applicable export control regulations, including U.S. EAR, ITAR, and UK and EU export licensing requirements.
• Fraud Prevention and Platform Security: To detect, investigate, and prevent fraudulent activity, misrepresentation, and unauthorised access.
• Platform Improvement: To analyse usage patterns, troubleshoot technical issues, and improve the functionality, performance, and user experience of Aviastore.net.
• Communications: To send service-related notifications, account updates, security alerts, and, where you have opted in, marketplace news and feature updates.
• Dispute Resolution: To investigate and assist in the resolution of disputes between users in accordance with our Terms of Service.
• Legal Compliance and Enforcement: To comply with applicable laws, respond to legal requests, enforce our Terms of Service, and protect the rights, property, and safety of Royal Air, our users, and others.

6. Cookies and Tracking Technologies

A. What Are Cookies

Cookies are small text files stored on your device when you visit a website. Aviastore.net uses essential cookies to maintain your session, protect the platform against bots, and prevent fraudulent access. With your consent, we also use Google Analytics to understand how visitors use the platform. You choose whether to allow analytics cookies via the cookie banner shown on your first visit — see Section E below to change your choice at any time.

B. Essential Cookies (always active)

• Session Cookie (aviastore_session): Strictly necessary. Maintains your authenticated session, CSRF protection, and flash messages. Set by Laravel. Expires at end of browser session or after inactivity.
• CSRF Token (XSRF-TOKEN): Strictly necessary. Protects all form submissions against cross-site request forgery. Set by Laravel on every page load.
• Remember Me (remember_*): Set only when you choose "Remember me" at login. Allows your session to persist across browser restarts for up to 30 days.
• Cloudflare Bot Protection (cf_clearance, __cf_bm): Set by Cloudflare Turnstile when you complete a bot-protection challenge on registration or contact forms. Used to detect and prevent automated abuse. Governed by Cloudflare's Privacy Policy.

C. Analytics Cookies (optional, requires your consent)

If you accept analytics cookies via the cookie banner, we load Google Analytics 4 to measure page views and platform usage. No analytics cookies are set, and no data is sent to Google, until you actively accept. Governed by Google's Privacy Policy.

D. Third-Party Cookies

Certain third-party services — such as PayPal for payment processing — may set their own cookies on your device. These are governed by the respective third party's own cookie and privacy policies. We do not control third-party cookies.

E. Managing Cookies

You may change your analytics cookie choice at any time via the "Cookie Preferences" link in the site footer, or disable or delete cookies through your browser settings. Please note that disabling essential cookies will affect the functionality of the platform and may prevent you from accessing certain features or maintaining a logged-in session.

7. How We Share Your Information

We do not sell your personal information to third parties under any circumstances. We share your information only in the following circumstances:

• With Other Users: When you engage in a transaction, enquiry, RFQ, or charter booking, relevant business contact details and listing information are shared with the other party or parties involved.
• With Service Providers: We work with trusted third-party providers including PayPal for payment processing, identity and document verification providers, sanctions screening providers, email delivery services, cloud hosting providers, and analytics providers. These providers process your information only as necessary and are contractually bound to maintain appropriate security standards.
• For Legal and Regulatory Compliance: We may disclose your information to regulatory authorities, law enforcement, government bodies, or courts where required by applicable law, including in connection with international sanctions regulations and export control laws. Where a sanctions match is identified, we may be legally required to report to the relevant authority without notifying you in advance.
• For Safety and Protection: We may share information where necessary to prevent, detect, or investigate fraud, security incidents, or illegal activity.
• Business Transfers: In the event of a merger, acquisition, or sale of Royal Air's business, your information may be transferred to the acquiring entity. We will notify users of any such transfer where required by applicable law.
• International Transfers: Aviastore.net operates as a global platform. Your information may be transferred to and processed in countries outside your own. Where such transfers occur, we implement appropriate safeguards including standard contractual clauses and data processing agreements to ensure your information is protected to an adequate standard.

8. Automated Processing and Profiling

Aviastore.net uses automated processes in the following limited circumstances:

• Sanctions Screening: User registration data is automatically screened against applicable Sanctions Lists. Where a potential match is identified, the process may result in automatic restriction of Account access pending manual review. You have the right to request human review of any automated sanctions decision by contacting [email protected].
• RFQ Distribution: The platform uses automated matching logic to distribute RFQs to users whose listings appear relevant to the requested asset or service. This process does not produce any legal or similarly significant effects.

We do not use your personal data for any other form of automated individual decision-making or profiling that produces legal or similarly significant effects without human oversight.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, alteration, or disclosure. These measures include:

• Encryption of data in transit using industry-standard TLS protocols
• Access controls and role-based permissions for platform staff
• Secure storage practices for verification documents and sensitive data
• Regular security monitoring and vulnerability assessments
• Contractual security obligations imposed on all third-party service providers who process personal data on our behalf

Payment transactions are processed exclusively by PayPal and are subject to PayPal's own security and compliance standards, including PCI DSS compliance. We do not store full card or bank account details.

While we implement robust security measures, no system is entirely immune to security incidents. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected users, in accordance with our obligations under applicable data protection law, including Egyptian Law No. 151/2020.

10. Data Retention

We retain your personal information for as long as your Account remains active or as necessary to fulfil the purposes set out in this Privacy Policy. In particular:

• Account and registration data is retained for the duration of your Account and for five (5) years following Account closure, to comply with our legal and regulatory obligations.
• Verification documents and identity records are retained for as long as required by applicable anti-money laundering, sanctions compliance, and aviation regulatory obligations, which may extend beyond Account closure.
• Sanctions screening records are retained in accordance with applicable legal requirements, which may require indefinite retention of records relating to confirmed or suspected sanctions matches.
• Transaction-related communications and records are retained for seven (7) years from the date of the relevant transaction.
• Technical and usage data collected automatically is retained for up to twenty-four (24) months, after which it is anonymised or deleted.

We may retain information for longer periods where required by law, for the resolution of outstanding disputes, enforcement of our agreements, regulatory reporting, or audit and compliance purposes. When your information is no longer required, we will securely delete or irreversibly anonymise it.

11. Your Rights

Depending on your jurisdiction and applicable data protection law, you may have the following rights in relation to your personal information:

• Right of Access: To request a copy of the personal information we hold about you and to receive information about how it is processed.
• Right to Rectification: To request correction of inaccurate, incomplete, or outdated information we hold about you.
• Right to Erasure: To request deletion of your personal information, subject to our legal and regulatory retention obligations. Where we are required by law to retain certain information — including sanctions screening records and verification documents — we may be unable to fulfil an erasure request in full.
• Right to Data Portability: To receive personal information you have provided to us in a structured, commonly used, and machine-readable format.
• Right to Object: To object to the processing of your personal information where we rely on legitimate interests as the legal basis, including objecting to direct marketing communications.
• Right to Restrict Processing: To request that we restrict the processing of your personal information in certain circumstances.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to Human Review: Where a decision with legal or similarly significant effects is made about you solely by automated means, you have the right to request human review of that decision.

Please note that certain rights may be limited or unavailable where we are required by applicable law to retain or process your information, including under sanctions compliance or export control obligations; where fulfilling your request would adversely affect the rights of other users; or where the information is required to establish, exercise, or defend legal claims.

12. Children

Aviastore.net is a B2B professional platform intended solely for use by individuals who are at least 18 years of age and who are acting in a professional business capacity. We do not knowingly collect, process, or store personal information from minors under the age of 18.

If we become aware that a minor has registered an Account or submitted any personal information through the platform, we will delete such information and terminate the relevant Account promptly. If you believe that a minor has provided personal information through Aviastore.net, please contact us immediately at [email protected].

13. Links to Third-Party Websites and Services

The Platform may contain links to third-party websites or integrate with third-party services, including PayPal and verification providers. We are not responsible for the privacy practices or content of any third-party website or service. We encourage you to review the privacy policies of any third-party service you access through or in connection with the platform.

14. Applicable Data Protection Law

This Privacy Policy is designed to comply with applicable data protection and privacy laws relevant to the operation of Aviastore.net, including:

• Egyptian Personal Data Protection Law (Law No. 151/2020) and its implementing regulations, which apply as Royal Air is incorporated in the Arab Republic of Egypt;
• Applicable English data protection standards, consistent with the governing law of our Terms of Service; and
• Any other national data protection laws applicable to users in their respective jurisdictions to the extent required by those laws.

Where users are located in jurisdictions with specific data protection requirements — including the European Economic Area (EEA), the United Kingdom, or other regulated markets — we apply appropriate safeguards and standards consistent with those requirements.

15. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of England and Wales. Any disputes relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of England and Wales, consistent with the dispute resolution provisions in our Terms of Service.

16. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the features and services offered through the platform. The most current version will always be published at aviastore.net/privacy with a revised "Last Updated" date.

Where changes materially affect how we process your personal information or your rights in relation to it, we will provide reasonable notice through the platform or by email before the changes take effect. Your continued use of the platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised policy.

17. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy, or if you wish to exercise any of your data protection rights, please contact us at:

We will endeavour to respond to all enquiries within thirty (30) days. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.