Privacy Policy

1. Who we are (Data Controller)

The data controller responsible for your personal data is:

• Name / Company: MIHAI Razvan
• Registered address: Bucharest, Romania
• Registration number (if applicable): [CUI / REG. COM. NUMBER]
• Email: kestreljetscharter@gmail.com

If you have any questions about this policy or how we handle your data, contact us at the email above.

2. Our role: what Kestrel is and is not

Kestrel is an independent affiliate of Villiers Jets. We do not own, operate, or charter aircraft ourselves.

When you request pricing through our site, we pass your enquiry to Villiers Jets, which sources aircraft and pricing from vetted third-party operators. This means your details are shared with Villiers Jets and, where relevant, with aircraft operators, in order to fulfil your request. See Section 5.

3. What data we collect

We collect the following categories of personal data:

Information you provide when requesting an estimate or quote:

• First and last name
• Email address
• Phone number (if provided)
• Trip details: origin, destination, dates, number of passengers, aircraft category
• Special requirements you choose to share (e.g. travelling with pets, extra luggage, wheelchair access, catering or other notes)
• Your consent record and the date/time you gave it

Information collected automatically:

• Basic technical data such as IP address, browser type, and device information
• Usage data (pages visited, searches performed) via cookies or similar technologies — see Section 9

We do not intentionally collect special categories of data (e.g. health data). Please do not include such information in free-text fields unless strictly necessary for your trip; if you do, you consent to us processing it for that purpose.

4. Why we use your data and our legal basis

Where we rely on consent, you may withdraw it at any time (see Section 8). Withdrawing consent does not affect processing carried out before withdrawal.

5. Who we share your data with

We share your personal data only as necessary to provide the service you request:

• Villiers Jets — to source pricing and availability. Villiers acts as a separate data controller for the purposes of fulfilling your booking. We recommend reviewing Villiers Jets' own privacy policy.
• Aircraft operators — where an enquiry proceeds, relevant trip details may be shared with vetted operators so they can quote and, if you proceed, arrange your flight.
• Service providers — companies that host our website and store our data (including our website and backend platform provider) process data on our behalf under appropriate agreements.
• Legal / regulatory authorities — where required by law.

We do not sell your personal data to anyone.

6. International data transfers

Aircraft operators and service providers may be located outside the European Economic Area (EEA). Where your data is transferred outside the EEA, we take steps to ensure it is protected by appropriate safeguards, such as European Commission adequacy decisions or Standard Contractual Clauses.

By requesting a quote for a route or operator based outside the EEA, you understand that fulfilling your request may require transferring your data internationally.

7. How long we keep your data

We keep your personal data only as long as necessary for the purposes described above:

• Enquiry and quote data: [e.g. 24 months] from your last interaction, unless a longer period is required for legal or accounting reasons.
• Consent records: retained for as long as required to demonstrate compliance.
• Technical/usage data: [e.g. up to 14 months].

After these periods, we delete or anonymise your data.

8. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten"), subject to legal limits
• Restrict or object to certain processing
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at [CONTACT EMAIL]. We will respond within one month.

You also have the right to complain to the Romanian Data Protection Authority:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

B-dul General Gheorghe Magheru 28-30, Sector 1, București
Email: anspdcp@dataprotection.ro · Web: www.dataprotection.ro

9. Cookies

We use cookies and similar technologies to operate the site and, with your consent, to understand how it is used. Essential cookies are necessary for the site to function. Non-essential cookies (e.g. analytics) are set only after you accept them via our cookie banner.

You can manage or withdraw your cookie preferences at any time through the banner or your browser settings.

10. Data security

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

11. Children

Our services are intended for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, please contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the latest version. Material changes will be communicated where appropriate.

13. Contact

Questions or requests regarding this policy or your data:

[YOUR LEGAL NAME / COMPANY]

Email: [CONTACT EMAIL]