Privacy · Aviation Souk

What we collect and why

Contact-form submissions. Name, email, company, role, message, optional budget/timeline. Used to reply to you and, for RFQs, to route your brief to the named supplier.
AI search queries. We log the text of queries submitted to /answer/ along with a hashed (non-reversible) IP, browser family, and referrer — to improve the AI and detect abuse. We do not attach queries to personal identifiers.
Profile views. We count supplier-profile page visits, deduped by hashed IP within 30 minutes. Used for the Hot leads dashboard that tells suppliers how many viewers they’ve had.
Newsletter signups. Email only. Used to send the GCC Aviation Weekly. Unsubscribe in every email.

Third-party analytics & tracking

Aviation Souk uses three analytics tools. You can opt out of our cookie-based analytics at any time from the opt-out page.

Google Analytics 4 (GA4)

Pageview, session, and engagement metrics. GA4 uses cookies (prefix _ga_) and may transfer anonymised data to Google LLC in the United States. Disclosure: Google’s privacy policy.

Microsoft Clarity

Session recordings and heatmaps used to understand which parts of pages users interact with and where they drop off. Clarity records mouse movements, clicks, scroll depth, and page-structure interactions. All text inputs and form fields are masked by default — we do not record what you type. Data is processed by Microsoft Corporation. Disclosure: Microsoft Privacy Statement. You can review Clarity’s specific cookie policy at learn.microsoft.com/clarity/faq.

Vercel Analytics & Speed Insights

Anonymous performance and web-vitals metrics. No cookies. Data stays on Vercel’s infrastructure.

Where data is stored

Supabase — our application database (EU region). Stores RFQs, supplier profiles, newsletter subscribers, search queries.
Vercel — our hosting platform (EU/US edge). Deploys the site and runs API routes.
Resend — our transactional email provider (US/EU). Sends and receives ops mail.

Your rights under UK GDPR

Access. Request a copy of the personal data we hold about you.
Rectification. Correct anything that’s wrong.
Erasure. Ask us to delete your data; we’ll comply within 30 days unless we have a lawful reason to retain it (e.g. an active RFQ under dispute).
Portability. Receive your data in a structured, commonly used, machine-readable format.
Objection. Object to processing that relies on legitimate interest.
Opt-out. Disable GA4 and Clarity tracking from the opt-out page.
Complain. Contact the UK Information Commissioner at ico.org.uk.

UAE Personal Data Protection Law (PDPL)

If you are a data subject resident in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 (the UAE Personal Data Protection Law, effective January 2023) applies to our processing of your personal data. In addition to the rights above, you have the following UAE-specific rights:

Consent. You can withdraw consent for processing at any time; where we rely on consent, withdrawal is effective from the date of notice.
Restriction. You can ask us to restrict processing while we verify a dispute about accuracy or legality.
Cross-border transfer notice. When we transfer your data outside the UAE (for example, to our EU-based database or our US-based email provider), we do so under adequacy mechanisms or contractual safeguards. Details available on request.
Complaint. You may lodge a complaint with the UAE Data Office at dataoffice.gov.ae.

Saudi Arabia Personal Data Protection Law (PDPL)

If you are a data subject resident in the Kingdom of Saudi Arabia, the Personal Data Protection Law (effective September 2024) applies. In addition to the rights above, you have these KSA-specific rights:

Informed notice. The right to be told — at the point of collection — what data we collect, why, and with whom we share it. This policy serves that purpose.
Consent withdrawal. You can withdraw consent at any time, with effect from the date of notice.
Correction or destruction. You can require correction of inaccurate data or destruction of data processed unlawfully.
Data-subject access. Request a statement of the data we hold about you, in the form prescribed by the SDAIA regulations.
Cross-border transfer. Transfers of KSA-resident personal data outside the Kingdom are limited to circumstances permitted by SDAIA (consent, adequate protection, international obligation). We rely primarily on adequate-protection contractual mechanisms.
Complaint. You may lodge a complaint with the Saudi Data & AI Authority (SDAIA) at sdaia.gov.sa.

Data Processing Agreement (DPA)

Where you submit personal data to Aviation Souk on behalf of an organisation (for example, uploading customer contact data or submitting an RFQ with personal contact details), our standard Data Processing Agreement governs the processing — defining us as Processor and your organisation as Controller. It includes our sub-processor list, security measures, and breach-notification commitments.

Contact

For any data-related request, email hello@aviationsouk.comwith subject line “Privacy request”. We respond within 5 business days. Our registered address is 1 Paradise Lane, Rowde, Devizes, SN10 2NN, United Kingdom.

Changes to this policy

If we change how we handle data, we’ll update this page and change the date at the top. For material changes (new tracker, new data export, new region), we’ll notify active newsletter subscribers by email.

How we handle your data.