Legal

Privacy Policy

Last updated: 14 August 2026

This Privacy Policy explains how we collect and use personal data when you use Avia Gateway (aviagateway.com). It forms part of our Terms of Service.

1. Who is responsible for your data

The data controller is:

AeroLine by Ieva, MB
Legal entity code: 307671211
Registered address: Bitininkų g. 1C-37, LT-08310 Vilnius, Republic of Lithuania
Email: info@aviagateway.com
Telephone: +370 656 22966

We have not appointed a Data Protection Officer, as we are not required to do so. All privacy enquiries should be sent to the address above.

2. What data we collect

Data you give us

Account: username, email address, password (stored only as a cryptographic hash), and any name you choose to display.
Listings: the text, photographs, specifications, location and price you publish, together with any contact details you choose to include. Anything you put in a listing is public.
Purchases: billing name, email address, billing address and country, package purchased, amount and date. Card details are entered directly with our payment provider and are never received or stored by us.
Messages: the content of enquiries you send to other Users through the Platform.
Contact form: your name, email address, telephone number and message.

Data collected automatically

IP address, browser type and version, device and operating system, language;
Pages viewed, searches performed, referring page, date and time;
Cookies and similar technologies (Section 8).

We do not knowingly collect special categories of personal data, and you should not include such data in listings or messages.

3. Why we use your data, and on what legal basis

Purpose	Legal basis (GDPR Art. 6)
Creating and administering your account	Performance of a contract (Art. 6(1)(b))
Publishing and displaying your listings	Performance of a contract (Art. 6(1)(b))
Selling listing packages, processing payment, issuing accounting documents	Performance of a contract (Art. 6(1)(b)); legal obligation for accounting and tax records (Art. 6(1)(c))
Delivering messages between Users	Performance of a contract (Art. 6(1)(b))
Responding to enquiries sent through the contact form	Legitimate interests — answering those who contact us (Art. 6(1)(f))
Keeping the Platform secure, preventing fraud and abuse	Legitimate interests — protecting the Platform and its users (Art. 6(1)(f))
Reviewing reports of unlawful content and acting on them	Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))
Establishing, exercising or defending legal claims	Legitimate interests (Art. 6(1)(f))
Non-essential cookies and analytics	Consent (Art. 6(1)(a))

Where we rely on legitimate interests, we have weighed those interests against your rights and concluded that our processing does not override them. You may object at any time (Section 7).

4. Who receives your data

We do not sell your personal data. We share it only with:

Other Users — any information you publish in a listing or send in a message is visible to them. This is under your control.
Stripe — our payment service provider, which processes card payments as an independent controller under its own privacy policy (stripe.com/privacy).
Our hosting provider — which stores the Platform and its database on servers located in the European Union, acting as our processor.
Professional advisers, auditors and authorities — where required by law or to establish or defend legal claims.

Processors act only on our documented instructions and under written data processing agreements.

5. Transfers outside the European Economic Area

Our servers are located within the European Union. Some providers, including Stripe, may process data outside the EEA. Where that happens, the transfer is protected by an adequacy decision of the European Commission or by Standard Contractual Clauses together with appropriate supplementary safeguards. You may request a copy of the relevant safeguards from us.

6. How long we keep your data

Account data — while your account exists, and for 12 months after you close it, so that we can deal with any question or claim that arises;
Listings — for the validity period of the listing, and up to 12 months thereafter in our backups and records;
Purchase and accounting records — 10 years, as required by Lithuanian accounting and tax law;
Messages between Users — while the account exists, and 12 months thereafter;
Contact form enquiries — 12 months from the last correspondence;
Server and security logs — up to 12 months;
Reports of unlawful content and our decisions — 2 years, so that we can demonstrate how a report was handled.

Where a longer period is required by law or necessary for a pending claim, we keep the data until that need ends.

7. Your rights

Under the General Data Protection Regulation you have the right to:

Access your personal data and receive a copy;
Rectify inaccurate or incomplete data;
Erase your data (“right to be forgotten”), where the conditions are met;
Restrict processing in certain circumstances;
Object to processing based on legitimate interests, and to direct marketing at any time;
Data portability — receive data you provided in a structured, commonly used, machine-readable format;
Withdraw consent at any time, without affecting processing carried out before withdrawal;
Not be subject to decisions based solely on automated processing producing legal or similarly significant effects. We do not carry out such decision-making.

To exercise any right, write to info@aviagateway.com. We will respond within one month; where a request is complex we may extend this by two further months and will tell you why. We may ask you to confirm your identity before acting.

Please note that erasing your account does not remove information you have already disclosed directly to other Users, and we may retain records we are legally required to keep.

8. Cookies

We use:

Strictly necessary cookies — for sign-in, sessions, the shopping basket, checkout and security. These are required for the Platform to work and are used without consent;
Functional cookies — to remember preferences such as language or display settings;
Payment cookies — set by Stripe for fraud prevention during checkout;
Analytics cookies — if and when introduced, only with your consent.

You can delete or block cookies in your browser settings, but strictly necessary cookies cannot be disabled without the Platform ceasing to function correctly.

9. Security

The Platform is served over encrypted HTTPS connections. Passwords are stored only as cryptographic hashes and are never visible to us. Access to the database and the server is limited to authorised persons. Card data never reaches our systems.

No system can be guaranteed absolutely secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the supervisory authority as required by law.

10. Children

The Platform is intended for persons aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Complaints

If you believe we have handled your personal data unlawfully, please contact us first at info@aviagateway.com — we would prefer to resolve the matter directly.

You also have the right to lodge a complaint with the Lithuanian supervisory authority:

Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate)
L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania
vdai.lrv.lt — ada@ada.lt

If you reside in another EU country, you may also complain to the supervisory authority there.

12. Changes to this Policy

We may update this Privacy Policy. The current version is always published here with its date. Where a change materially affects how we use your data, we will announce it on the Platform in advance.

13. Contact

For any question about this Policy or about how we handle your data, write to info@aviagateway.com.