Privacy Policy

Last updated: 2026-04-01

1. Who we are

RARE AIR (IOM) LTD (“RARE AIR”, “we”, “us”) is an aircraft buyer’s agent and aviation consultancy based in the Isle of Man. This Privacy Policy explains how we collect, use, disclose and protect personal data when you use our website at rare-air.co.uk (the “Site”) or otherwise interact with us.

Our registered address:
34 Hope Street, Third Floor,
Douglas, IM1 1AP,
Isle of Man.

For privacy enquiries: enquiries@rare-aviation.com

2. What data we collect

  • Contact form data: name, email address, and the message you submit when you use the enquiry form on the Site.
  • Authentication data (optional): when you log in via Auth0 (our identity provider), we receive and store your name, email address, profile picture URL, and the stable Auth0 subject identifier (“sub”). A local user profile is created/updated on our systems.
  • Technical / log data: IP address, user agent, timestamps, and request details (standard web server and application logs). These are used for security, debugging, and abuse prevention.
  • Staff / internal data: if you are a staff user, we may store and process additional information related to aircraft models and spec sheets (private documents) for the purpose of serving our clients.

3. How we use your data and legal basis

We use the data for the following purposes:

  • To respond to your enquiries and provide our buyer’s agent and consultancy services (legitimate interest and/or contract).
  • To authenticate users and enable secure access to staff features (consent via login + contract).
  • To operate, secure, and improve the Site (legitimate interest).
  • To comply with legal obligations.

The contact form is the primary way members of the public interact with us. By submitting the form you are providing your personal data to us so that we may respond to your enquiry.

4. Sharing and third parties

We do not sell your personal data.

We share data with trusted service providers only where necessary:

  • Auth0 – identity and single sign-on (OIDC). Auth0 processes authentication data on our behalf.
  • Brevo (Sendinblue) – transactional email delivery for contact form submissions.
  • AWS (Elastic Beanstalk, RDS Postgres, S3, CloudFront) – hosting, database, and secure file storage. All production data stores for user data and media are private to our VPC or protected by signed URLs; no public buckets expose personal data.

We may also disclose data if required by law, to protect our rights, or in connection with a business transfer.

5. Data retention

We keep personal data only for as long as necessary for the purposes described above, or to meet legal, accounting, or reporting requirements. Contact enquiry records are typically retained for the duration of the business relationship plus a reasonable period thereafter. Authentication profiles are retained while the account is active and for a period after last activity for security and audit purposes.

6. Your rights

Under the Isle of Man Data Protection Act (and equivalent standards), you have rights including: access to your personal data, rectification, erasure (in certain circumstances), restriction of processing, data portability, and the right to object to certain processing.

To exercise these rights, or to withdraw consent where consent is the legal basis, please contact us at enquiries@rare-aviation.com. We will respond in accordance with applicable law.

7. Cookies and similar technologies

The Site uses essential cookies and similar technologies for session management, CSRF protection, and (via Auth0) authentication and single sign-on across related sites in the same Auth0 tenant. These are necessary for the Site to function securely. We do not use advertising or non-essential tracking cookies at this time. You can control cookies through your browser settings; disabling essential cookies may prevent login and certain features from working.

8. Security

We implement appropriate technical and organisational measures to protect personal data. Production databases are not publicly accessible. Private media (such as aircraft specification documents) is stored in access-controlled storage and served only via time-limited, cryptographically signed URLs. Nevertheless, no system is 100% secure; please contact us if you have any concerns.

9. International transfers

Some of our service providers (Auth0, Brevo, AWS) may process data outside the Isle of Man / UK / EEA. Where this occurs we rely on appropriate safeguards (such as Standard Contractual Clauses or equivalent measures) or the necessity of the transfer for the performance of our services to you.

10. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top indicates the current version. Material changes will be highlighted on the Site or communicated to registered users where appropriate.

This policy is provided for the RARE AIR website and initial contact purposes. Specific engagements for aircraft acquisition services are governed by separate written agreements.