Privacy Policy

1. Controller

The controller of personal data described in this policy is ZOLORET TRADING LIMITED, trading as Zoloret Trading, registration number HE 102412, registered office Stavrou 56, KARYATIS CENTRE, BLOCK A, Floor 1, Office 104, 2035 Nicosia, Cyprus.

For any question or request about your personal data, contact us at info@zolorettrading.com or +357 99 468713.

2. How the enquiry form works

The enquiry form on this website does not submit your entries to a website backend or persist them in browser storage. When you press "Prepare email request", your own email application opens with a pre-filled message to info@zolorettrading.com. We receive your details only if you choose to send that email. From then on, your email is handled as ordinary business correspondence as described below.

3. Personal data we process

Enquiries and correspondence

Your name, company, job role, email address, telephone number if you give it, and the content of your message (for example part numbers, quantities, aircraft type or scope of work).

Business relationships

Contact details of people representing customers, suppliers, repair organisations, forwarders and other business partners; quotations, orders, shipping and customs records, invoices and related correspondence; and, where an order requires it, information needed for export-control and sanctions compliance (for example end-user and end-use statements naming individuals).

Technical data

When you visit the website, the hosting infrastructure processes technical data such as your IP address, browser type, requested pages and time of request, which is needed to deliver the website and protect it from misuse.

Providing personal data is voluntary. However, without the contact details and, for an order, the order information we need, we may be unable to respond to your enquiry or fulfil the order. We ask only for what we need to handle the enquiry or business matter. Please do not send special categories of personal data (such as health information).

4. Purposes and legal bases

• Enquiries from individuals acting for themselves: taking steps at your request before entering into a contract (GDPR Art. 6(1)(b)).
• Enquiries and dealings with people who represent a company: our legitimate interest in communicating and doing business with that company (Art. 6(1)(f)). The contract is with the company, not with the individual representative.
• Performing a contract: Art. 6(1)(b) where you are yourself the contracting party; otherwise legitimate interest as above.
• Accounting, tax, customs and export-control records: compliance with legal obligations (Art. 6(1)(c)), and our legitimate interest in managing compliance risk where no specific obligation applies (Art. 6(1)(f)).
• Establishing, exercising or defending legal claims: legitimate interest (Art. 6(1)(f)).
• Operating and securing the website: legitimate interest (Art. 6(1)(f)).

Processing on this basis is permitted only where our legitimate interests are not overridden by your interests and fundamental rights. You may object at any time (see section 11).

5. Recipients

We share personal data only where needed for the purposes above, with:

• website platform and hosting providers. The website is built and operated using the Lovable platform, provided according to its published terms by Lovable Labs Incorporated, together with the hosting and content-delivery providers it uses;
• email and IT service providers that host our mailbox and business systems;
• business counterparties such as manufacturers, suppliers, approved repair organisations, freight forwarders, carriers and customs brokers, where needed to answer a request or fulfil an order;
• banks, payment providers and professional advisers such as accountants, auditors and lawyers;
• public authorities, including tax, customs and export-licensing authorities, where required by law.

Service providers process personal data on our behalf under our instructions where they act as our processors. Some providers, including platform and network providers, may also process limited technical data for their own purposes, such as securing their networks, under their own privacy terms. Business counterparties and authorities process data they receive as separate controllers.

6. International transfers

Some recipients, including platform, hosting or email providers and business partners involved in an international shipment, may be located or process data outside the European Economic Area. Where personal data is transferred outside the EEA, the transfer must be covered by a protection recognised by the GDPR, such as an adequacy decision, Standard Contractual Clauses or another appropriate safeguard, or by a derogation where one applies, for example where a transfer is necessary to perform a contract you have asked us to arrange. You can ask us at info@zolorettrading.com for information about the safeguard used for a particular transfer and how to obtain a copy.

For the website platform, Lovable Labs Incorporated processes personal data on our behalf under its Data Processing Agreement, which applies to our plan and incorporates the EU Standard Contractual Clauses for applicable transfers of personal data outside the EEA in its role as our processor. Lovable may also handle certain service and log data as an independent controller under its own privacy terms; that handling is not covered by the agreement with us.

7. How long we keep data

We keep personal data only for as long as it is needed for the purpose it was collected for, taking into account legal retention obligations, limitation periods for possible claims, and whether there is a continuing business relationship.

• Enquiries that do not lead to an order: kept while needed to deal with the request and any follow-up. We review them at least once a year and delete or anonymise them when there is no continuing purpose, and in any event no later than 24 months after the last meaningful contact, unless they are needed for a legal obligation or a claim.
• Contacts at customers, suppliers and partners: kept for the duration of the business relationship and afterwards only as long as needed for the obligations and records connected with it.
• Quotations, orders, invoices, shipping, customs and export records: kept for the periods required by applicable accounting, tax, customs and export-control law, and longer where needed while a claim is outstanding or may still be brought.
• Technical and security records: kept only as long as proportionate for operating and securing the service. Their periods are set by the relevant hosting or service provider.

Where data is needed for an actual or reasonably expected legal claim, investigation or request from an authority, we may keep it until that matter is concluded.

8. Marketing

We do not use information sent through the enquiry form or in an enquiry email to send unsolicited marketing. If we introduce marketing communications in future, we will do so only on a lawful basis, with a simple way to opt out, and will update this policy.

9. Automated decisions

This website does not make solely automated decisions that produce legal or similarly significant effects on you.

10. Security

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, taking into account the nature of the data and the risks involved. Email sent over the internet is not fully secure; please avoid sending sensitive information unless necessary.

11. Your rights

Subject to the conditions set by the GDPR, you have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected;
• have data erased, or its processing restricted, in certain cases;
• object to processing based on legitimate interests;
• receive data you provided in a portable format, where processing is based on consent or contract, is carried out by automated means, and the other GDPR conditions apply;
• withdraw consent at any time, where processing is based on consent.

To exercise a right, email info@zolorettrading.com. We may need to confirm your identity. We will respond within one month, which may be extended by up to two further months where the GDPR allows, in which case we will tell you why.

12. Complaints

You can complain to the Office of the Commissioner for Personal Data Protection, Cyprus (dataprotection.gov.cy), or to the supervisory authority where you live or work. We would welcome the chance to address your concern first.

13. Cookies and changes

See our Cookies Policy. We may update this policy; the version and date at the top of this page show when.