Privacy Policy

AviaInventory is an online marketplace for aircraft parts operated by Upgear Aviation Limited, a company registered in Kenya with its office at Fairbank Arcade, Suite 3-204, Mai Mahiu Road, off Langata Road, Next to Wilson Airport, Nairobi, Kenya ("we", "us", "our").

For the personal data described in this policy we are the data controller under the Data Protection Act, 2019 (the "Act") and the Data Protection (General) Regulations, 2021. We are registered, or will register, with the Office of the Data Protection Commissioner (ODPC) as required by the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.

This policy applies to buyers, suppliers and visitors who use AviaInventory, including the people who act for a company account (for example procurement, sales, quality and finance staff). AviaInventory is a business-to-business service and is not intended for anyone under 18. We do not knowingly collect personal data about children.

Information you give us

• Account details: name, business email, phone number, country, job title and password. Passwords are stored only in hashed form and nobody at AviaInventory can read them.
• Company details: company name, organisation type, registration number, address, city, website, and buying or selling preferences.
• Verification and compliance documents: certificates of incorporation, approvals (for example KCAA, EASA or FAA approvals) and part certification documents such as FAA 8130-3 or EASA Form 1. These can contain the names and signatures of individuals.
• Marketplace activity: listings, requests for quotation (RFQs), quotations, orders, shipments, invoices, messages and reviews.
• Billing records: plan, billing period, payment status, invoices and receipts. Card and M-Pesa details are collected directly by our payment provider, Paystack, and are never stored by us. We receive only the payment reference, amount and status.
• Communications: messages you send to our support team.

Information collected automatically

• IP address, browser and device type, pages visited, and the date and time of access, held in our hosting provider's security logs.
• The cookies and browser storage described in our Cookie Policy.

We do not intentionally collect sensitive personal data as defined in the Act (for example health, ethnic or biometric data). Please do not include it in documents or messages.

Section 30 of the Act requires a lawful basis for each use of personal data. We rely on the following:

• To perform our contract with you: creating and securing your account, showing your listings and company profile, passing RFQs, quotations and orders between buyers and suppliers, and providing your subscription.
• To comply with the law: keeping financial and tax records, responding to lawful requests from authorities, and anti-fraud and anti-money-laundering checks.
• For our legitimate interests: verifying suppliers and certification documents to keep the marketplace safe, preventing misuse, securing the platform, and improving our service. We balance these interests against your rights.
• With your consent: product news and marketing messages. You can withdraw consent at any time, without affecting anything done before.

We contact you by email and, if you give us a WhatsApp number, through the WhatsApp Business Platform from +254 183 210970.

• Service messages (part of providing the marketplace, so no separate consent is needed): account confirmation and password reset (from no-reply@aviainventory.com), new RFQ alerts, quotation notifications, order and shipment updates, and billing receipts.
• Promotions (marketplace news, offers and featured-supplier campaigns from sales@aviainventory.com or WhatsApp): sent only if you opt in, as section 37 of the Act requires for commercial use of personal data. You can opt out at any time by replying STOP on WhatsApp, using the unsubscribe link in any email, or changing your notification settings.

WhatsApp messages are delivered by Meta Platforms, which processes your phone number and message content under its own terms and privacy policy.

We do not sell personal data. We share it only where needed:

• Other marketplace users: your company profile, listings and verification status are public. Your contact details are shared with a buyer or supplier only as needed for an RFQ, quotation or order you take part in.
• Service providers acting as our data processors, under written contracts that require them to protect your data: hosting and database (Vercel, Supabase), payments (Paystack, for card and M-Pesa), WhatsApp messages (Meta Platforms, through the WhatsApp Business Platform), and our email delivery provider.
• Professional advisers such as auditors and lawyers, under duties of confidentiality.
• Authorities such as the Kenya Revenue Authority, the Kenya Civil Aviation Authority or law enforcement, where the law requires it.
• A buyer or successor if our business is sold or reorganised, under the same protections.

Some of our service providers store or process data outside Kenya (for example in the European Union or the United States). Where this happens we transfer data only as permitted by Part VI of the Act, relying on appropriate safeguards such as contractual data protection terms, and only to providers that keep the data secure.

• Account and company data: while your account is active, then deleted or anonymised within 12 months of closure, unless we need it for an open dispute.
• Transaction, billing and tax records: at least five years, as required by the Tax Procedures Act, 2015.
• Verification and certification documents: for as long as the related supplier account or listing is active and for any period required for traceability, then deleted.
• Security logs: for a limited period set by our hosting provider, usually a few weeks.

Under section 26 and Part IV of the Act you have the right to:

• be informed of how your personal data is used (this policy);
• access the personal data we hold about you;
• object to processing of all or part of your data;
• have false or misleading data corrected;
• have false, misleading or unlawfully held data deleted;
• receive your data in a portable format; and
• withdraw consent where we rely on it, including for marketing.

To use any of these rights, email info@aviainventory.com. We may ask you to confirm your identity, and we will respond within the time limits set by the Data Protection (General) Regulations, 2021. You can also update most account details yourself from your account settings.

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

Data is encrypted in transit. Access to each account's data is restricted by database security rules, and verification documents are kept in private storage that only the owning supplier and authorised AviaInventory staff can open. Passwords are hashed and never stored in plain text.

If a personal data breach is likely to put your rights at risk, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it and inform affected users without undue delay, as section 43 of the Act requires. No system is perfectly secure, so please use a strong, unique password and keep it private.

We use only essential cookies and browser storage, needed to keep you signed in and to save unfinished forms. See our Cookie Policy for the full list.

We may update this policy, for example when we add new features or the law changes. We will publish the new version on this page and tell account holders about significant changes by email or in the app. Privacy questions and requests: info@aviainventory.com, +254 183 210970, or write to Upgear Aviation Limited, Fairbank Arcade, Suite 3-204, Mai Mahiu Road, off Langata Road, Next to Wilson Airport, Nairobi, Kenya.