Legal
Privacy Policy
How SpoolUp collects, uses, stores and protects personal information.
Introduction
This Privacy Policy explains how SpoolUp collects, uses, stores, shares and protects personal information when you use our website, marketplace, account areas, contact forms, enquiry tools, listing services and related communications.
SpoolUp is committed to handling personal information lawfully, fairly and transparently. This policy explains what information we collect, why we collect it, the lawful basis we rely on, how long we keep it, who we may share it with and the rights you have in relation to your personal information.
Who we are
For the purposes of data protection law, the controller of your personal information is:
[Insert legal company name]
Trading as: SpoolUp
Registered address: [Insert registered address]
Company number: [Insert company number, if applicable]
Email: hello@spoolup.aero
References in this policy to “SpoolUp”, “we”, “us” or “our” mean the organisation responsible for operating the SpoolUp website, marketplace and related services.
Scope of this policy
This policy applies to personal information collected through:
- The SpoolUp website
- Marketplace listings and enquiry forms
- Customer, partner, operator and shop account areas
- APU listing, valuation, RFQ and enquiry workflows
- Contact forms and support requests
- Email, telephone and other business communications
- Analytics, security and website performance tools
- Any other SpoolUp service that links to this Privacy Policy
This policy does not apply to external websites or third-party services that we do not control. If you follow a link to another website, you should read that organisation’s privacy policy.
Information we collect
The personal information we collect depends on how you use SpoolUp. We may collect the following categories of information.
Identity and contact information
- Your name
- Email address
- Telephone number
- Job title or role
- Company name
- Business address
- Country or region
Account information
- Login details and account identifiers
- Account status
- Customer, partner, operator or shop profile details
- Permissions, access roles and user preferences
- Records of account activity
Marketplace and enquiry information
- Messages submitted through contact, RFQ or seller enquiry forms
- Listing interests and enquiries
- Asset-related enquiry details
- Information linked to APU listings, availability, workscope or documentation requests
- Buyer, seller, partner or customer relationship details
Business and transaction information
- Records of enquiries, quotes, proposals or service requests
- Commercial communications
- Information needed to manage customer, partner or marketplace relationships
- Records of support, onboarding or operational activity
Technical and usage information
- IP address
- Browser type and version
- Device type
- Operating system
- Pages visited
- Referring website or source
- Approximate location based on technical data
- Session information
- Cookie and consent preferences
- Security logs and error logs
Communication information
- Emails, messages or forms you send to us
- Support requests
- Feedback, complaints or queries
- Records of our responses
Marketing information
- Marketing preferences
- Email subscription status
- Records of whether you have opened or interacted with marketing emails, where tracking is enabled
- Preferences about receiving updates, insights or service communications
Special category information
We do not intentionally collect special category personal information through the SpoolUp website or marketplace. Special category information includes details about health, ethnicity, religion, political opinions, trade union membership, genetics, biometrics, sex life or sexual orientation.
Please do not provide special category information through our website forms, marketplace messages or general communications unless we specifically ask for it and explain why it is needed.
If you voluntarily provide special category information, we will only use it where necessary and where we have a lawful basis and, where required, an additional condition under data protection law.
How we collect information
We may collect personal information in the following ways:
- Directly from you when you complete forms, create an account, submit an enquiry or contact us
- From your employer or organisation where they create or manage access for you
- From customers, partners, operators, shops or marketplace participants involved in an enquiry or transaction
- Automatically through cookies, server logs, security tools and analytics technologies
- From publicly available business sources, where relevant to our services
- From third-party service providers where necessary to operate, secure or improve our services
How we use personal information
We use personal information for the following purposes.
To provide and operate our services
We use personal information to operate the SpoolUp website, marketplace, account areas, listings, enquiry tools, partner services and related workflows.
This may include creating and managing accounts, enabling users to submit enquiries, connecting marketplace participants, managing APU listing information, responding to requests and providing access to relevant platform features.
To manage enquiries and communications
When you submit a contact form, RFQ, seller enquiry or support request, we use the information provided to respond, route the request to the appropriate recipient, keep a record of the communication and follow up where necessary.
To manage customer, partner and marketplace relationships
We use personal information to maintain business records, manage customer and partner relationships, support listing activity, monitor account access and provide operational support.
To protect the website and prevent misuse
We use technical and security information to protect our website, detect misuse, prevent spam, investigate suspicious activity, maintain logs and keep our systems secure.
To improve our website and services
We may use website usage data, analytics, feedback and operational information to understand how the website is used, identify issues, improve user experience and develop our services.
To send service communications
We may send service-related communications, such as account updates, enquiry confirmations, security notices, operational updates, legal document updates, marketplace notifications or changes to our services.
Service communications are not marketing messages and may be sent where necessary to provide or manage our services.
To send marketing communications
Where permitted by law, we may send marketing communications about SpoolUp services, marketplace updates, insights, events or relevant business information.
You can opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us.
To meet legal and regulatory obligations
We may use personal information where necessary to comply with legal obligations, maintain appropriate records, respond to lawful requests, protect legal rights or support regulatory, tax, accounting or compliance requirements.
Lawful bases for using personal information
Under data protection law, we must have a lawful basis for using personal information. The lawful basis we rely on depends on the purpose of the processing.
| Purpose | Examples | Lawful basis |
|---|---|---|
| Providing services and account access | Creating accounts, managing access, operating marketplace tools and responding to service requests | Contract, legitimate interests |
| Managing enquiries | Responding to contact forms, RFQs, seller enquiries and support messages | Contract, legitimate interests |
| Marketplace communications | Routing enquiries between buyers, sellers, partners or relevant service participants | Contract, legitimate interests |
| Security and fraud prevention | Protecting systems, preventing misuse, managing logs and investigating suspicious activity | Legitimate interests, legal obligation |
| Website analytics and improvement | Understanding usage, improving pages, fixing issues and measuring performance | Consent where required, legitimate interests where appropriate |
| Service communications | Account notices, enquiry confirmations, legal updates and operational messages | Contract, legitimate interests, legal obligation |
| Marketing communications | Sending updates, insights, newsletters or promotional messages | Consent or legitimate interests, depending on the situation |
| Legal, accounting and compliance records | Keeping business records, responding to legal claims or complying with regulatory obligations | Legal obligation, legitimate interests |
Legitimate interests
Where we rely on legitimate interests, we only do so where we consider that our interests are not overridden by your rights, freedoms or interests.
Our legitimate interests may include:
- Operating and improving the SpoolUp website and marketplace
- Responding to enquiries and service requests
- Maintaining business relationships with customers, partners, operators and shops
- Supporting marketplace communication between relevant parties
- Keeping appropriate business and operational records
- Preventing fraud, spam, misuse and unauthorised access
- Protecting our legal rights and business interests
- Understanding how users interact with our website and services
When we use consent
Where we rely on consent, you can withdraw your consent at any time. This may apply to certain cookies, analytics tools, marketing communications or optional features.
Withdrawing consent will not affect the lawfulness of any processing carried out before consent was withdrawn.
Marketing communications
We may send marketing communications where you have consented to receive them or where we are otherwise permitted to do so by law.
Marketing communications may include information about SpoolUp services, marketplace updates, aviation industry insights, events, platform news or related content.
You can opt out of marketing emails at any time by clicking the unsubscribe link in the email or by contacting us at hello@spoolup.aero.
We may still send service communications where these are necessary to manage your account, provide our services, respond to enquiries, notify you about legal updates or protect the platform.
Cookies and similar technologies
We use cookies and similar technologies to support website functionality, security, performance, analytics and user preferences.
Some cookies are essential for the website to work properly. Other cookies, such as analytics or marketing cookies, may only be used where appropriate consent has been given.
For more information, please read our Cookie Policy.
Who we share personal information with
We may share personal information with the following categories of recipients where necessary.
Customers, partners, sellers and marketplace participants
Where you submit a marketplace enquiry, RFQ, contact seller message or related request, we may share relevant details with the appropriate recipient so they can respond to your enquiry.
This may include your name, company, email address, enquiry details and information linked to the relevant listing or asset.
Service providers
We may use trusted service providers to help operate our website, marketplace and business systems. These may include providers of:
- Website hosting
- Email delivery
- Customer relationship management
- Analytics and performance monitoring
- Security and spam prevention
- Cloud storage and infrastructure
- Professional support and maintenance
Professional advisers
We may share information with lawyers, accountants, auditors, insurers, consultants or other professional advisers where necessary for business, legal, insurance or compliance purposes.
Authorities and legal recipients
We may share information with regulators, law enforcement bodies, courts, public authorities or other third parties where required by law or where necessary to protect our rights, users, systems or business interests.
Business transfers
If SpoolUp is involved in a business sale, merger, restructuring, investment process or asset transfer, personal information may be shared with relevant parties as part of that process, subject to appropriate confidentiality and legal protections.
International transfers
Some service providers may process personal information outside the United Kingdom or the European Economic Area.
Where personal information is transferred internationally, we will take steps designed to ensure that appropriate safeguards are in place. These may include using providers located in countries with adequacy arrangements, approved contractual terms, international data transfer agreements or other lawful transfer mechanisms.
How long we keep personal information
We keep personal information only for as long as reasonably necessary for the purposes described in this policy, unless a longer retention period is required or permitted by law.
Retention periods may vary depending on the type of information, the purpose for which it is used and any legal, accounting, tax, contractual or operational requirements.
| Type of information | Typical retention approach |
|---|---|
| Account information | Kept while the account is active and for a reasonable period afterwards for operational, legal and record-keeping purposes. |
| Enquiry and marketplace communications | Kept for as long as needed to manage the enquiry, support related transactions and maintain business records. |
| Customer and partner relationship records | Kept while the relationship is active and for a reasonable period afterwards for business, legal and compliance purposes. |
| Marketing records | Kept until you unsubscribe or object, and then retained only as needed to maintain suppression records. |
| Security logs and technical data | Kept for a limited period needed for security, diagnostics, fraud prevention and system administration. |
| Legal and compliance records | Kept for the period required to comply with legal, tax, accounting, contractual or regulatory obligations. |
When personal information is no longer needed, we will delete it, anonymise it or securely archive it.
How we protect personal information
We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
These measures may include:
- Access controls and account permissions
- Password-protected systems
- Secure hosting and infrastructure controls
- Encryption where appropriate
- Security monitoring and logging
- Backups and recovery processes
- Staff or administrator access restrictions
- Regular review of security and operational processes
No system can be guaranteed to be completely secure. You should keep your account details confidential and notify us promptly if you suspect unauthorised access to your account.
Your rights
Depending on the circumstances, you may have the following rights under data protection law:
- Right of access: to request a copy of the personal information we hold about you.
- Right to rectification: to ask us to correct inaccurate or incomplete information.
- Right to erasure: to ask us to delete personal information in certain circumstances.
- Right to restrict processing: to ask us to restrict how we use your information in certain circumstances.
- Right to object: to object to processing based on legitimate interests or direct marketing.
- Right to data portability: to receive certain information in a structured, commonly used and machine-readable format.
- Right to withdraw consent: where we rely on consent, you may withdraw it at any time.
- Right to complain: to complain to a data protection supervisory authority.
These rights are not absolute and may not apply in every situation. We may need to verify your identity before responding to a request.
How to exercise your rights
To exercise your rights, please contact us using the details below:
Email: hello@spoolup.aero
Subject line: Data Protection Request
Please include enough information for us to identify you and understand your request. We will respond in accordance with applicable data protection law.
Complaints
If you are unhappy with how we handle your personal information, please contact us first so we can try to resolve the issue.
You also have the right to complain to the UK Information Commissioner’s Office, which is the UK supervisory authority for data protection matters.
Information Commissioner’s Office
Website: https://ico.org.uk/
Telephone: 0303 123 1113
Automated decision-making
We do not currently use personal information for solely automated decisions that produce legal or similarly significant effects on individuals.
If this changes, we will update this Privacy Policy and provide any additional information required by law.
Children’s privacy
SpoolUp is intended for business users and is not directed at children. We do not knowingly collect personal information from children.
If you believe a child has provided personal information to us, please contact us so we can take appropriate action.
Third-party links
Our website may contain links to third-party websites, platforms or services. We are not responsible for the privacy practices, content or security of those third parties.
You should read the privacy policy of any third-party website or service before providing personal information to them.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, legal requirements, technologies or business operations.
The latest version will be published on this page. Where appropriate, we may also notify users by email, account notice or another suitable method.
Contact us
If you have any questions about this Privacy Policy or how SpoolUp handles personal information, please contact us:
[Insert legal company name]
Trading as: SpoolUp
Email: hello@spoolup.aero
Address: [Insert registered address]
