Version 2 · 2 October 2026

Privacy notice

This notice covers the personal data we handle through this website — in practice, the enquiry form and the server logs behind it. It is written to be read once, so it says what we do rather than what the law permits. If something here is unclear, ask us and we will answer in the same plain terms.

Who is responsible

The controller is TPC Aviation L.L.C-FZ, a free-zone company registered in Dubai, United Arab Emirates, at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates.

For anything in this notice — a question, a correction, a deletion — write to info@tpcaptain.com and mark it for the attention of data protection. It reaches the people who answer enquiries, which in a company this size is also the people who hold the data.

We have not appointed a data protection officer, and we are not required to: under Article 10 of the UAE Personal Data Protection Law (Federal Decree-Law 45/2021) the obligation applies to high-risk processing, systematic evaluation of sensitive data and large volumes of it. A business enquiry form is none of those. The absence of a DPO does not reduce any of your rights below.

TPC Aviation L.L.C-FZ has no establishment in the European Union. Where this notice applies to people in the EU it does so under Article 3(2) of the GDPR, and until a representative under Article 27 is designated every request reaches us directly at the address above and is answered within one month.

What we collect, why, and on what basis

Only what the form asks for, plus what any web server records to stay up. There is no tracking pixel on this site, no marketing list, and nothing is bought from or sold to anyone.

Two fields are required — your name and your work email — because without them we cannot reply. Everything else is optional: leaving a field empty costs you a slower or vaguer answer, and nothing else. Where we rely on legitimate interest, the interest is specific and narrow: answering a business enquiry that you sent us, and keeping the channel that carries it working.

Please keep special categories of data out of the free-text field — health, political or religious views, trade union membership, anything about a criminal matter. We do not need it to place or inspect an aircraft, and a free-text box is the wrong place for it. If it arrives anyway we delete that part and tell you.

What we collect, why, and on what basis
What you give us	What we use it for	Legal basis	How long we keep it
Your name, role and company	Knowing who we are talking to, and answering as a person rather than a ticket.	Steps taken at your request before a contract (GDPR Art. 6(1)(b)), and our legitimate interest in answering a business enquiry (Art. 6(1)(f)).	24 months from our last contact, if the enquiry leads nowhere.
Your work email and, if you give it, your phone number	Replying to you through the channel you chose.	Art. 6(1)(b) and Art. 6(1)(f), as above.	24 months from our last contact.
The requirement itself: transaction, aircraft type, configuration, term, market of operation and the date you need it	Working out what can be placed against it, what it would cost and how long the paperwork will take in that jurisdiction.	Steps taken at your request before a contract (Art. 6(1)(b)).	24 months if nothing comes of it; if a transaction follows, the life of that transaction plus the period the applicable accounting and tax rules require.
Anything else you write in the free-text field	Whatever you tell us it is for.	Art. 6(1)(b) and Art. 6(1)(f).	The same as the enquiry it belongs to.
Your IP address, your browser and the time of the request, in the server log	Keeping the site up and stopping automated abuse of the form. Our hosting provider's firewall counts requests per IP address to limit repeated submissions and to flag automated traffic; it does not identify you.	Legitimate interest in the security of the service (Art. 6(1)(f)).	The short period our hosting provider keeps its logs for. We do not copy them anywhere else and we do not use them to build a profile of you.
A hidden field and a signed timestamp travelling with the form	Telling a person apart from a bot without making you solve a puzzle.	Legitimate interest in preventing abuse (Art. 6(1)(f)).	Discarded the moment the submission is accepted or rejected.
The cookie choice you make — only if measurement or advertising is ever introduced. Today there is nothing to choose and nothing is recorded	Doing what you asked, not asking again for a while, and being able to show that you asked it.	Legal obligation to be able to demonstrate consent (Art. 7(1)); the cookies themselves would run on your consent (Art. 6(1)(a)).	12 months, then you would be asked again.
An advertising click identifier (gclid, wbraid) — not collected today; only if advertising measurement is ever introduced and you accept it	Knowing which advert produced a real enquiry, so we can stop paying for the ones that do not.	Consent (Art. 6(1)(a)). No consent, no identifier.	With the enquiry it belongs to.

Who else sees it

Each recipient is named in the table below. Nobody else receives your data — not a data broker, not a partner, not another client. If that ever changes, this table changes before it changes.

One distinction matters more than it looks, and it is where most privacy notices quietly cheat. A processor acts only on our instructions and we answer for it. An independent controller decides its own purposes and answers for them itself; we cannot instruct it and we do not shelter our own use of it under its contracts. Google is the second kind, and so is Meta. Saying otherwise would make this notice easier to write and wrong.

Who else sees it
Who	Role	Where	What governs it
Vercel Inc.	Processor for the data you send us: it hosts the site and processes the request logs on our instructions. But it is also a controller in its own right for the data its own service generates and for its own account and contact data — that part cannot be contracted away, so we declare it instead of pretending everything here is ours to direct.	United States, serving from regions worldwide.	Vercel's data processing addendum (Art. 28 GDPR) and the EU Standard Contractual Clauses it incorporates for onward transfers.
Formspark	Processor: the form service that receives your enquiry from our server and passes it to our mailbox, on our instructions. It is a Belgian company.	European Union: submissions are stored with Amazon Web Services in Ireland and with Hetzner in Germany.	The Article 28 GDPR data processing terms included in Formspark’s terms of service. We use it without its optional third-party spam filter, so the content of your enquiry is not passed to a further provider outside the EU, and we apply the same retention periods to the copies it keeps as to our mailbox.
Microsoft	Processor: the mailbox that receives your enquiry, and the files we keep if it becomes a transaction, run on Microsoft 365.	Microsoft's data centre regions, as configured for our tenant.	The Article 28 terms of Microsoft's data protection addendum, with the EU Standard Contractual Clauses.
Google	Not a recipient today: this site runs no Google measurement or advertising. If it ever does, Google will act as an independent controller, not as our processor: for the advertising and measurement it operates, it sets its own purposes and answers for them under its own notices. Our legal basis for asking you about those cookies would be our own — your consent — and we would not claim cover under Google’s terms for it.	Worldwide.	Your consent would be needed for anything to run at all, plus the transfer mechanisms Google publishes for itself, including the EU Standard Contractual Clauses and, where it applies, the EU–US Data Privacy Framework.
Meta	Independent controller. If you write to us on WhatsApp, that conversation happens on Meta's infrastructure under Meta's terms, and your phone number becomes visible to us. Nothing from Meta is embedded in this site: the button is an ordinary link, so opening this page sends Meta nothing.	Worldwide.	Meta's own notices, which apply to you as its user. Use email or the form if you would rather Meta were not involved.
A contracted consultancy	Processor: an external consultancy builds and operates parts of this site and helps handle the enquiries that arrive, strictly on our instructions.	European Union.	Written Article 28 terms, with confidentiality and no permission to use your data for anything of its own.

Sending the form is not an international transfer. Cookies would be.

These two get mixed up constantly, and they are genuinely different things.

When you fill in the form you hand your data directly to us, a controller in the United Arab Emirates. There is no exporter in the European Economic Area and therefore no transfer in the sense of Chapter V of the GDPR — this is example 1 of the European Data Protection Board's Guidelines 05/2021. What does apply to us is Article 3(2): the GDPR governs what we then do with your data, and this notice is part of how we comply with it. So the absence of a transfer mechanism here is not a gap; it is the correct answer.

Cookies would be the other case. Today this site sets none, so nothing about your visit goes to Google or anyone else. If measurement or advertising cookies are ever introduced and you consent to them, data about your visit would go to Google as its own controller and leave your country. That would be an international transfer, relying on the mechanisms Google publishes — the EU Standard Contractual Clauses and, where it applies, the EU–US Data Privacy Framework. Which is why the cookie choice would be a separate decision from sending the form: refusing cookies would have no effect whatsoever on your enquiry or on the answer you get.

In the other direction, when we send personal data out of the United Arab Emirates, Articles 22 and 23 of the UAE Personal Data Protection Law apply: an adequate destination, or a contract that imposes the protections of that law, or your explicit consent, or the necessity of a contract you are party to.

Consent: where it would apply, and how it would work

Today nothing on this site runs on consent. There are no measurement or advertising cookies, and the form does not ask you to agree to anything beyond sending your enquiry. Replying to you is never based on consent — you wrote to us, and Article 6(1)(b) covers that — and we do not use your enquiry for commercial contact beyond answering it.

If measurement or advertising cookies are ever introduced, they will run only on your consent, asked for in a banner before anything is stored. Article 7(1) asks us to be able to demonstrate that consent, not merely to obtain it. So at that point we would store, for each purpose separately, your choice, the date and time, the version of the cookie notice in force and a technical identifier for that record — without your name. The record would be kept for 12 months, after which you would be asked again, and it would be kept after a withdrawal too, because a withdrawal is exactly what we may need to prove we honoured.

Withdrawing would take the same single click as giving consent, from a cookie settings link that would then appear in the footer of every page. Refusing would be as easy as accepting, on the first screen, with nothing pre-ticked and no wall in front of the content. None of this is on the site yet because there is nothing yet to consent to; the cookie notice will change before it is.

Withdrawing consent stops the processing from that moment. It does not make what happened before unlawful, and it cannot reach data already passed to an independent controller under its own responsibility — for that part, that controller’s own tools apply, and we will point you to them.

Your rights, and what it takes to use them

You can exercise any of these by writing to info@tpcaptain.com. We answer within one month. We may ask you to confirm the email address the enquiry came from — that is the only identity check a business enquiry needs, and we will not ask for a passport to close a contact form.

There is no charge, and using a right has no effect on any transaction in progress.

Access: a copy of what we hold about you, and where it came from.
Rectification: anything wrong gets corrected, including in the mailbox thread.
Erasure: see the next paragraph, because this is the one people actually want.
Restriction: we keep it but stop using it while something is disputed.
Objection: to anything we base on legitimate interest, at any time.
Portability: the data you gave us, in a structured, machine-readable file.
Withdrawal of consent: at any time, with no need to say why.
Complaint to a supervisory authority, without going through us first.

If you are in the European Union or the European Economic Area, you can complain to the data protection authority of the Member State where you live or work, or where you believe the infringement took place. The European Data Protection Board publishes the list of those authorities: national data protection authorities (EDPB)

How to have it deleted, specifically

Write to info@tpcaptain.com with the word erasure and the email address you used. We delete the enquiry and its attachments from the mailbox, from the form service’s records and from the transaction file, and confirm in writing what was deleted and when.

Two things survive, and you should know about both. We keep a minimal record that a deletion request was made and when — without the data itself — because that record is how we show the request was honoured. And if a transaction went ahead, accounting and tax rules require us to keep the contractual documents for their own period; we restrict them to that purpose instead of deleting them, and we say which ones they are.

Server logs are not searchable by name, so they are not deleted on request; they age out on their own, within the short period described in the table above.

No automated decisions about you

Nothing on this site decides anything about you automatically, and we do not profile you. An enquiry is read by a person, and the answer is written by one. There is no scoring, no ranking and no automatic rejection.

If you consent to advertising cookies, Google may profile you for its own purposes as an independent controller. That is its processing, under its notices and its controls, and it has no bearing on how we handle your enquiry.

Children

This site and the services it describes are for businesses — airlines, operators, lessors, traders and the people who work for them. They are not directed at anyone under 18, and we do not knowingly collect personal data from them.

If we learn that an enquiry or any other data came from someone under 18, we delete it and do not act on it.

Security, and what happens if it fails

The site is served over HTTPS only. Access to enquiries is limited to the people who answer them, on accounts in our own Microsoft 365 tenant with multi-factor authentication. We do not keep a copy of enquiries on anyone's laptop.

If there is a breach that puts your data at risk, we notify the competent supervisory authority within 72 hours under Article 33 of the GDPR and the UAE Data Office immediately under Article 9 of the Personal Data Protection Law, and we tell you directly where the risk to you is high.

United Arab Emirates: the PDPL

We are established in the UAE, so Federal Decree-Law 45/2021 on the Protection of Personal Data applies to us alongside the GDPR. We are a free-zone company registered in Dubai and are not established in either of the financial free zones (DIFC or ADGM), which have their own data protection laws; our understanding is therefore that the federal regime is the one that applies to us.

Article 13 of that law asks us to tell you, before processing begins, what the purposes are, who the data will be shared with inside and outside the UAE, and how it is protected when it crosses a border. That is what the tables above are for. Article 4 leans more on consent than the GDPR does; where we rely on the necessity of a contract or of steps before one, we say so in the table, and where we rely on consent you will have been asked.

Articles 13 to 18 give you access, portability, correction, erasure, restriction and objection, including objection to automated decisions. They are the same rights listed above and the same address reaches them. Complaints go to the UAE Data Office.

Switzerland

If you are in Switzerland, the revised Federal Act on Data Protection applies to this processing. Article 19 requires that you be told who the controller is, what the purpose is and who the recipients are, at the point your data is collected: that is this notice, and the tables above cover it.

The supervisory authority is the Federal Data Protection and Information Commissioner. Whether Article 14 obliges us to appoint a representative in Switzerland depends on thresholds we are assessing; if one is appointed, its name and address appear here and in no other place first.

If this notice changes

The version and date at the top change with it, and the previous version stays available on request. A change of wording does not need your involvement.

A change of purpose does. If we ever want to use data you gave us for something outside what this notice describes, Article 13(3) requires us to tell you before we do it, with the new purpose and its legal basis — and if the basis is consent, to ask.