Privacy Policy

This privacy policy informs you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process when you visit this website or send us a request, for which purposes and on which legal basis.

The controller responsible for data processing is Valionex Aviation GmbH, Speditionstraße 15a, 40221 Düsseldorf. Email: contact@valionexaviation.com.

We have not appointed a data protection officer, as we are not legally required to do so. For questions about data protection, please contact contact@valionexaviation.com.

• This website does not set any cookies.
• We do not use analytics, tracking or advertising services, social media plugins or third-party content. Fonts and graphics are served from our own server.
• We process personal data only to the extent necessary to provide this website and to handle your requests, or where required by law.

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The server functions that process form requests run in a data centre in Frankfurt am Main, Germany.

Each time the website is accessed, Vercel processes technically necessary access data:

• IP address of the requesting device
• date and time of access
• requested page or file and amount of data transferred
• response status code
• previously visited page (referrer), if your browser transmits it
• browser type and operating system

This data is needed to deliver the website and to ensure its stability and security, for example to detect and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a secure and functioning website. Log data is deleted automatically after a short period unless it is needed to investigate a security incident.

We have concluded a data processing agreement with Vercel pursuant to Art. 28 GDPR. As Vercel is a company based in the USA, a transfer of personal data to the USA cannot be ruled out. Vercel is certified under the EU-US Data Privacy Framework; the transfer is based on the adequacy decision of the European Union (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46(2)(c) GDPR).

When you send us a request through a form, we process the information you enter:

• name, company, business email address and phone number; for requests about parts and lubricants also your job title and the company website (for general requests the phone number is optional)
• the content of your request, for example part numbers and alternate part numbers, description, quantity, required condition, outright purchase or exchange, required delivery date, aircraft type, aircraft class, aircraft registration or serial number, documentation required, your own reference, for lubricants the product, quantity and packaging, urgency, topic and message
• for requests about parts and lubricants, additionally customer due diligence and export-control information: customer status, for existing customers optionally the customer number, destination country, intended use, the end user's company and country where applicable and your end-use declaration; for new customers also the company's country and city, its commercial register or VAT identification number and its type of business

We use this information to handle your request, prepare a quotation and contact you. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures and performance of a contract) and Art. 6(1)(f) GDPR where you act on behalf of a company; our legitimate interest lies in handling business enquiries.

We need the export-control information to comply with our obligations under foreign trade law and to prevent violations of export restrictions and sanctions, in particular under the German Foreign Trade and Payments Act and Ordinance, the EU Dual-Use Regulation (EU) 2021/821 and the sanctions regulations of the European Union. The legal bases are Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR; our legitimate interest lies in knowing our business partners and excluding unlawful deliveries. For this purpose we screen companies and persons involved, with software support, against the financial sanctions list of the European Union and the sanctions list of the US Department of the Treasury (OFAC SDN), and against country rules. If the screening shows a possible match, the request is put on hold until a member of our staff has reviewed it personally.

To prevent misuse, we only accept requests from business email addresses; the form rejects addresses from free email providers and disposable addresses. We also compare the domain of your email address with the company website you state. If they differ, this is only a note for our personal review of the request. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in assessing whether business requests are authentic.

Required fields are marked in the form. Without this information we cannot handle your request; for requests about parts and lubricants, the export-control information is a prerequisite for a quotation.

Your request is not stored on the website. It is transmitted in encrypted form to our internal processing system and stored there so that we can handle it, meet deadlines and document our checks. We also receive it by email in our mailbox. We operate the internal system with Supabase (database, Supabase Inc., USA) and Vercel (Vercel Inc., USA); the data is stored and processed in data centres in Frankfurt am Main. We have concluded data processing agreements pursuant to Art. 28 GDPR with both providers. Access from the USA, for example for support and operations, cannot be ruled out completely; it is safeguarded by standard contractual clauses (Art. 46(2)(c) GDPR) and, where the provider is certified, by the EU-US Data Privacy Framework (Art. 45 GDPR). After you submit it, we send an automatic confirmation of receipt with a reference number to the email address you provided. For sending and for the mailbox we use ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. We have concluded a data processing agreement with this provider pursuant to Art. 28 GDPR.

To protect against automated spam, the forms contain a field invisible to humans and a time check. In addition, your IP address is held in the working memory of the server function for no more than ten minutes to limit the number of requests per sender. It is not stored permanently and not combined with other data. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protection against misuse.

If you contact us by email, we process your information to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns or prepares a contract, otherwise Art. 6(1)(f) GDPR.

Our employees use a digital business card at card.valionexaviation.com (hosted by Vercel, see section 3). Using the “Send my contact” function, you can send us your name, your company, your email address and, optionally, your phone number and a message. We receive these details by email and store them as a business contact in order to stay in touch with you. We send one automatic email with our employee's contact details to the email address provided; this email contains none of your entries and no advertising. To prevent misuse, we briefly process your IP address in memory to limit the number of submissions; it is not stored. The legal basis is Art. 6(1)(b) GDPR where pre-contractual steps are concerned, otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in maintaining business contacts and in preventing misuse. Section 7 applies to the storage period.

The digital business card also contains a link to WhatsApp. If your details cannot be delivered by email, the form offers to send them via WhatsApp instead; WhatsApp then opens on your device with a prepared message to our employee's business phone number, and nothing is sent until you tap send in WhatsApp. Using WhatsApp is voluntary; you can always reach us by email instead. WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Data may be transferred to Meta Platforms Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Which data WhatsApp processes is governed by WhatsApp's privacy policy. The legal basis for our processing is Art. 6(1)(b) or (f) GDPR as above.

The digital business card sets no cookies and uses no analytics or tracking services. Only if you install the card as an app on your device does it store its own files (page, contact file, icons) in your browser's storage so that it can be displayed without an internet connection. This storage is strictly necessary for the offline use you requested (Section 25(2) No. 2 TDDDG); it contains no information about you and can be removed at any time by uninstalling the app or deleting the website data.

Apart from the processors named above, we only share personal data where necessary:

• with our suppliers, where needed for a quotation or for the delivery. As a rule we only share information about the part or product (for example part number, quantity, destination country), and personal data only where suppliers require it, for example for an end-use declaration;
• with freight forwarders, couriers and logistics providers to carry out the delivery;
• with authorities, in particular customs and export-control authorities, where we are legally obliged to do so;
• with tax advisers, auditors, banks and lawyers, where necessary to meet legal obligations or to protect our rights.

As we operate internationally, recipients may be located outside the EU and the EEA. Such transfers only take place where an EU adequacy decision or appropriate safeguards (Art. 46 GDPR) exist, or where the transfer is necessary for the performance of a contract with you or for pre-contractual measures (Art. 49(1)(b) GDPR).

We store personal data only as long as necessary for the respective purpose. We delete requests that do not lead to a contract no later than 24 months after the last contact, unless statutory retention obligations apply.

We retain business letters, quotations, contracts and accounting records for the statutory retention periods under German commercial and tax law (Section 257 HGB, Section 147 AO), generally six to ten years. We retain export-control records, including the records of our sanctions screening, for as long as required by foreign trade law, at least five years. We make personal data in these records unrecognisable as soon as it is no longer needed as evidence. The data is then deleted.

You have the following rights regarding your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, a message to contact@valionexaviation.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the data protection supervisory authority of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

We do not make decisions based solely on automated processing, including profiling (Art. 22 GDPR). Screening against sanctions lists and country rules is software-supported; the software can only put a request on hold. Every decision on your request, such as an approval or a rejection, is made by a person.

This website is transmitted exclusively in encrypted form via HTTPS (TLS). We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Our internal processing system is accessible only to authorised staff with two-factor sign-in. Access is restricted by role, and every change is logged in a tamper-proof way.

We update this privacy policy when the website, our processes or the legal situation change. The version published on this page applies.