Article 1 – Data Controller

“`

The controller responsible for the processing of personal data collected through jalaero.com, hereinafter referred to as the Website, is:

This Privacy Policy explains how JAL AERO collects, uses, stores, shares and protects personal data in accordance with Regulation EU 2016/679, the General Data Protection Regulation, and the amended French Data Protection Act.

The Policy applies to Website visitors, prospective customers, customers, suppliers, professional contacts, consignees, end users and any individual whose personal data is processed in connection with a quotation, order, payment, shipment, return or compliance check.

Information relating exclusively to a legal entity is not personal data. However, the name, professional email address, telephone number and other information relating to an identifiable employee, director, representative, consignee or individual contractor constitute personal data.

“`

Article 2 – Personal Data Collected

“`

2.1 Identification and contact data

When a user contacts JAL AERO, requests a quotation, creates an account, receives a payment link or places an order, JAL AERO may collect:

• First name and surname
• Job title and professional role
• Company or organisation name
• Billing address
• Delivery address
• Email address
• Telephone number
• Preferred language
• Customer or supplier account reference

2.2 Company and professional information

For business transactions, JAL AERO may collect:

• Company registration details
• Tax identification and VAT numbers
• EORI or customs identification numbers
• Professional contact details
• The identity and authority of the person acting for the company
• Purchase order and internal customer references
• Information required to assess or open a professional customer or supplier account

2.3 Quotation and order data

For quotation, sourcing, order and after-sales management, JAL AERO may collect:

• Quotation requests and accepted quotations
• Purchase orders and order history
• Product descriptions and quantities
• Part numbers and dash numbers
• Serial numbers where applicable
• Requested product condition
• Certification and traceability requirements
• Aircraft, engine, equipment or system references where relevant
• Delivery requirements and deadlines
• Prices, discounts, taxes and shipping costs
• Invoices, credit notes and refund information
• Returns, warranty claims and complaints
• Communications with JAL AERO

2.4 Payment data

Payments are processed through Monetico and the banking organisations involved in the transaction.

JAL AERO may receive or retain information such as:

• The transaction amount
• The currency
• The order and transaction references
• The payment date and time
• The payment status
• The payment method category
• Authentication or fraud-prevention results
• Information required to process a refund or payment dispute

JAL AERO does not receive or store the complete payment card number, card security code or full banking authentication credentials.

2.5 Secure payment-link data

Where JAL AERO generates a personalised payment link following a quotation or price negotiation, JAL AERO may process:

• The identity of the employee or authorised user who generated the link
• The customer or company concerned
• The agreed amount and currency
• The product or transaction description
• The quotation, invoice or commercial reference
• The creation and expiry dates of the link
• The technical token associated with the link
• The access, use and payment status of the link
• Technical logs required to prevent misuse or repeated use

The payment-link token is intended only to provide temporary access to the corresponding checkout transaction. It must not be treated as a permanent customer identifier.

2.6 Shipping and customs data

For worldwide delivery and customs clearance, JAL AERO may collect:

• The identity and contact details of the consignee
• The delivery and final destination addresses
• Carrier and freight-forwarder references
• Tracking numbers
• Proof of dispatch and delivery
• Customs declarations and commodity information
• Importer, exporter and EORI information
• Country of origin and destination
• Incoterms and shipping instructions where applicable
• Information required for export or import formalities

2.7 Technical and navigation data

When a user accesses the Website, technical data may be collected automatically:

• IP address
• Browser type and version
• Operating system and device information
• Date and time of access
• Pages and functions accessed
• Referral and navigation information
• Login, security and error logs
• Shopping cart and checkout session information
• Cookie and consent preferences

2.8 Communications and documents

JAL AERO may retain emails, contact forms, attachments, photographs, certificates, technical documents, delivery documents and other information voluntarily supplied in connection with a request or transaction.

2.9 Sources of personal data

Personal data may be obtained:

• Directly from the person concerned
• From the company or organisation represented by that person
• From a customer, supplier, consignee or end user
• From Monetico, banks and payment participants
• From carriers, freight forwarders, customs brokers and insurers
• From suppliers, manufacturers, workshops and technical service providers
• From company registers and official public sources
• From sanctions, embargo and export-control lists
• From competent public authorities

“`

Article 3 – Aviation and Compliance Data

“`

“`

Article 4 – Purposes of Processing

“`

Personal data is collected and processed for the following purposes:

4.1 Quotations and pre-contractual requests

• Receiving and analysing requests for quotations
• Identifying the required aircraft parts or equipment
• Checking availability, condition and documentary requirements
• Contacting suppliers and sourcing products
• Preparing commercial quotations
• Negotiating prices, delivery arrangements and contractual conditions
• Responding to technical and commercial questions

4.2 Performance of the sales contract

• Creating and managing customer accounts
• Processing purchase orders and online orders
• Generating and managing secure payment links
• Processing and confirming payments
• Preparing, inspecting and packaging products
• Managing product documentation and traceability
• Organising domestic and international deliveries
• Providing invoices and transaction documents
• Managing returns, refunds, claims and after-sales service

4.3 Customs and international trade compliance

• Completing export and import formalities
• Preparing customs documents
• Verifying destinations, consignees and end users
• Screening against applicable sanctions and embargo lists
• Assessing product and end-use restrictions
• Applying for or managing export authorisations where required
• Preventing unlawful diversion or re-export
• Responding to lawful requests from customs and competent authorities

4.4 Accounting and legal compliance

• Issuing and retaining invoices and credit notes
• Maintaining accounting and tax records
• Managing VAT and export documentation
• Complying with legal record-keeping requirements
• Establishing, exercising or defending legal claims
• Responding to legally binding requests from authorities

4.5 Customer and supplier relationship management

• Responding to enquiries
• Maintaining commercial correspondence
• Managing customer and supplier records
• Monitoring quotations, orders and deliveries
• Assessing supplier performance and product conformity
• Preventing counterfeit or incorrectly documented parts

4.6 Website operation and security

• Operating WordPress and WooCommerce
• Maintaining carts, accounts and checkout sessions
• Preventing fraud and unauthorised access
• Protecting payment links and user sessions
• Detecting technical errors and malicious activity
• Maintaining logs, backups and security controls
• Managing cookie and consent preferences

4.7 Service improvement

• Improving Website performance and usability
• Analysing technical incidents
• Producing audience statistics where legally permitted
• Improving customer service and commercial processes

4.8 Commercial communications

JAL AERO may send information concerning available aircraft parts, services, quotations and commercial opportunities where the recipient has consented or where such communication is permitted on another lawful basis.

Every recipient may object to direct marketing at any time using the unsubscribe method provided or by contacting JAL AERO.

“`

Article 5 – Legal Bases for Processing

“`

Each processing operation is based on an appropriate legal basis under the General Data Protection Regulation:

“`

Article 6 – Retention Periods

“`

JAL AERO retains personal data only for as long as necessary for the purpose for which it was collected, subject to statutory, accounting, tax, customs, aviation, sanctions and export-control requirements.

At the end of the applicable retention period, personal data is deleted, anonymised or placed in a restricted archive where continued retention is legally required.

“`

Article 7 – Recipients of Personal Data

“`

7.1 Internal access

Personal data is accessible only to authorised persons who require it for their duties, including those responsible for:

• Sales and quotation management
• Product sourcing and procurement
• Order preparation and logistics
• Customer and supplier relations
• Accounting and invoicing
• Compliance and export checks
• Website administration and security
• Returns, claims and after-sales service

7.2 Service providers and business partners

Personal data may be shared, strictly where necessary, with:

• Website hosting and technical-maintenance providers
• Providers supporting the WordPress and WooCommerce environment
• Monetico and the banking participants involved in payment processing
• Email and transactional-notification providers
• Carriers, freight forwarders and logistics providers
• Customs brokers and customs representatives
• Transport and credit insurers
• Suppliers, manufacturers, repair organisations and technical partners
• Product inspection, certification and traceability providers
• Sanctions and export-control screening providers
• Accountants, auditors, legal advisers and other professional advisers

These recipients receive only the information reasonably required to perform their role.

7.3 Carriers and customs authorities

For worldwide delivery, recipient and shipment information may be disclosed to carriers, freight forwarders, customs brokers, destination-country authorities and other organisations involved in export, transit and import formalities.

7.4 Suppliers and technical partners

Where necessary to source, identify or document a product, JAL AERO may share limited professional contact and transaction information with a supplier, manufacturer, repair organisation or technical partner.

7.6 Public authorities

Personal data may be disclosed to judicial, customs, tax, financial, aviation, sanctions, export-control or other competent authorities where disclosure is legally required or necessary to establish, exercise or defend legal rights.

“`

Article 8 – International Data Transfers

“`

8.1 Worldwide commercial activity

JAL AERO supplies aircraft parts worldwide, except where a destination, party, product or intended use is subject to an applicable prohibition or restriction.

International transactions may therefore require personal data to be sent outside the European Economic Area to customers, consignees, end users, carriers, freight forwarders, customs brokers, suppliers, banks, insurers or competent authorities.

8.2 Transfers required for a transaction

Where a customer requests delivery outside the European Economic Area, certain data transfers may be necessary to perform the contract, deliver the order, complete customs procedures or comply with applicable legal obligations.

8.3 Transfers to service providers

Where a service provider processes personal data outside the European Economic Area, JAL AERO verifies, where required, that an appropriate transfer mechanism is available, such as:

• An adequacy decision adopted by the European Commission
• Standard Contractual Clauses adopted by the European Commission
• Binding corporate rules
• A legally recognised certification or code of conduct
• Another mechanism or derogation permitted by the General Data Protection Regulation

8.4 Additional safeguards

Where appropriate, JAL AERO or its providers may implement additional contractual, technical or organisational safeguards, including access restrictions, encryption, data minimisation and limited retention periods.

8.5 Further information

A person may request information concerning the safeguards applicable to a relevant international transfer by contacting JAL AERO at info@jalaero.com.

“`

Article 9 – Cookies and Trackers

“`

9.1 Definition

A cookie is a small text file or comparable tracker stored or accessed on a user’s device when visiting a website.

9.2 Strictly necessary cookies

Strictly necessary cookies may be used to:

• Operate WordPress and WooCommerce
• Maintain a shopping cart and checkout session
• Open and process secure payment links
• Maintain an authenticated user session
• Secure forms and transactions
• Prevent fraud and malicious activity
• Remember cookie preferences

These cookies do not require prior consent where they are necessary to provide a service expressly requested by the user.

9.3 Payment cookies

Monetico, banking institutions and 3D Secure authentication services may use technical cookies or identifiers necessary to initiate, authenticate, secure and complete a payment.

9.4 Audience measurement and optional cookies

If optional analytics, functional, advertising or social-media services are activated, the corresponding cookies are used only under the conditions described in the Cookie Policy and after consent where required.

9.5 Managing preferences

The cookie management tool allows users to accept, refuse or customise non-essential cookies and to modify their choices later.

Refusing non-essential cookies does not prevent access to the Website, quotation requests or the completion of an order.

9.6 Dedicated Cookie Policy

Further information is available in the Cookie Policy.

“`

Article 10 – Third-Party Services

“`

The Website and JAL AERO’s commercial activities rely on services provided by third parties. These providers may process personal data under JAL AERO’s instructions or, in certain circumstances, as independent data controllers.

10.1 Website hosting

The Website is hosted by OVH SAS. Hosting and infrastructure services may process technical logs, IP addresses, backups and data required to operate and secure the Website.

10.2 WordPress and WooCommerce

The Website uses WordPress and WooCommerce to provide content-management, customer-account, shopping-cart, order and checkout functions.

Plugins and extensions used with these systems may process only the data required for their stated technical function.

10.3 Monetico

Payment-card transactions are processed through Monetico.

Monetico and the banking participants involved may process payment, authentication, device, fraud-prevention and transaction data under their own legal and regulatory obligations.

10.4 Carriers and logistics providers

Carriers, freight forwarders and customs brokers process recipient, contact, shipment, tracking and customs data in order to transport and deliver orders.

10.5 Suppliers and aviation partners

Suppliers, manufacturers, repair organisations, inspection providers and aviation partners may receive limited information required to source, identify, document, inspect or return a product.

10.6 Compliance services

JAL AERO may use public databases or specialised providers to verify company information, sanctions, embargoes, export restrictions, end users and other compliance information.

10.7 Audience measurement

If an audience measurement service is enabled, it is used according to its actual configuration and only after consent where required.

10.8 External websites

The Website may contain links to third-party websites. JAL AERO does not control the privacy practices of an external website and users should consult the policy provided by the relevant operator.

“`

Article 11 – Data Subject Rights

“`

Subject to the conditions and limitations established by applicable law, individuals have the following rights:

11.1 Right of access

An individual may obtain confirmation as to whether JAL AERO processes personal data concerning them and may request access to that data and related processing information.

11.2 Right to rectification

An individual may request the correction of inaccurate personal data and the completion of incomplete data.

11.3 Right to erasure

An individual may request the deletion of personal data in the circumstances provided by law.

This right does not require JAL AERO to delete data that must be retained for accounting, tax, customs, sanctions, export-control, contractual or legal-claims purposes.

11.4 Right to restriction

An individual may request that the use of their data be temporarily restricted in the circumstances established by law.

11.5 Right to data portability

Where applicable, an individual may receive personal data they provided in a structured, commonly used and machine-readable format and may request its transmission to another controller where technically feasible.

11.6 Right to object

An individual may object to processing based on JAL AERO’s legitimate interests for reasons relating to their particular situation.

An individual may object to direct marketing at any time and without providing a reason.

11.7 Withdrawal of consent

Where processing is based on consent, the individual may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

11.8 Rights relating to automated decisions

An individual has the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except in the circumstances permitted by law and subject to appropriate safeguards.

Automated tools may be used to flag fraud, sanctions or compliance risks. Where required, a significant decision is reviewed by an authorised person before final action is taken.

11.9 Instructions after death

Where French law applies, an individual may define instructions concerning the retention, deletion and communication of their personal data after death.

11.10 Exercising your rights

Requests may be submitted:

• By email: info@jalaero.com
• By post: JAL AERO, 13 A rue des Châtaigniers, 44690 Château-Thébaud, France

The request should clearly identify the right being exercised and provide the information necessary to locate the relevant data.

JAL AERO will respond without undue delay and normally within one month of receiving the request. This period may be extended by up to two additional months where permitted because of the complexity or number of requests. The individual will be informed of any extension within the initial one-month period.

Proof of identity may be requested only where JAL AERO has reasonable doubts concerning the identity of the person making the request.

11.11 Complaint to the CNIL

An individual who considers that the processing of their personal data infringes applicable law may lodge a complaint with:

CNIL
3 Place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France
Website: www.cnil.fr

“`

Article 12 – Data Security

“`

12.1 General security measures

JAL AERO implements technical and organisational measures proportionate to the nature of the data, processing purposes and identified risks.

These measures may include:

• SSL or TLS encryption for Website communications
• Restricted access to administrative and commercial systems
• Individual user accounts and access controls
• Strong authentication and password-management measures
• Security updates and technical maintenance
• Website firewall and malware-protection tools
• Logging and monitoring of sensitive actions
• Backups and recovery procedures
• Secure hosting infrastructure
• Data minimisation and limited retention
• Confidentiality obligations for authorised personnel and providers

12.2 Payment security

Complete card information is entered and processed within the secure payment environment operated by Monetico and the relevant banking participants.

JAL AERO limits its payment processing to transaction information required to identify the order, verify payment status, issue refunds and manage disputes.

12.3 Payment-link security

Secure payment links may use temporary, random and restricted tokens. JAL AERO may apply expiry periods, single-use restrictions, access logs and account-level controls to reduce the risk of unauthorised use.

Recipients should not publish or forward a payment link to unauthorised persons.

12.4 Organisational measures

Access to personal data is limited according to professional responsibilities and operational necessity.

JAL AERO requires relevant service providers to apply appropriate security and confidentiality measures where they process data on its behalf.

12.5 Data breaches

If a personal-data breach occurs, JAL AERO will investigate the incident, take reasonable corrective action and notify the CNIL and affected individuals where required by applicable law.

“`

Article 13 – Minors

“`

The Website and the products and services offered by JAL AERO are primarily intended for aviation professionals, companies and adults capable of entering into a contract.

JAL AERO does not knowingly request commercial, payment, aircraft or export-compliance information from minors acting independently.

A minor must not create an account, request a commercial quotation, submit payment information or place an order without the authorisation and supervision required by applicable law.

If a parent or legal representative believes that a minor has supplied personal data without appropriate authorisation, they may contact JAL AERO so that the situation can be reviewed and the data deleted where legally appropriate.

“`

Article 14 – Changes to this Privacy Policy

“`

JAL AERO may amend this Privacy Policy to reflect changes in legislation, regulatory guidance, commercial activity, Website functionality, payment systems, international shipping arrangements or technical service providers.

If a material change affects how personal data is used, JAL AERO may provide information through a notice on the Website, an updated consent interface or an email where appropriate.

The date of the latest update appears at the top of this document.

“`

Article 15 – Contact

“`

For any question concerning this Privacy Policy or the exercise of data-protection rights, please contact:

JAL AERO will process requests diligently and respond within the time limits established by applicable data-protection legislation.

“`