Data Processing Terms
Version of 6 November 2026 · Integral part of the Terms and Conditions and of the Privacy Notice
These Data Processing Terms set out, precisely and completely, how Aeroprop Trading SA processes the personal data of its clients, guests, participants and visitors: in which roles, through which providers, in which countries, with which safeguards and security measures, and how you are informed and protected. By ticking the acceptance box on any of our forms you confirm that you have read them and that you consent to the processing they describe.
1. Parties and roles
- Controller. Aeroprop Trading SA, Chemin du Budron A14, 1052 Le Mont-sur-Lausanne, Switzerland, UID CHE-113.162.256 ("Aeroprop"), decides why and how your data is processed. Data protection contact: sales@prop.aero.
- Processors. The providers listed in section 4 process data only on Aeroprop's instructions, under their data processing terms.
- Independent controllers. Organisers of Third-Party Events, charter brokers, aircraft and helicopter operators, transport companies, hotels, venues, restaurants, security companies and ticket issuers receive the data needed to deliver what you booked and process it under their own responsibility and privacy notices.
- Data subjects. Clients, their guests and passengers, and visitors of the website.
2. Subject matter, purposes and duration
Processing serves exclusively the purposes listed in section 3 of the Privacy Notice: answering requests, quoting, booking and delivering tickets and services, invoicing and accounting, legal compliance, communications you asked for, and the security of our systems. It lasts for the retention periods listed in section 6 of the Privacy Notice, after which data is deleted or irreversibly anonymised.
3. Categories of data
- Identification and contact data: name, email address, telephone and messaging number, company, job title, country.
- Billing and transaction data: billing address, VAT or UID number, amounts, currency, payment status and references. No card numbers.
- Booking data: events, tickets, services, dates, number of guests, notes, documents and invoices.
- Travel data, only where required for a service: names of passengers, dates of birth, nationality, passport or identity document details, travel times.
- Sensitive data, only if you choose to provide it and with your explicit consent: dietary, accessibility or medical requirements.
- Consent data: the versions of the terms you accepted, with date and time; your choices on invitations, news and alerts.
- Technical data: IP address, browser and device type, time of access; push alert addresses.
4. Processors and their locations
| Provider | Service | Location and safeguard |
|---|---|---|
| Supabase Inc. | Database, file storage and server functions holding requests, client records, bookings, documents and invoices | Hosted on Amazon Web Services infrastructure; company in the United States, standard contractual clauses |
| Netlify Inc. | Hosting and delivery of the website; technical access logs | Global network; United States, Data Privacy Framework and standard contractual clauses |
| EmailJS | Delivery of confirmation emails to you and of request alerts to our team | European Union and United States, standard contractual clauses |
| Apple, Google, Mozilla and Microsoft push services | Delivery of alerts you switched on, to your device | United States and European Union; they receive the alert, not your name or contact details |
| Google Fonts and Wikimedia Commons | Typefaces and certain photographs, loaded directly by your browser, which therefore transmits your IP address | United States, Data Privacy Framework (Google) |
Aeroprop may replace or add processors offering equivalent guarantees. This page always shows the current list.
5. International transfers
Where data is transferred to a country that does not provide adequate protection under Swiss or EU law, Aeroprop relies on the Data Privacy Framework where the recipient is certified, on the standard contractual clauses of the European Commission with the adaptations required by the FDPIC, or, for Organisers, Suppliers and Operators abroad, on the necessity of the transfer for the performance of the contract you requested (Article 17(1)(c) FADP, Article 49(1)(b) and (c) GDPR).
6. Technical and organisational security measures
- Encryption: all connections use HTTPS (TLS); stored data is encrypted at rest by our database provider.
- Access control: individual named accounts only, no shared passwords; database rules ensure that the public website can only submit requests and can never read client data.
- Least privilege: amounts, payments, invoices and client documents are visible only to the persons responsible for finance; other team members cannot read them, which is enforced in the database itself.
- Private documents: invoices and documents are kept in a private store and opened only through short-lived links issued to authorised finance accounts.
- No card data: Aeroprop does not collect or store card details.
- Secrets: keys that grant administrative access are kept only on the servers and never in the website.
- Browser protection: a strict content security policy and security headers protect the pages against injection and framing.
- Data minimisation: no advertising or analytics cookies; travel documents are requested only when required and deleted once the service is performed.
- Availability: website delivered over a global content network.
- Confidentiality: every person with access is bound by confidentiality and processes data only for the purposes above.
7. Data security breaches
If a breach of data security occurs, Aeroprop will assess it without delay, take measures to contain it, report it to the FDPIC as soon as possible where it is likely to result in a high risk (Article 24 FADP) and, where the GDPR applies, to the competent supervisory authority within 72 hours (Article 33 GDPR), and inform the persons concerned where this is required for their protection or where the risk to them is high.
8. Consent and its record
Every form on this website requires you to accept the Terms and Conditions, the Privacy Notice and these Data Processing Terms before anything is sent, and, for tickets and concierge services, to acknowledge expressly Aeroprop's role as intermediary. Aeroprop records which versions you accepted, with date and time, in the record of your request. Invitations and news are sent only if you tick that separate box, and you may withdraw any consent at any time with effect for the future, by writing to sales@prop.aero.
9. Your rights
Your rights of access, rectification, erasure, restriction, objection and data portability, and your right to complain to a supervisory authority, are described in section 8 of the Privacy Notice. Aeroprop ensures that its processors assist it in answering your requests.
10. Deletion and return
At the end of the retention periods, Aeroprop deletes the data or anonymises it irreversibly, and requires its processors to do the same, unless a statutory obligation requires further storage.
11. Applicable law
These Data Processing Terms are governed by Swiss law. Mandatory provisions of the GDPR and of other applicable data protection laws remain reserved and prevail.