Privacy Policy

01About This Policy

CPA Aviations India Private Limited ("CPA Aviations", "we", "us" or "our") is a company incorporated in India, with its corporate office at 2A, Pvt No. 2A/8A, Third Floor, Municipal No. 63, Rama Road, Najafgarh Road Industrial Area, New Delhi 110015, India. We respect your privacy and are committed to protecting the personal data you share with us.

This Privacy Policy explains what personal data we collect through our website https://cpaaviations.com (the "Website"), why we collect it, how we use, share and protect it, and the choices and rights available to you. It has been prepared in line with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 and the rules made under it (together, "Applicable Data Protection Law").

For personal data collected through the Website, CPA Aviations is the Data Fiduciary and you are the Data Principal, as those terms are used in the Digital Personal Data Protection Act, 2023.

By using the Website or sharing your details with us, you acknowledge that you have read this Policy. Where we rely on your consent, we ask for it clearly and separately, for example through the consent checkbox on our contact form.

02Who This Policy Applies To

This Policy applies to:

• visitors to the Website, including our service pages, blog and the digital visiting card pages of our team;
• people who contact us through the Website contact form, by email at info@cpaaviations.com or by phone; and
• representatives of airports, airlines, charter operators, government bodies, suppliers and other organisations who engage with us about our services.

This Policy does not apply to third-party websites and services linked from or embedded in the Website, such as Google Maps and our pages on Instagram, Facebook, LinkedIn and X. Those services are governed by their own privacy policies. Where we process personal data under a signed agreement with a client, the terms of that agreement will also apply.

03Personal Data We Collect

3.1 Information you give us

• Contact form: your full name, phone number, email address, the content of your message and a record of your consent.
• Email and phone enquiries: your name, contact details, organisation, designation and any information or documents you choose to share, such as project requirements, tender or RFQ documents, aircraft or equipment details, technical specifications or a CV.
• Blog comments: if you comment on a blog post, your name, email address, website (if you provide one) and your comment.
• Email updates: if we offer email updates and you sign up for them, your email address.
• Business relationships: if you represent a client, vendor or partner, your business contact details and the information needed to prepare quotations, perform agreements, process payments and meet regulatory requirements.

3.2 Information collected automatically

When you visit the Website, our web server and hosting provider automatically record technical information such as your IP address, browser type and version, device and operating system, the pages you visit, the date and time of your visit and the page that referred you. When you leave a blog comment, your IP address and browser details are stored with the comment to help detect spam. We use this information to deliver the Website, keep it secure and fix technical problems.

At the time this Policy was last updated, the Website does not use analytics, advertising or tracking tools. If we introduce them, we will update this Policy and ask for your consent where the law requires it.

3.3 Information processed while delivering our services

When we provide aviation support services such as charter coordination, passenger facilitation, crew coordination, ground handling, customs clearance or import and export handling, we may need to process personal data of passengers, crew and other individuals, such as names, identity and travel documents and flight details. We use this information only to obtain the necessary approvals, meet aviation security and regulatory requirements and deliver the service. This information is usually provided by our client and is handled in line with the relevant agreement, applicable regulations and this Policy.

3.4 Information we do not ask for through the Website

Please do not send us sensitive information through the contact form, email enquiries or blog comments, such as passwords, bank account, credit card or debit card details, health or medical information, biometric data or government identity numbers such as Aadhaar or PAN. If a specific service requires such information, we will request it through an appropriate secure channel and only to the extent necessary.

04How We Use Personal Data

We use personal data to:

• respond to your enquiry and contact you about it by phone or email;
• understand your requirements and prepare proposals, quotations and tender responses;
• deliver, manage and support the services we have agreed to provide, including coordination with airport operators, authorities and partners;
• manage relationships with clients, vendors and partners, including invoicing, payments and record keeping;
• publish and moderate blog comments;
• send you updates about our services, only if you have agreed to receive them;
• operate, maintain and secure the Website and prevent spam, fraud and misuse;
• comply with legal, regulatory, tax, customs and aviation security obligations and respond to lawful requests from authorities; and
• establish, exercise or defend legal claims.

We will not use your personal data for a purpose unrelated to the one for which it was collected without informing you and, where required, obtaining your consent.

05Basis for Processing

• Consent: when you submit the contact form and tick the consent box, sign up for email updates or leave a blog comment, we process your personal data based on your consent. You can withdraw your consent at any time, as explained in Section 10. Withdrawal does not affect processing carried out before it.
• Legitimate uses recognised by law: we may also process personal data without separate consent where the law allows it, for example where you voluntarily share your details for a specific purpose (such as emailing us or handing over a business card) and have not told us you object to their use for that purpose, or where processing is needed to comply with law, a court order or a regulatory requirement.

06Cookies and Third-Party Services

Cookies are small text files stored on your device when you visit a website. The Website uses only a small number of cookies and third-party services:

You can block or delete cookies through your browser settings. If you do, some features, such as the embedded map, may not work as intended.

07How We Share Personal Data

We do not sell, rent or trade your personal data. We share it only where needed, with:

• Our parent company: C P Arora Private Limited, where needed for joint projects, shared administration or group business decisions, subject to confidentiality and this Policy.
• Service providers working for us: such as website hosting, email, IT support and website maintenance providers, and professional advisers such as auditors, lawyers and consultants, all of whom are bound by confidentiality.
• Aviation and project stakeholders: where needed to deliver a service you or your organisation requested, such as airport operators, airlines, charter operators, maintenance organisations, equipment manufacturers, suppliers, and logistics and customs partners.
• Government and regulatory authorities: such as the Directorate General of Civil Aviation (DGCA), the Bureau of Civil Aviation Security (BCAS), the Airports Authority of India (AAI), customs authorities and law enforcement agencies, where required by law or needed to obtain approvals for a service.
• Others, for legal and protective reasons: to comply with law, court orders or lawful requests, to enforce our Terms & Conditions, or to protect the rights, property or safety of CPA Aviations, our clients or others.
• A successor business: in connection with a merger, acquisition, restructuring or sale of assets, subject to confidentiality and this Policy.

Whenever we share personal data, we require the recipient to protect it and use it only for the purpose for which it was shared.

08Transfers Outside India

Some of our service providers, such as email and hosting providers, and partners involved in international projects may store or process personal data outside India. We transfer personal data outside India only in line with Applicable Data Protection Law, and not to any country or territory to which such transfers are restricted by the Government of India.

09How Long We Keep Personal Data

We keep personal data only for as long as needed for the purpose for which it was collected, or for longer where the law requires it:

• Enquiries that do not lead to an engagement: up to 24 months from our last communication with you.
• Client, vendor and contract records: for the duration of the relationship and afterwards for the periods required by applicable tax, company, customs and aviation record-keeping laws. Accounting records, for example, are generally kept for at least eight years.
• Blog comments: until the comment is removed by us or at your request.
• Server and security logs: for a limited period, and for at least any minimum period prescribed by law.

When personal data is no longer needed, we delete it securely or anonymise it.

10Your Rights

Subject to Applicable Data Protection Law, you have the following rights:

To exercise any of these rights, email us at info@cpaaviations.com with the subject line "Privacy Request". We may need to verify your identity before acting on your request. We will respond within the period required by law, and in any case within 30 days.

If you are not satisfied with how we handle your request or grievance, you may file a complaint with the Data Protection Board of India in accordance with the law.

When exercising your rights, you are expected to provide accurate information, not impersonate anyone and not file false or frivolous complaints.

11How We Protect Personal Data

We follow reasonable security practices and procedures to protect personal data against unauthorised access, use, alteration, disclosure and loss. These include encrypted (HTTPS) connections to the Website, access limited to authorised personnel who need it for their work, secure hosting, regular software updates and confidentiality obligations for our staff and service providers.

No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security. Please do not send confidential or sensitive information through the contact form or blog comments. If a personal data breach occurs, we will inform affected individuals and the Data Protection Board of India as required by law.

12Updates and Marketing Communications

We do not send promotional emails or messages without your consent. Every update we send will include a way to unsubscribe, and you can also opt out at any time by writing to info@cpaaviations.com. Even if you opt out, we may still contact you about an ongoing enquiry or engagement.

13Children

The Website is intended for businesses and professionals and is not directed at children. We do not knowingly collect personal data of anyone under 18 years of age. If you believe a child has shared personal data with us, please contact us and we will delete it.

14Links to Other Websites

The Website contains links to third-party websites and platforms. We are not responsible for the privacy practices or content of those websites, and we encourage you to read their privacy policies.

15Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Website or the law. The updated version will be posted on this page with a revised "Last updated" date. If we make significant changes, we will take reasonable steps to inform you, such as by placing a notice on the Website.

16Grievance Officer and Contact Details

If you have any questions, requests or complaints about this Policy or how we handle your personal data, please contact our Grievance Officer:

We will acknowledge your grievance within 24 hours of receipt and aim to resolve it within 15 days.