Privacy

1. Who we are

1.1 The Back2Flight platform, available at back2flight.com, is operated by VirtualBridge LLC, a limited liability company organised under the laws of the State of New Mexico, United States (entity number 0008064883), whose registered address is 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States ("Back2Flight", "we", "us"). We are the controller of the personal data described in this policy.

1.2 Contact for any question about your data: contact@back2flight.com. We have not appointed a representative in the European Union at this time: our processing of data of persons in the Union is limited in scale and does not involve special categories of data. We will appoint one, and name it here, when the scale of our activity in the Union so requires.

1.3 This policy applies to visitors, to users of buyer accounts and of supplier accounts, to people who leave a request and to people who write to us. The platform is for professional use; most data we handle are business contact data of people acting for their organisation.

2. Data we handle

2.1 Account data: email address, password (stored only in hashed form by our authentication provider), full name, phone number if given, the organisation you belong to, your role (admin, buyer, quality for buyers; admin or member for suppliers), invitations sent and accepted, the version and date of the terms you accepted and, for supplier users, the date of your confirmation of the undertaking on introduced buyers (supplier terms, clauses 8.8 to 8.15).

2.2 Organisation data: legal name, country, billing and delivery addresses, VAT number or equivalent, type of organisation and approval number for buyers; for suppliers, currency, payment terms, carriers, lead time, the address that receives orders, declared approvals with their files, any commission rate agreed in writing and the "referred by" field when filled in.

2.3 Order and quote data: purchase orders, quote requests and requests on aircraft listings with the data of the buyer recorded at that time (organisation, addresses, name, email and phone of the contact), statuses and their history with the user who acted, messages and attachments in order threads, problem reports, documents uploaded by suppliers, purchase order PDFs, monthly commission statements, the list of buyers introduced to each supplier (organisation, introduction date, items concerned) and the declarations of aircraft sales and leases made by suppliers.

2.4 Stock files uploaded by suppliers, their lines and the reading template validated by the supplier, and aircraft listings with their declared data. These are business data; they may contain personal data only if a supplier puts them there.

2.5 Search data: each search records the query, the filters and the number of results. For a signed-in user, the search is linked to the user account; for a visitor, it is not linked to any identifier.

2.6 Contact form: your name, email address and message.

2.7 Emails: the emails the platform sends (recipient, template, content and delivery status) and the emails you send to our addresses.

2.8 Technical data: our hosting provider processes request logs (such as IP address, browser data, page requested and time) to deliver and protect the platform. Records of actions taken by Back2Flight staff on behalf of suppliers and of administration actions are kept with their author and date.

2.9 Requests: when you leave a request for a part, equipment, an aircraft or a lease, with or without an account, we keep the details of what you look for (category, part number or model, quantity, condition, aircraft type, lease wanted), the date you need it by if you give one, the search you made before the request if there was one, your e-mail address, your company and country, and your note, to pass the request on to suppliers and to tell you when an offer is listed. Suppliers receive the details of what you look for, the quantity and that date only, never your identity. The "Requests" tab of the platform shows an anonymised list of open requests (category, part number or model, description, quantity, country and date); your name, company and e-mail address are never shown there. We keep a request for 12 months after it is matched or closed, then delete it. You can stop the e-mails for a request at any time with the link in the e-mail confirming your request.

2.10 For partner stock, the name of the owning company or person as given to us by an associate, kept internally and never published, and the written replies of that owner (by email or messaging app) to our listing note and to our introduction messages, kept with the offer and the order concerned.

3. Why we use them and on what legal basis

3.1 To create and run your account, transmit orders, quote requests and requests, relay statuses, documents and messages, send the related emails, show the anonymised list of open requests and issue commission statements: performance of the contract with you or your organisation (terms of use or supplier terms), and our legitimate interest in running the platform when you act for an organisation.

3.2 To keep a dated record of the acceptance of terms, of the confirmation of the undertaking on introduced buyers, of order events, of introductions of buyers to suppliers, of declarations of sales and leases and of actions taken on behalf of suppliers: our legitimate interest in being able to prove what was agreed and done, and in calculating commissions correctly.

3.3 To secure the platform, prevent abuse and fraud, and limit the rate of requests: our legitimate interest.

3.4 To improve search and the catalogue from search statistics: our legitimate interest.

3.5 To keep invoices and accounting records and answer lawful requests from authorities: legal obligations.

3.6 To answer messages sent through the contact form or by email: our legitimate interest in answering, or steps taken at your request before a contract.

3.7 We do not use your data for advertising, we do not sell them, and we do not make decisions about you based solely on automated processing.

4. Who receives them

4.1 The other party to an order, a quote or a request on an aircraft listing: the supplier receives the buyer data recorded in the purchase order or request, and the buyer sees the supplier's declared information and the names of the supplier users who write in the thread. The supplier uses buyer data as an independent controller, under the supplier terms. A request left under clause 2.9 is passed to suppliers without your identity.

4.2 Users of your own organisation, according to their role.

4.3 Back2Flight staff, who administer suppliers, orders and statements.

4.4 Our service providers, who process data on our instructions:

• Supabase (database, authentication and file storage), with the data hosted in the European Union (Frankfurt region);
• Cloudflare (hosting of the website, network, security and email routing of our back2flight.com addresses);
• Brevo (sending of emails);
• Hostinger (the virtual private server that runs background tasks: stock imports, PDFs, emails), server located in Malaysia;
• Anthropic, PBC (United States), whose Claude API proposes how the columns of a supplier stock file are read: it receives the column headers and a few sample lines of the file, which in principle contain no personal data; the proposal is reviewed and validated by the supplier before any use; under Anthropic's commercial terms, Anthropic does not train its models on the data submitted through its API;
• Cloudflare (email routing of our addresses) and Google (the mailbox that receives them).

4.5 Authorities, when the law requires it.

5. International transfers

5.1 VirtualBridge LLC is established in the United States and its team may work from outside the European Union. Some of our service providers are established, or have staff, outside the European Union.

5.2 When personal data from the European Union are transferred to a country without an adequacy decision, we rely, for each provider, on its certification under the EU-US Data Privacy Framework where it has one, and otherwise on the standard contractual clauses of the European Commission included in its data processing agreement. Our background tasks run on a server in Malaysia operated by Hostinger International Ltd, a company established in the European Union, under its data processing agreement and those clauses. The data sent to Anthropic, PBC in the United States are covered by the standard contractual clauses included in Anthropic's data processing addendum. Our own access to data from the United States and from Qatar is covered by the same clauses in our internal rules. You may ask us for information on these safeguards at the contact address above.

6. How long we keep them

6.1 Account data: while the account is open, then 12 months after it is closed.

6.2 Orders, quotes, requests on aircraft listings, threads, documents, acceptance and confirmation records, the list of introduced buyers and the declarations of sales and leases: 10 years after the order, the quote or the declaration, for accounting, limitation and traceability purposes.

6.3 Commission statements and invoices: 10 years.

6.4 Stock files and their lines: 12 months after the supplier's last import. Aircraft listings: while listed, then with the quotes and requests that refer to them.

6.5 Search records: 12 months.

6.6 Contact messages: 12 months.

6.7 Email records: 12 months. Invitation links and PDF attachments are removed from our email queue once an email is sent or has failed.

6.8 Technical logs: as long as our hosting providers keep them, about 30 days.

6.9 Requests: 12 months after the request is matched or closed.

6.10 Name of the owner of partner stock (2.10): deleted when the part is attached to the supplier's account, or with the offer. The owner's written replies kept with an order follow the order (6.2).

7. Cookies and storage on your device

7.1 We use no advertising, analytics or tracking cookies, and no cookie that identifies you across visits for statistics. For this reason we do not ask for consent.

7.2 We use only what is strictly necessary for the service you ask for:

• session cookies of our authentication provider, set when you sign in, to keep you signed in (HttpOnly);
• a signed cookie that keeps the order you started while you create your account, deleted when the order resumes and at most after 7 days (HttpOnly);
• a signed cookie used during a password reset, valid for 15 minutes.

7.3 Your browser also stores, on your device only and never sent to us: your last five searches (local storage), and for the current browser session whether you closed the supplier banner and whether you paused or already saw the animation of the home page (session storage). You can clear them in your browser settings.

8. Your rights

8.1 Under the GDPR, and depending on the case, you may ask for access to your data, their rectification or erasure, the restriction of their processing, their portability, and object to processing based on our legitimate interest. You may also withdraw any consent you gave.

8.2 To exercise these rights, write to contact@back2flight.com. We may ask you to confirm your identity. We answer within the time limit set by the GDPR.

8.3 Some data cannot be erased while they are needed for an order in progress, for accounting or for legal claims; we tell you when this is the case. Order data recorded with a supplier are also held by that supplier, who answers for its own processing.

8.4 You may lodge a complaint with the data protection authority of your country of residence or work in the European Union.

8.5 Admins of an organisation can update the organisation's details, addresses and users from the account. Each user can change their password.

9. Security

9.1 Data are exchanged over encrypted connections. Each organisation sees only its own orders, quotes, documents and statements; access rules are enforced in the database. Documents are served through short lived signed links. Passwords are never stored in readable form. Administrative access is limited to the Back2Flight team and recorded.

9.2 No system is free of risk. If a data breach is likely to affect you, we inform you and the competent authority as the GDPR requires.

10. Changes to this policy

10.1 We may update this policy. The version and date are shown at the top. We inform account admins by email of any significant change.

11. Contact

11.1 contact@back2flight.com, or the contact page of the platform. Postal address: VirtualBridge LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States.