Draft
Privacy statement 2.0
Draft of how Advolo will handle personal data on advolo.org and in the marketplace at app.advolo.org.
Who we are
JSNL Aircraft Management B.V., trading as Advolo, Winthontlaan 200, 3526 KV Utrecht, the Netherlands, Chamber of Commerce number 81260970 (“Advolo”) is controller for the processing described below. Contact: hello@advolo.org.
Two roles
- Advolo as controller: for visitors of advolo.org, for people who contact us, and for the accounts, security, support and billing of the platform.
- Advolo as processor: for personal data that our customers put in the platform, such as passengers, crew, their own clients and the visitors of a broker’s website widget. The customer decides about those data; read its privacy statement, or contact it. Advolo processes them only on its instructions, under a data processing agreement.
What we process, why, and on what basis
| Who | Data | Purpose | Legal basis |
|---|---|---|---|
| Website visitors | IP address in server logs | Security and abuse prevention | Legitimate interest |
| People using the contact or access form | Name, e-mail, company, phone, message, fleet details, IP address | Answering, assessing an access request, spam prevention | Steps towards an agreement; legitimate interest |
| Users of the platform | Name, business e-mail, phone, role, company, password (hashed), preferences, language and time zone | Providing the account | Agreement with the customer; legitimate interest |
| Users of the platform | Logins and failed logins, IP address, browser, pages requested, actions such as searches, quotes and bookings, changes to data | Security, support, audit trail, preventing misuse | Legitimate interest |
| Users who switch on two-step login | Key of the authenticator app (encrypted), recovery codes (hashed), remembered devices: browser name, IP address, dates | Securing the account | Agreement with the customer; legitimate interest |
| Users who switch on push notifications | Device push address and keys, device name | Sending notifications they asked for | Consent (can be switched off per device) |
| Users of the service desk | Messages, screenshots and files they send | Support | Agreement; legitimate interest |
| Signers of a service agreement | Name, title, e-mail, time and IP address of signing, declarations ticked | Concluding the agreement and evidence | Agreement; legal obligation |
| Customer contacts for billing | Name, e-mail, company details, VAT number, invoices and payments | Invoicing and accounting | Agreement; legal obligation |
| People in a demo | Name and e-mail of the presenter, if given | Giving the demo | Legitimate interest |
We do not use personal data for advertising, we do not sell them, and we do not make decisions about people by automated means. Market insights in the platform use only aggregated figures about companies, never about persons.
Cookies
advolo.org and the platform use functional cookies: a session cookie that keeps you logged in and protects forms (deleted when you log out or close the browser), on the platform a cookie advolo_device when a user asks to remember a device for two-step login (30 days, deleted by Forget or when it expires), and on advolo.org a cookie that protects the contact form. We use no advertising cookies and load nothing from other websites; a statistics cookie is only placed with consent. Visit statistics on advolo.org are kept by Advolo itself on the Advolo platform server: anonymously without cookies by default (a daily changing visitor code, no IP address); only with the visitor’s consent with a statistics cookie (advolo_vid), the IP address (kept 90 days) and the city, and linked to a request for access. Statistics are deleted after 13 months. The website widget on a broker’s website sets no cookies. The functional cookies are strictly necessary and need no consent; the statistics cookie is only placed after consent, which can be withdrawn at any time under “Cookie settings” on advolo.org.
How long we keep data
| Data | Kept for |
|---|---|
| Contact and access requests that do not lead to an agreement | Up to 2 years after handling |
| User accounts | Until the account or the customer’s agreement ends, then deleted within 30 days (after the export period) |
| Failed login attempts | 24 hours |
| Page requests in the logs | 180 days |
| Events (logins, searches, quotes, bookings) and data changes | 3 years |
| Technical error logs | 1 year |
| Remembered devices (two-step login) | 30 days, or until forgotten |
| Push subscriptions | Until switched off, or after repeated delivery failures |
| Service desk tickets and attachments | 2 years after closing – to be decided |
| Signed agreements and their signing records | Term of the agreement + 7 years |
| Invoices and payment records | 7 years (Dutch tax law) |
| Website widget leads (processed for the broker) | Until the broker deletes them, or the end of its agreement |
Who receives data
Only the parties that need them: the hosting provider, the e-mail delivery provider and the push services of the browser or operating system you use (Apple, Google, Mozilla), whose messages are encrypted end to end. The current list of sub-processors is at advolo.org/sub-processors. Within the platform, operators and brokers see each other’s business contact details when they exchange requests and quotes. We share data with authorities only when the law requires it.
All data are stored and processed in the European Union. Should a provider outside the EU ever be used, we will only do so with appropriate safeguards, such as the EU standard contractual clauses.
Security
We protect data with encrypted connections, hashed passwords, two-step login (required for Advolo staff, available to every user), encrypted secrets, access only per company and per role, tamper-evident audit logs, sealed PDF documents and regular backups frequency to be confirmed. See also our responsible disclosure policy.
Your rights
You can ask us to access, correct or delete your data, to restrict or object to processing, or to receive your data in a portable format, and you can withdraw consent at any time. E-mail hello@advolo.org; we answer within one month. For data we process for a customer, we forward your request to that customer. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes
We update this statement when our processing changes and show the date of the latest version at the top.
Draft of 13 November 2026 · All legal documents