Privacy Policy

INFORMATION YOU PROVIDE DIRECTLY

When you register, list items, or contact us, we collect: full name, email address, phone number, company name, business address, certifications and license numbers (FAA/EASA), and payment-related information processed securely via Stripe.

AUTOMATICALLY COLLECTED DATA

We automatically collect usage data including IP address, browser type, device identifiers, pages visited, search queries, and interaction timestamps for platform security and improvement.

TRANSACTION DATA

All transaction records, order history, quote communications, and escrow-related data are stored to facilitate dispute resolution and regulatory compliance.

PLATFORM OPERATIONS

To process transactions, verify vendor credentials, manage escrow accounts, facilitate buyer-seller communications, and provide customer support.

SAFETY & COMPLIANCE

To verify FAA/EASA certifications, detect fraud, enforce our prohibited items policy, and report violations to relevant aviation regulatory authorities (FAA, EASA, GCAA) when legally required.

COMMUNICATIONS

To send order notifications, quote updates, policy changes, and platform announcements. You may opt out of marketing emails at any time.

LEGAL OBLIGATIONS

To comply with Swedish law, GDPR requirements, and international aviation safety standards (ICAO). Certain transaction data may be retained for up to 7 years for tax and legal compliance.

WITH OTHER PLATFORM USERS

Vendor company names, certifications, and listing details are visible to registered buyers. Personal contact details are only shared when both parties confirm a transaction.

WITH SERVICE PROVIDERS

We share data with trusted third-party processors including Stripe (payments), Stockholm Chamber of Commerce (arbitration services), and authorized MRO inspection bodies when required.

LEGAL DISCLOSURES

We may disclose your information to law enforcement, regulatory bodies, or courts when legally compelled, or when necessary to prevent fraud, enforce our Terms, or protect public safety.

NO SALE OF DATA

We do not sell, rent, or trade your personal information to any third party for marketing purposes.

TECHNICAL SAFEGUARDS

All data is transmitted via TLS/SSL encryption. Payment data is processed exclusively through Stripe's PCI-DSS compliant infrastructure. We do not store raw card details.

ACCESS CONTROLS

Access to user data is restricted to authorized AEX personnel on a need-to-know basis. All internal access is logged and audited.

BREACH NOTIFICATION

In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours in accordance with GDPR Article 33.

PRIMARY STORAGE

Your data is primarily stored on servers within the European Economic Area (EEA), in compliance with GDPR requirements.

CROSS-BORDER TRANSFERS

Where data is transferred outside the EEA (e.g., to FAA databases or US-based MROs), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

ESSENTIAL COOKIES

We use strictly necessary cookies for authentication, session management, and security. These cannot be disabled.

ANALYTICS COOKIES

With your consent, we use analytics tools to understand platform usage patterns and improve our services. You can manage cookie preferences via our Cookie Settings banner.

NO THIRD-PARTY ADVERTISING

We do not use advertising or tracking cookies for third-party marketing purposes.

RIGHT OF ACCESS

You have the right to request a copy of all personal data we hold about you.

RIGHT TO RECTIFICATION

You may request correction of any inaccurate or incomplete personal data.

RIGHT TO ERASURE

You may request deletion of your personal data, subject to legal retention obligations (e.g., transaction records required for tax purposes).

RIGHT TO RESTRICTION & PORTABILITY

You may request that we restrict processing of your data, or receive it in a portable format for transfer to another service.

RIGHT TO OBJECT

You may object to processing based on legitimate interests, including direct marketing communications.

HOW TO EXERCISE YOUR RIGHTS

Submit a written request to: legal@aex-aviation.com. We will respond within 30 days. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se.

ACCOUNT DATA

Active account data is retained for the duration of your account. Upon account closure, personal profile data is deleted within 90 days.

TRANSACTION RECORDS

Transaction and order history is retained for 7 years to comply with Swedish tax law and aviation regulatory requirements.

COMPLIANCE LOGS

Certification verification logs and regulatory reports are retained indefinitely if linked to a safety investigation or legal proceeding.

AGE RESTRICTION

AEX is a B2B aviation marketplace. Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware of such data, it will be deleted immediately.

DATA CONTROLLER

AEX Operations, operating as AEX (AeroExchange), Hisingsgatan 28, 411 03 Gothenburg, Sweden.

PRIVACY INQUIRIES

For all privacy-related requests, complaints, or GDPR inquiries, contact: legal@aex-aviation.com. Response time: within 30 days of receipt.

SUPERVISORY AUTHORITY

You have the right to file a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten — IMY) at imy.se if you believe your data has been processed unlawfully.