Privacy Policy

1. About This Privacy Policy

SPI Aviation Support Services (“SASS,” “we,” “us,” or “our”) operates CERTRA, an aviation technical-records and asset-trust platform. This Privacy Policy explains how we collect, use, share, and protect personal information when you visit the CERTRA website or microsite, request a demonstration, contact us, or otherwise interact with us as a visitor, prospect, or business contact.

This Policy governs personal information collected through our public-facing website and marketing activities. It does not govern the aviation, engine, or asset records that a customer subsequently places into the CERTRA platform — that data is addressed separately in Section 12.

2. Who We Are

CERTRA is developed and operated by SPI Aviation Support Services, providing engine MROs, lessors, OEMs, and airline operators with a trusted system of record for aviation technical documentation. References to “CERTRA” in this Policy mean the CERTRA website, microsite, and associated marketing activities, unless the context requires otherwise.

3. Information We Collect

We only collect information that serves a clearly identifiable purpose. We do not collect aviation technical-record data simply because someone visits the CERTRA website.

A. Information You Provide

• Name, business email address, and phone number
• Company, job title, and country or region
• Enquiry, demonstration, or meeting requests
• Content of your communications with us

B. Information Collected Automatically

• IP address, device, browser, and operating system information
• Pages visited, time on page, and referral source
• Cookies and similar tracking technologies (see Section 5)

C. Information From Third Parties

• Event organisers and industry associations we jointly engage with
• Business partners and marketing platforms
• Publicly available business sources (e.g., company or professional directories)

4. How We Use Your Information

We use personal information only for the purposes below, and for no purpose incompatible with them.

5. Cookies & Similar Technologies

The CERTRA website uses essential cookies (required for the site to function), analytics cookies (to understand usage), and, where applicable, marketing cookies (to measure campaign effectiveness). You can manage non-essential cookies through your browser settings or any cookie-preference tool provided on the site. Full details of the specific technologies deployed are set out in our separate Cookie Policy.

6. How We Share Information

We do not sell personal information. We share information only with:

• Service providers who support hosting, CRM, marketing automation, analytics, email delivery, and customer support, under confidentiality and data-protection obligations
• Professional advisors, where necessary for legal, audit, or compliance purposes
• Regulators or public authorities, where required by law
• A successor entity, in connection with a merger, acquisition, or sale of business assets, subject to equivalent privacy protections

7. International Data Transfers

SASS is based in India. As CERTRA serves aviation organisations across multiple jurisdictions, personal information may be stored or processed in India or by service providers located in other countries. Where information is transferred internationally, we apply appropriate contractual and organisational safeguards designed to protect it to a standard consistent with this Policy.

8. How We Protect Your Information

We apply reasonable technical and organisational safeguards appropriate to the sensitivity of the information involved, including encryption in transit, access and authentication controls, role-based permissions, security monitoring, vendor security requirements, and employee confidentiality obligations. No system is completely secure, and we continually review our safeguards as CERTRA and the threat landscape evolve.

9. Data Retention

• Enquiry and prospect information — retained while the relationship is active, and for a reasonable period afterward for legitimate business or legal purposes
• Marketing information — retained until you unsubscribe or withdraw consent, or per our standard retention schedule
• Analytics information — retained according to the configuration of the relevant analytics tool
• Information we are legally required to keep — retained for the applicable statutory period

Once information is no longer required, we securely delete or anonymise it.

10. Your Privacy Rights

Depending on your jurisdiction and applicable law (including India’s Digital Personal Data Protection Act, the EU/UK GDPR, and US state privacy laws such as California’s), you may have the right to:

• Know what personal information we hold about you and how it is used
• Access or request a copy of your information
• Correct inaccurate information
• Request deletion of your information
• Withdraw consent, where consent is the basis for processing
• Object to, or request restriction of, certain processing
• Receive your information in a portable format
• Opt out of certain marketing or, where applicable, the sale or sharing of information
• Lodge a complaint with your local data protection authority

Not every right applies to every individual or every processing activity. To exercise a right, contact us using the details in Section 16; we will respond within the time frame required by applicable law.

11. Marketing Communications

Where permitted by applicable law, we may send you information about CERTRA, product developments, events, and related SASS services. You may unsubscribe at any time using the link in any marketing message or by contacting us directly.

Unsubscribing from marketing does not affect transactional communications necessary to service an active enquiry, demo, or relationship.

12. CERTRA Platform & Customer Data

This Policy covers personal information collected through the CERTRA website and marketing activities (“Website Data”). It does not cover the information a customer places into the CERTRA platform once onboarded (“Platform Data”), which may include aircraft, engine, and component information; technical, maintenance, and LLP records; MRO documentation; lease and transaction information; and platform user-account data.

Platform Data is governed by the applicable Customer Agreement, Data Processing Agreement, and CERTRA Platform Terms — not by this Policy. For Website Data, SASS generally determines the purpose and means of processing. For Platform Data, the customer is generally the controller or data fiduciary, and SASS/CERTRA acts as a processor or service provider under the terms of the governing agreement.

This Policy does not grant SASS any ownership interest in a customer’s aviation or asset records.

13. Security Incidents

We maintain safeguards to detect and respond to suspected security incidents, including investigation, containment, and remediation measures, and we will provide notifications where required by applicable law. This section describes our commitment, not our full incident-response procedure.

14. Children’s Privacy

The CERTRA website is intended for business and professional audiences and is not directed at children. We do not knowingly collect personal information from children.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our services, technology, legal requirements, or privacy practices. We will revise the “Last Updated” date above and, for material changes, provide reasonably prominent notice on the CERTRA website.

16. Contact Us

If you have a question about this Policy or wish to exercise a privacy right, please contact: