Privacy Notice
Version 2026-07-05.draft-1. Draft, pending external counsel validation.
Who we are & data residency
Aero RFP operates an invitation-only auction venue. All personal data and the compliance audit trail are hosted on infrastructure located in the European Union (Frankfurt, Germany).
Lawful basis
We process personal data on the basis of contract necessity (operating your bidder account and the auction) and our legitimate interest in running a compliant, fraud-resistant marketplace.
What we collect
Identity and organization details you provide at signup and KYC, and technical data required to secure the service. For essential-cookie consent we store a timestamp, the policy version, and a one-way hash of your IP address, never the raw IP address.
Cookies
We use only essential first-party cookies necessary to run the platform. There are no marketing cookies, no analytics, and no third-party trackers.
Retention
Personal data is retained while your account is qualified and then in line with our retention schedule; audit-log entries are retained for ten years and are pseudonymized (not deleted) on erasure so the tamper-evident record survives.
Your rights
You may request access, rectification, portability, and erasure. These requests are handled by an administrator (there is no self-service portal) and actioned within 30 days.
Sub-processors
We rely on a small set of sub-processors (our cloud database/host provider, our static hosting provider, and our transactional email provider), each under a data-processing agreement (DPA).