1. AvTech Adheres to the Data Privacy Framework Principles

AvTech, Inc. (“AvTech”) is a United States-based aviation industry service provider. As a data processor, AvTech processes data on behalf of its business customers through its aviation service operations, including flight support services, maintenance coordination, and related products and services that support the aviation industry. In this capacity, AvTech acts on the instructions of its business customers and does not own or have independent rights to or control of the personal data it receives and/or processes on their behalf. 

AvTech complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. Data Privacy Framework (“UK Extension to the EU-U.S. DPF”), and the Swiss- U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data transferred from the European Union and European Economic Area (“EU”), the United Kingdom and Gibraltar (“UK”), and Switzerland to the United States. AvTech has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF principles of: notice; choice; accountability for onward transfer; security; data integrity and purpose limitation; access; and recourse, enforcement and liability; as well as the supplemental principles (as applicable) that explain and augment those seven privacy principles (the “Principles”). If there is any conflict between the terms in this Privacy Policy and the Principles, the Principles shall govern.

To learn more about the Data Privacy Framework program, and to view AvTech’s certification, please visit https://www.dataprivacyframework.gov/. 

In connection with its aviation industry services, AvTech may collect and process the following categories of personal data from or on behalf of its direct US, EU, UK, and Swiss clients: clients’ customer names and contact information (including email addresses, telephone numbers, and mailing addresses); business and organizational identifiers (including, company name, title, and department); travel and booking data (including flight information, itineraries, and reservation details); service and maintenance records; correspondence and communications; and professional and employment-related information of client contacts. ¹ AvTech does not knowingly collect medical or health-related personal data in the ordinary course of its aviation services.

The U.S. Federal Trade Commission (“FTC”) has jurisdiction over AvTech’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. In certain situations, AvTech may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

2. Notice

By virtue of this Privacy Policy, and subsequent updates or revisions to this Privacy Policy which will be posted to AvTech’s website, AvTech is hereby informing you about the types of personal data collected, the purposes for which it is collected and used, how to contact AvTech with inquiries or complaints, an individual’s right to access their personal data, the choices and means AvTech offers for limiting the use of personal data, the independent recourse mechanism designated to address complaints at no cost to you, the fact that AvTech is subject to the investigatory and enforcement powers of the FTC and/or other governmental regulators, the possibility of invoking binding arbitration under certain conditions, and the requirement to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. 

Where personal data is collected by AvTech through means other than its website, or where AvTech processes personal data on behalf of a client acting as a data controller, the notice will be provided in clear and conspicuous language when an individual is first asked to provide such information. In those instances, and to the extent provided for by applicable law, AvTech may rely on its data controllers to satisfy the notice and consent requirements under relevant and applicable data protection law, and will only act on the instructions of that controller.

3. Choice

AvTech will not use personal data for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by you without first providing you the opportunity to opt out. AvTech will provide clear, conspicuous, and readily available mechanisms to exercise these choices as deemed reasonable under the given circumstances.

For sensitive personal data — including data specifying medical or health conditions, racial or ethnic origin, etc. — AvTech requires affirmative express consent (opt in) before such data is used for a purpose other than those for which it was originally collected or subsequently authorized.

Disclosures required by law or legal proceedings are exempt from the choice principle.

4. No Third-Party Data Sharing

AvTech does not sell, share, disclose, or otherwise transfer personal data to third parties. All personal data received by AvTech is processed solely by AvTech in connection with its aviation industry services and in accordance with the instructions of its business customers. AvTech does not engage third-party agents or service providers to process personal data on its behalf.

5. Security and Data Integrity

AvTech handles US, EU, UK, and Swiss individuals’ personal data with reasonably appropriate care and safeguards. AvTech has security measures in place to help protect personal data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. In addition, any data processing will be carried out with reasonable and appropriate security measures, taking due account of the risks involved in the processing and the nature of the personal data. 

AvTech may be required to disclose personal information collected at its website site or processed for AvTech business purposes in response to legal process, for example, in response to a court order or a subpoena. AvTech also may disclose such information in response to a law enforcement or other government agency’s request, or where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our terms of use, to comply with legal requirements, or as otherwise required by or law. 

AvTech has a Privacy Administrator identified below who is responsible for the internal supervision of AvTech’s privacy policies and practices.

6. Data Integrity and Purpose Limitation

AvTech will take reasonable steps to limit the personal data it knowingly processes to that which is relevant for the purposes of the particular processing. AvTech will not purposefully process personal data in a way that is incompatible with the purposes for which it has been collected or subsequently authorized by the individual. 

To the extent necessary for those purposes, AvTech will take reasonable steps to ensure that personal data is reliable for its intended use, accurate, complete, and current. AvTech will adhere in good-faith to the DPF Principles for as long as it retains such information. 

Personal data may be retained in a form identifying or making identifiable the individual only for as long as it serves a purpose of processing consistent with the DPF Principles. This obligation does not prevent AvTech from processing personal data for longer periods to the extent such processing reasonably serves the purposes of archiving in the public interest, scientific or historical research, or statistical analysis, subject to appropriate safeguards.

7. Access and Rights

Individuals, while not direct customers of AvTech, may have the right to obtain from AvTech confirmation of whether AvTech is processing personal data relating to you, and, in some limited instances, have that data communicated to you within a reasonable timeframe, at a charge, if any, that is not excessive, and in a reasonable manner. Individuals may have the right to correct, amend, or delete personal data where it is inaccurate or has been processed in violation of the DPF Principles except where the burden or expense of providing access would be disproportionate to the risks to your privacy in the case in question, or where the rights of persons other than you would be violated.

To exercise your access rights, you may submit a request by email to dpa@avtechcorp.com or by mail to AvTech Inc.’s privacy office at the address set forth in the Contact Information section of this policy. Please provide your full name, and flight details in the email submission.

8. Recourse, Enforcement, and Liability

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, AvTech commits to refer unresolved complaints concerning its handling of personal data received in reliance on the DPF to JAMS, an independent third-party dispute resolution body based in the United States. The services of JAMS will be provided at no cost to you. You may visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint.

The FTC has jurisdiction over AvTech’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. AvTech’s failure to comply with the DPF Principles may constitute a violation of Section 5 of the FTC Act prohibiting unfair and deceptive acts or practices. 

If you do not receive timely acknowledgment of your DPF Principles-related complaint, or if AvTech has not addressed your complaint to your satisfaction, you may, under certain conditions, invoke binding arbitration. This option is available after you have: (1) raised the complaint directly with AvTech and afforded AvTech an opportunity to resolve the issue; (2) made use of the independent recourse mechanism identified above; and (3) raised the issue through the relevant data protection authority and afforded the U.S. Department of Commerce an opportunity to resolve the complaint.

9. Data Retention

AvTech retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required or permitted by applicable law. Upon the expiration of the applicable retention period, or upon a valid request for deletion, personal data will be securely deleted or anonymized. AvTech will continue to adhere to the DPF Principles for as long as it retains personal data received under the DPF, including after any withdrawal from the DPF Program. Following withdrawal, AvTech will either return or delete the personal data collected under the DPF, or will continue to protect such data in accordance with the DPF Principles.

10. Changes to This Policy

AvTech reserves the right to amend this policy from time to time consistent with the requirements of the DPF, and to comply with applicable changes in legal and regulatory requirements.

Any material changes to this policy will be posted on the AvTech website at
https://www.avtechcorp.com/.

If AvTech makes material changes that affect personal data previously collected under a prior version of this policy, AvTech will provide appropriate notice by posting such change to its website and, where required by the DPF Principles, obtain consent before applying such changes to previously collected data. AvTech’s continued participation in the DPF is contingent upon its ongoing compliance with the DPF Principles as they may be updated from time to time by the U.S. Department of Commerce.

11. Contact Information

Individuals with inquiries or complaints regarding AvTech’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF Principles or this policy may contact AvTech by mail, email, or telephone at:

AvTech, Inc.
Attn: Data Privacy Office
2126 S. Wolf Road
Des Plaines, Illinois 60018
dpa@avtechcorp.com

For more information about the Data Privacy Framework program, and to view AvTech’s certification, please visit https://www.dataprivacyframework.gov/.