PERSONAL DATA PRIVACY POLICY

Diamond Executive Aero Services Ltd Last updated: 9 October 2026 · Version 1.1

Summary

• Who we are. Diamond Executive Aero Services Ltd (Cyprus) is a private aviation charter broker. We do not operate aircraft ourselves: we find a suitable aircraft and arrange the flight with an air operator.
• What we collect. The details you send us in an enquiry (name, phone, e-mail, route, dates, passengers, comments), the IP address and time of the enquiry, standard server logs, website statistics and ad-click measurement if you accept cookies, and — if you book — the passenger data the operator and authorities require.
• Why. To answer your enquiry, prepare a quotation, arrange and operate your flight, meet our legal and accounting obligations, and keep the website secure.
• Who receives it. The air operator and other parties needed for your flight, and our IT and communication providers. Some of them are outside the European Economic Area, including in the Russian Federation (our e-mail and website statistics provider) — see Sections 6 and 7.
• No sale of data. We do not sell or rent personal data, and we do not make automated decisions about you.
• Your rights. Access, correction, deletion, restriction, portability, objection, withdrawal of consent, and complaint to the Cyprus Commissioner for Personal Data Protection. Write to da@diamond.aero.

---

1. Introduction

This Privacy Policy explains how Diamond Executive Aero Services Ltd ("we", "us", "our") collects and uses personal data when you visit https://diamond.aero (the "Website"), send us a flight enquiry, contact us by telephone, WhatsApp, Telegram or e-mail, book a flight through us, or when we contact you as a business contact.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the Cyprus Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data.

2. Who we are and how to contact us

The data controller is:

Please send any question or request about your personal data to da@diamond.aero with the subject "Data protection request", or by post to the address above.

We are established in the Republic of Cyprus, an EU Member State, and are directly subject to the GDPR.

Our role as a broker. We act as an intermediary between you and air operators. For the arrangement of your enquiry and booking we are the controller of your data. The air operator, and other parties who receive your data to operate the flight (Section 6.1), process it as separate controllers for their own operational, safety and legal purposes, under their own privacy notices.

3. What personal data we collect

3.1 Enquiry forms on the Website

When you send an enquiry (private jet, helicopter, empty leg, yacht or similar), we collect the data you enter:

• your name;
• your telephone number and/or e-mail address;
• route (departure and destination), dates and number of passengers;
• any comments or requirements you write in the form.

A name and at least one contact method are needed so that we can reply. Everything else is optional.

3.2 Data recorded automatically with an enquiry

Together with each enquiry our server records:

• the IP address from which it was sent;
• the date and time (UTC);
• the page and form used, the referring page and any campaign tags in the link (for example "utm" parameters);
• if you came from one of our Google ads, the ad click identifier from the link (gclid, gbraid or wbraid), and your cookie choice (accepted, declined or none) — see Section 9.

When you press a WhatsApp button on the Website, we record the same technical data (IP address, time, page, referring page) so that we can see which pages lead to WhatsApp conversations. We do not see your phone number at that moment.

3.3 Web server logs

Our web server keeps standard access logs: IP address, date and time, the page or file requested, response status, referring page and browser user-agent. We use them only to operate, secure and troubleshoot the Website.

3.4 Website statistics (cookies)

If you accept cookies, Yandex Metrica and Google Analytics collect information about your visit and Google Ads records whether you came from one of our ads — see Section 9.

3.5 Telephone, WhatsApp, Telegram and e-mail

If you call, message or e-mail us, we process your contact details and the content of the communication. Our WhatsApp Business number is connected to our own systems through a WhatsApp business service provider (Section 6.2), so that messages to and from that number are also stored in our records of your enquiry.

3.6 Booking data

If your enquiry becomes a booking, we and the air operator need the data required to arrange and lawfully operate the flight — typically each passenger's full name, date of birth, nationality, passport or ID details and, where relevant, visa details, special assistance needs and catering preferences — together with invoicing and payment details.

If you tell us about a health condition or medical need of a passenger (for example special assistance or medical requirements), we use it only to arrange the flight safely and only with your explicit consent (Article 9(2)(a) GDPR). You may withdraw that consent, but we may then be unable to arrange the flight.

If you give us data about other passengers, please make sure they are aware of this Policy.

3.7 Business contacts from other sources

We may obtain the business contact details of representatives of companies — name, position, employer, work e-mail and work telephone — from publicly available corporate sources (company websites, public registers, business publications) or from industry partners such as operators and other brokers. We use them for limited business-to-business communication about our services. If we contact you this way, we will tell you the source and how to object.

3.8 What we do not do

• We do not ask for special categories of personal data through the Website forms.
• We do not take decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (Article 22 GDPR).
• We do not sell, rent or trade personal data.
• We do not take online payments on the Website and do not receive full payment card numbers through it.

4. Purposes and legal bases

Where we rely on legitimate interests, we have balanced them against your interests and rights: the data is limited business and technical data, it is kept only for the periods in Section 8, and you can object at any time (Section 10). You can ask us for details of this assessment.

5. How your enquiry is handled

When you submit a form on the Website:

1. the enquiry and the technical data in Section 3.2 are saved on the server that hosts the Website (Hetzner, data centre in Helsinki, Finland);
2. a copy is sent by e-mail to our business mailbox da@diamond.aero and to a mailbox of our team;
3. a notification with the details of your enquiry is sent to our team through the Telegram messenger, so that we can reply quickly;
4. your enquiry is entered into our customer records, kept on the same server in Finland.

Access to these records is limited to our team members who handle enquiries.

6. Who receives your data

We share personal data only where necessary for the purposes in Section 4.

6.1 Parties needed to arrange your flight (separate controllers)

• air operators, aircraft owners and their management companies, and — where an aircraft is available only through another intermediary — other charter brokers;
• handling agents, FBOs, airports, catering and ground transport providers;
• border, customs and other public authorities of the countries of departure, arrival or overflight, as required by law.

Before you pay for a booking, we share only the trip details needed to obtain offers (route, dates, number of passengers, special requirements). Passenger identity data is passed on only for a confirmed booking.

6.2 Our service providers (processors)

WhatsApp and Telegram also process data as controllers under their own terms when you use their apps.

We may also disclose data to courts, regulators and law enforcement where we are legally required to do so or need to establish or defend legal claims.

7. Transfers outside the European Economic Area

Some recipients are located outside the EEA:

• Russian Federation (Yandex). Our business mailbox and our website statistics are provided by Yandex, which processes data in Russia. The European Commission has not adopted an adequacy decision for Russia, which means the level of protection there is not recognised as equivalent to the EU, and public authorities may have access to data under local law. For website statistics, we rely on your explicit consent given in the cookie banner after being informed of this risk (Art. 49(1)(a) GDPR). For e-mail correspondence about your enquiry or booking, we rely on the transfer being necessary for the steps you asked us to take or for the contract (Art. 49(1)(b) GDPR). If you do not want your correspondence to pass through this provider, please contact us by telephone or WhatsApp instead of e-mail and the Website form.
• Flight-related recipients. Operators, handling agents and authorities at your destination may be outside the EEA. These transfers are necessary to perform the charter you asked us to arrange (Art. 49(1)(b)–(c) GDPR), and we send only the data needed for that flight.
• United States. For providers in the United States we rely on the EU–U.S. Data Privacy Framework (Commission adequacy decision of 10 July 2023) where the provider is certified, and otherwise on the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914.
• United Arab Emirates and other countries (Telegram). Internal notifications sent through Telegram contain the details of your enquiry; this transfer is necessary for us to respond to your enquiry (Art. 49(1)(b) GDPR).

You can ask us for more information about these transfers at da@diamond.aero.

8. How long we keep your data

After these periods we delete the data or make it anonymous. We may keep data longer only where needed to establish or defend a legal claim, for as long as the claim may be brought.

9. Cookies

A cookie is a small file stored on your device by a website. Under Cyprus Law 112(I)/2004 we may store non-essential cookies on your device only with your consent.

When you first visit the Website, a banner asks whether you accept statistics and advertising cookies, with two equal buttons, "Accept" and "Decline". Until you press "Accept", the Yandex Metrica and Google Ads code is not loaded at all and nothing is sent to Yandex or Google. If you press "Decline" or simply ignore the banner, neither is loaded, and the Website, including the enquiry form, works the same way. We remember your choice for 12 months and then ask again. We have switched off Webvisor, the Yandex Metrica feature that records sessions on the page.

Google Ads. We use the Google Ads tag only to measure enquiries from our ads, and only after you press "Accept". If you came from one of our ads, the click identifier in the page address is also sent with an enquiry form on that page (Section 3.2); it is stored on your device (cookie da_click, 90 days) only after you accept. With your consent, Google receives data about your visit and ad click and uses it to measure our ads (see how Google uses data); we do not allow Google to use it for personalised advertising or remarketing.

You can change or withdraw your consent at any time through the "Cookie settings" link at the bottom of every page; withdrawing consent deletes the Yandex Metrica and Google Ads cookies of this Website. You can also delete cookies in your browser settings.

10. Your rights

You have the right to:

1. access your personal data and receive a copy (Art. 15);
2. have inaccurate data corrected (Art. 16);
3. have your data deleted in the cases set out in Art. 17;
4. restrict processing, for example while a dispute about accuracy is examined (Art. 18);
5. receive the data you gave us in a machine-readable format and have it transmitted to another controller — data portability (Art. 20);
6. object at any time to processing based on our legitimate interests, and to direct marketing without any reason (Art. 21);
7. withdraw consent at any time, without affecting earlier processing (Art. 7(3));
8. lodge a complaint with a supervisory authority.

To exercise your rights, write to da@diamond.aero ("Data protection request") or to our postal address. It is free of charge. We reply within one month; for complex requests this may be extended by two further months, and we will tell you within the first month. We may ask you to confirm your identity.

Supervisory authority

Office of the Commissioner for Personal Data Protection Kypranoros 15, 1061 Nicosia, Cyprus P.O. Box 23378, 1682 Nicosia Tel.: +357 22 818456 · Fax: +357 22 304565 E-mail: commissioner@dataprotection.gov.cy Website: https://www.gov.cy/dataprotection/en/

You may also complain to the authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first at da@diamond.aero.

11. Security

We protect personal data with measures appropriate to the risk, including:

• the Website is served only over HTTPS, with HTTP Strict Transport Security;
• our server is located in the EU, and access to enquiry records is limited to authorised team members;
• the enquiry forms are protected by rate limits, size limits and spam filtering.

No method of transmission over the internet is completely secure. If a personal data breach is likely to result in a risk to your rights, we will notify the Commissioner within 72 hours and inform you where the law requires.

12. Children

Our services are intended for adults. We do not knowingly collect data from children through the Website. Data of minors travelling as passengers is provided by the adult making the booking, who must have the authority to do so. If you believe a child has sent us personal data, contact us and we will delete it.

13. Changes to this Policy

We may update this Policy when our practices, providers or the law change. The current version is always on this page, with the "Last updated" date at the top. For material changes — a new purpose, a new type of recipient or a new transfer outside the EEA — we will place a notice on the Website before the change takes effect.