PRIVACY POLICY

Last Updated: January 26, 2026

1. INTRODUCTION

Aviatrading INC ("Aviatrading", "we", "our", or "us") is a corporation incorporated under the laws of the Province of Ontario, Canada. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information in connection with the Aviatrading.com website and related online marketplace platform for trading aviation and aircraft spare parts (the "Platform").

This Policy is designed to comply with:
• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), including 2025 amendments on data mobility;
• Applicable provincial privacy laws in Canada (e.g., substantially similar laws in Alberta, British Columbia, Quebec);
• The EU General Data Protection Regulation (GDPR), where applicable (e.g., for EU users);
• Applicable United States privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the California Online Privacy Protection Act (CalOPPA), Virginia's Consumer Data Protection Act (CDPA), and emerging 2026 laws in Indiana, Kentucky, and Rhode Island.

We regularly review this Policy to align with legal developments.

2. SCOPE

This Privacy Policy applies to all users of the Platform worldwide, including visitors, registered users, buyers, sellers, aviation suppliers, vendors, and business counterparties. It covers personal information processed in connection with Platform activities, such as browsing, account creation, transactions for aviation parts, and communications.

For EU users, GDPR applies if we target or monitor behavior in the EU. For US residents, state-specific laws apply based on your location (e.g., CCPA for Californians).

3. ACCOUNTABILITY AND CONTACT INFORMATION

Aviatrading is responsible for personal information under its control. We have designated a Privacy Officer to oversee compliance.

Email: [email protected]

We aim to respond to inquiries within 30 days (or 45 days for complex requests under CCPA/CDPA).

4. DEFINITIONS

• "Personal Information" means information about an identifiable individual, as defined under PIPEDA and, where applicable, GDPR (e.g., name, email).

• "Sensitive Personal Information" includes government identifiers (e.g., SSN, passport, ID), payment/financial data, or other categories requiring extra protection (GDPR Art. 9).

• "Processing" includes any operation performed on personal information, such as collection, use, disclosure, storage, deletion, or automated decision-making.

• "Automated Decision-Making" means decisions made solely by algorithms without human involvement (e.g., fraud detection).

5. INFORMATION WE COLLECT

We collect only what is necessary for Platform operations, minimizing data where possible.

5.1 Information Provided Directly:
• Name, company name, email, phone
• Account credentials/profile information as voluntarily provided by users for informational purposes only
• Communications/transactions (e.g., parts orders, payment details—required for fulfillment, optional for marketing)

5.2 Information Collected Automatically:
• IP address, browser/device type
• Log/usage data (e.g., viewed parts)
• Cookies/tracking technologies (see Section 8)

5.3 Information from Third Parties:
• Payment providers (e.g., card verification)
• Analytics/security partners
• Compliance/verification firms (e.g., export controls for aviation parts)

5.4 We do not intentionally collect or process special categories of personal data under GDPR (e.g., racial/ethnic origin, political opinions, religious beliefs, genetic/biometric/health/sex life data) or equivalent sensitive categories under other laws, except as incidentally provided by users (e.g., in communications). If such data is provided, we process it only as strictly necessary and with heightened safeguards.

6. PURPOSES AND LEGAL BASIS FOR PROCESSING

6.1 We process personal information for the following purposes:
• To provide, operate, and maintain the Platform
• To facilitate communication between users
• To verify accounts and prevent fraud
• To comply with legal and regulatory obligations
• To improve Platform functionality and security

6.2 Where GDPR applies, processing is based on one or more of the following legal grounds: performance of a contract, legitimate interests, legal obligation, or user consent.

6.3 Aviatrading does not collect, process, or use personal information for the purpose of determining airworthiness, regulatory compliance, or operational control of aircraft or aeronautical products, and does not act as an aircraft operator, designated operator, distributor, or approved maintenance organisation under applicable aviation regulations.

7. CONSENT

By using the Platform, users consent to the collection, use, and disclosure of personal information as described in this Policy (implied for essentials). For non-essential uses (e.g., marketing emails), we seek explicit opt-in consent.

Users may withdraw consent at any time via [email protected], subject to legal or contractual restrictions. Withdrawal won't affect prior lawful processing but may limit Platform access.

8. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to operate the Platform, analyze usage, and improve user experience. The Platform does not currently respond to "Do Not Track" signals transmitted by web browsers. However, users may manage cookie preferences through browser settings or available consent tools.

9. DISCLOSURE OF PERSONAL INFORMATION

We disclose as necessary:
• To other users solely to the extent reasonably necessary to facilitate transactions, communications, shipping, compliance, and dispute resolution (e.g., buyer/seller contact)
• To service providers performing services on our behalf (e.g., payment processors, vetted with contracts requiring safeguards)
• To regulators, law enforcement, or authorities as required by law (e.g., fraud investigations)
• In connection with a corporate transaction, merger, or sale of assets
• To protect and enforce Aviatrading's legal rights, interests, and remedies, including in connection with the investigation or prevention of fraud, suspected unlawful activity, violations of our Terms and Conditions, or in connection with actual or threatened legal claims, including the disclosure of information to professional advisors, insurers, or counterparties where reasonably necessary

We don't sell data. All disclosures use safeguards like encryption/contracts.

10. INTERNATIONAL DATA TRANSFERS

Personal information may be processed or stored outside the user's country of residence, including in Canada and other jurisdictions. Such transfers are subject to appropriate safeguards as required by applicable law.

11. DATA RETENTION

We retain personal information only for as long as necessary to fulfill the purposes identified in this Policy or as required by law.

Notwithstanding the foregoing, Aviatrading may retain personal information for longer periods where necessary for the establishment, exercise, or defense of legal claims, compliance with legal obligations, dispute resolution, or enforcement of agreements. This includes retaining records relating to transactions, communications, and account activity.

Information is securely deleted or anonymized when no longer required.

12. SECURITY SAFEGUARDS

We implement reasonable administrative, technical, and physical safeguards to protect personal information against unauthorized access, loss, misuse, or disclosure.

Particularly sensitive information (e.g., financial details) receives enhanced protections, including encryption and restricted access.

13. INDIVIDUAL RIGHTS

Subject to applicable law, users may have the right to:
• Access personal information held about them
• Request correction of inaccurate information
• Request deletion or restriction of processing (where applicable)
• Withdraw consent
• Object to certain processing activities

Requests may be submitted to the Privacy Officer using the contact details above.

14. RIGHT TO LODGE A COMPLAINT

Users have the right to lodge a complaint with a competent data protection supervisory authority in their country of residence, place of work, or where an alleged infringement has occurred.

File with us first. Under GDPR: Lodge with your local supervisory authority (e.g., EDPB list). Under PIPEDA: Contact OPC at www.priv.gc.ca.

15. DATA BREACH NOTIFICATION

In the event of a breach of security safeguards involving personal information that poses a real risk of significant harm, Aviatrading will notify affected individuals and relevant authorities as required by law.

16. CHILDREN'S PRIVACY

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors.

We delete known minor data.

17. THIRD-PARTY LINKS

The Platform may contain links to third-party websites. We are not responsible for the privacy practices of such third parties.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. The updated version will be posted on the Platform with a revised effective date. Continued use of the Platform constitutes acceptance of the updated Policy.

19. GOVERNING LAW

This Privacy Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without overriding mandatory protections (e.g., GDPR for EU users).

20. AI AND AUTOMATED DECISION-MAKING

We may use AI for fraud detection. You have rights to human review if decisions significantly affect you.