Legal Information
Last updated: Monday, October 5, 2026

Privacy Policy

This page explains what data Rotate collects, why it is collected, how long it is kept, and how you can exercise your rights, in accordance with the General Data Protection Regulation (GDPR).

ROTATE (hereinafter "ROTATE," the "Company," or "we") places great importance on protecting the personal data of its clients, prospects, and website users. This privacy policy (hereinafter the "Policy") is intended to inform you, in accordance with Regulation (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data (the "GDPR") and the amended Act No. 78-17 of January 6, 1978, on information technology, data files, and civil liberties (the "French Data Protection Act"), about how your personal data is collected, used, stored, and protected when you use our website https://www.rotatejets.com/ and/or when you enter into an air charter brokerage contract with ROTATE.

This Policy may be modified or supplemented at any time, particularly to comply with any legislative, regulatory, or judicial developments, as well as the recommendations and decisions of the French Data Protection Authority (the "CNIL"). We encourage you to review it regularly.

Article 1 - Data Controller

The controller of the personal data described in this Policy is ROTATE, a simplified joint-stock company (société par actions simplifiée) with a capital of 10,000 euros, registered in the Bordeaux Trade and Companies Register under number 109 567 073, with its registered office located at Place des Grands Hommes, 33000 BORDEAUX (hereinafter the "Data Controller").

As ROTATE is not required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR, any questions regarding this Policy or the exercise of your rights may be addressed to the following internal contact: erwann@rotatejets.com or by mail to the registered office address indicated above.

Article 2 - Data collected and purposes of processing

ROTATE collects and processes personal data through several distinct channels, the scope of which varies depending on the nature of the relationship with the person concerned.

2.1 Contacting us (website form, social media, email, phone)

When you use the contact form available on our website, or when you contact us directly by phone, email, or via our social media accounts, we collect the following data:

  • Surname;
  • First name;
  • Email address;
  • Phone number (optional).

This data is collected for the purpose of processing your request for information or connection, responding to you, and, if applicable, initiating a pre-contractual relationship with a view to providing our air charter brokerage services.

2.2 Conclusion and execution of the brokerage contract

When you enter into an air charter brokerage contract with ROTATE, we collect more extensive data, which is necessary for the formation and execution of the contract, as well as for connecting you with the air operator selected to perform the flight (the "Operator"):

  • Surname and first name;
  • Postal address;
  • Email address;
  • Phone number;
  • A copy of the passport (or any equivalent identity document), including all information contained therein, such as surname, first name(s), date and place of birth, nationality, document number and type, issuing authority, dates of issue and expiry, and, where applicable, the passenger's photograph.

This information is essential for identifying passengers to the selected Operator, for security and airport access formalities, and for any customs and immigration procedures applicable to the flight. If this information is not provided, ROTATE will be unable to fulfill the brokerage contract.

2.3 Marketing

When you are a Client or have provided us with your contact details during an inquiry, ROTATE may send you marketing communications regarding its air charter brokerage services via electronic or telephone means.

By electronic means (email, SMS):

  • If you are already a Client, these solicitations, concerning products or services similar to those you have already received, may be sent to you without prior consent, based on ROTATE's legitimate interest. You may object to this at any time, free of charge and easily, via the unsubscribe link included in every communication.
  • If you are not or are no longer a Client, these solicitations are only sent to you with your prior and express consent, obtained through a clear, non-pre-checked positive action, which you may withdraw at any time.

When you are contacted as a professional for a purpose related to your activity, marketing sent to a generic email address of a legal entity (contact@, info@) may be carried out without prior consent, as this address does not target a specific individual; marketing sent to an individual professional email address may be carried out solely on the basis of ROTATE's legitimate interest, provided there is clear information and a simple way to object.

By telephone: ROTATE only contacts you by phone with your prior, free, specific, informed, and revocable consent, unless the solicitation occurs within the framework of an ongoing contract and relates to its subject matter, or when the person being contacted is acting, for the purpose of that solicitation, within the scope of their professional activity and therefore does not qualify as a consumer under the Consumer Code.

Article 3 - Legal Bases for Processing

The processing operations described in Article 2 are based, as the case may be, on the following legal grounds:

  • Performance of the contract (Article 6.1.b of the GDPR), for the collection and processing of data necessary for the formation, management, and execution of the air charter brokerage contract, as well as the transport contract concluded with the Operator;
  • Pre-contractual measures taken at your request (Article 6.1.b of the GDPR), for the processing of data collected via the website contact form, email, telephone call, or social media;
  • Consent (Article 6.1.a of the GDPR), for any processing based on it, particularly, where applicable, regarding electronic marketing communications sent to non-clients and, for any telephone marketing, subject to legal exceptions; this consent may be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal;
  • ROTATE's legitimate interest (Article 6.1.f of the GDPR), particularly to ensure the security of its website, prevent fraud, manage potential claims and disputes, as well as to send existing Clients electronic marketing communications regarding similar products or services, or to send marketing communications to professionals at a generic or individual business address;
  • Compliance with legal obligations (Article 6.1.c of the GDPR), particularly regarding accounting, tax, and anti-money laundering and counter-terrorist financing regulations, as well as, where applicable, security and customs and immigration formalities imposed by airport authorities or operators.

Article 4 - Data Recipients

Personal data collected by ROTATE is disclosed, to the extent necessary for each of the purposes described in Article 2, to the following recipients:

  • Authorized ROTATE personnel, within the limits of their respective duties;
  • The air carrier selected for the flight, to whom passenger identification data, including a copy of the passport, is necessarily disclosed for identification, security, and, where applicable, customs and immigration formalities;
  • Airport managers and competent airport, security, customs, and immigration authorities, when the disclosure of data is legally or contractually required;
  • Online payment service providers for payment processing;
  • ROTATE's technical service providers (website hosting, email, management tools), acting as processors within the meaning of Article 28 of the GDPR, under contracts governing their data protection obligations;
  • Administrative or judicial authorities, when the disclosure of data is required by a legal or regulatory provision or by a court order.

In accordance with its policy for securing personal data exchanges, ROTATE ensures that the transmission of sensitive documents such as passport copies is carried out using appropriate means (secure channels, limiting unprotected attachments where possible).

Article 5 - Data Transfers Outside the European Union

As part of its international air charter brokerage business, ROTATE may use Operators established outside the European Union and the European Economic Area (the "EU/EEA"), which implies a transfer of passengers' personal data, including copies of their passports, to a third country.

This transfer constitutes an inherent and necessary feature of the service requested by the Client: as soon as the Client requests a flight to, from, or via a third country, ROTATE will be required, for the conclusion and performance of the transport contract, to transmit the data of the passenger(s) to the Operator selected for the flight.

In accordance with Articles 44 et seq. of the GDPR, such a transfer is only carried out under one of the following conditions:

  • The destination country is the subject of an adequacy decision by the European Commission finding that it ensures an adequate level of protection;
  • In the absence of an adequacy decision, the transfer is governed by appropriate safeguards within the meaning of Article 46 of the GDPR, such as standard contractual clauses adopted by the European Commission, binding corporate rules, or any other mechanism provided for by Article 46 of the GDPR;
  • Only when neither an adequacy decision nor appropriate safeguards can reasonably be mobilized may the transfer, by way of derogation, be based on one of the conditions of Article 49 of the GDPR, in particular: the conclusion or performance of the transport contract concluded in the interest of the passenger;
  • In any event, the explicit and informed consent of the passenger, obtained specifically for this transfer after having informed them of the identity of the Operator, the country concerned, and the risks inherent in the absence of protection equivalent to that of the European Union, may also justify such a transfer, in accordance with Article 49 of the GDPR.

When the transfer is based on standard contractual clauses, the Client or passenger may request that ROTATE provide a copy of these clauses as actually concluded with the relevant Operator, including completed and signed annexes. To the extent necessary to protect trade secrets or other confidential information, certain elements of this copy may be redacted. ROTATE will then justify the reasons for this to the passenger and provide a comprehensible summary allowing them to understand the content and effectively exercise their rights.

Article 6 - Data Retention Period

Your personal data is retained for the following periods:

  • Data collected during initial contact or as part of prospecting activities: retained for three (3) years from the date of the last contact, provided no brokerage contract is concluded;
  • Data collected within the framework of the brokerage contract (surname, first name, address, email, telephone): retained for the entire duration of the contractual relationship, and then for five (5) years from the end of that relationship, a period corresponding to the common law statute of limitations (Article 2224 of the French Civil Code);
  • Passport copy and associated identity information: retained for a period limited to six (6) months after the completion of the relevant flight, unless a legal, regulatory, or litigation-related obligation justifies longer retention; this reduced period is justified by the particular sensitivity of this document;
  • Accounting or tax data (notably invoices): retained for ten (10) years from the end of the relevant financial year, in accordance with Article L. 123-22 of the French Commercial Code.

Once these periods have expired, the data will be deleted or anonymized, unless there is a legal obligation to the contrary or it is necessary to retain the data for the establishment, exercise, or defense of legal claims.

Article 7 - Data Security

ROTATE implements appropriate technical and organizational measures, considering the nature of the data processed and the risks presented by the processing, to ensure a level of security adapted to the risk and to prevent any destruction, loss, alteration, disclosure, or unauthorized access to personal data, in accordance with Article 32 of the GDPR.

These measures include, but are not limited to, limiting data access to authorized personnel only, securing the exchange of sensitive documents such as passport copies, and training ROTATE staff on data protection requirements. In the event of a personal data breach likely to result in a risk to the rights and freedoms of the individuals concerned, ROTATE will notify the CNIL as soon as possible and, if necessary, no later than seventy-two (72) hours after becoming aware of it, in accordance with Article 33 of the GDPR, and will notify the individuals concerned when this risk is high, in accordance with Article 34 of the GDPR.

Article 8 - Cookies and trackers

The ROTATE website only uses cookies that are strictly necessary for its operation (e.g., technical navigation or security cookies), which are exempt from prior consent under Article 82 of the French Data Protection Act and CNIL guidelines regarding cookies and other trackers. Consequently, no consent banner is required.

Article 9 - Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights regarding your personal data:

  • Right of access: to obtain confirmation as to whether or not your data is being processed and, if so, to obtain a copy;
  • Right to rectification: to obtain the correction of inaccurate or incomplete data;
  • Right to erasure: to obtain the deletion of your data in the cases provided for by the GDPR;
  • Right to restriction of processing;
  • Right to data portability, when processing is based on consent or the performance of a contract and is carried out by automated means;
  • Right to object, for processing based on the legitimate interest of ROTATE, as well as for any processing for marketing purposes;
  • Right to withdraw your consent at any time, when processing is based on it, without affecting the lawfulness of processing based on consent before its withdrawal;
  • Right to define directives regarding the fate of your data after your death.

You may exercise these rights by sending your request, along with proof of identity, to the internal contact mentioned in Article 1 of this Policy (erwann@rotatejets.com).

ROTATE commits to responding to your request within one (1) month of receipt. This period may be extended by two (2) additional months depending on the complexity or number of requests, in accordance with Article 12 of the GDPR.

If, after contacting us, you feel that your rights are not being respected, you have the right to file a complaint with the CNIL (3 Place de Fontenoy 75334 Paris Cedex 07; www.cnil.fr).

Article 10 - Changes to the Privacy Policy

ROTATE reserves the right to modify or update this Policy at any time, particularly to comply with any legislative, regulatory, or judicial changes, or recommendations from the CNIL. Any changes will be published on the ROTATE website with the date of the update. We encourage you to review this Policy regularly to stay informed of any modifications.