Privacy Notice

Last updated: [DATE]. Data controller: Aerovista Club, 33 Fairhills, Irlam, Manchester, M44 6BA. Contact for privacy matters: marcelle@aerovistaclub.co.uk. ICO registration number: [NUMBER — confirm whether registration is required]. This notice is written for UK GDPR and the Data Protection Act 2018.

1. What we collect

• Customer records entered by staff: name, organisation, email, phone, country, notes, status, and details of the enquiry or proposed transaction.
• Staff account data: email address, authentication and access-log data, role.
• Technical data: IP address, browser/device data and security logs held by our hosting provider.
• Blockchain data: wallet addresses and transactions on public networks are public and cannot be erased by us.

We do not use the demo to collect customer personal data. We do not intentionally collect special-category data; please do not provide it.

2. Why we use it and our lawful basis

• Responding to enquiries and preparing or performing a contract with you — contract / steps before a contract.
• Managing customers, fee records and accounts — legitimate interests (running our business) and legal obligation (accounting and tax).
• Identity, anti-money-laundering and sanctions checks if a live service is offered — legal obligation.
• Securing the service and preventing fraud — legitimate interests.

3. Who receives it

Staff approved by the administrator; and processors acting on our instructions, currently Supabase (database and authentication) and Vercel (hosting). We may also share data with professional advisers, regulators, law enforcement or as required by law. We do not sell personal data.

4. International transfers

Our providers may process data outside the UK. Where they do, we rely on adequacy regulations, the UK International Data Transfer Agreement/Addendum or equivalent safeguards. [CONFIRM hosting region and provider terms.]

5. Retention

Customer records are kept while the relationship is active and for [PERIOD — e.g. 6 years after the last transaction] for legal, tax and dispute purposes, then deleted or anonymised. Enquiries that do not proceed are deleted after [PERIOD].

6. Security

Customer data is held behind staff login with row-level access controls, so only authorised staff can read or change it. Access is limited to what is needed, administrators can revoke it, and incidents are handled under our Data Breach Policy. No system is completely secure.

7. Your rights

You may request access, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Contact marcelle@aerovistaclub.co.uk. We will respond within one month. You may complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113) — we ask that you contact us first.

8. Cookies

We use only essential cookies needed for staff sign-in sessions. We do not use advertising or analytics cookies. [Update if this changes.]

9. Changes

We will publish updates here with a new date.