1. Who we are and scope
This Privacy Policy explains how NORETTI GROUP, operator of norettigroup.com, handles personal information in connection with this Website, business inquiries, aircraft and equipment listings, order requests, and related communications. NORETTI GROUP is responsible for the processing described here unless a different contracting entity is identified in a written agreement.
This Policy applies to business and professional users. It does not govern third-party websites or services that have their own privacy policies.
2. Information you choose to provide
Depending on how you interact with us, you may provide:
- Identity and contact data: name, business email, telephone or WhatsApp number, company, job role, and country.
- Inquiry and transaction data: products or aircraft of interest, quantities, specifications, requested documents, delivery requirements, order references, notes, quotations, inspection arrangements, and correspondence.
- Commercial and compliance data: preferred payment method and, where separately required for a transaction, company-registration, tax, customs, end-user, sanctions-screening, or know-your-customer information.
- Communications: emails, WhatsApp messages, attachments, and other information you choose to send.
Do not send through public forms or unsecured messages: full payment-card or bank-account credentials, security codes, PINs, passwords, one-time codes, passport or identity documents, unnecessary sensitive personal data, export-controlled technical data, trade secrets, or confidential third-party material. Provide only information reasonably necessary for your inquiry. If sensitive compliance or transaction documents are genuinely required, wait for a specific request and use the separately agreed protected channel.
3. What the current Website forms and checkout actually do
The Website is currently static. It does not maintain a customer account database or a server-side order database.
- Checkout: the checkout tool creates an order reference and prepares an order-request message in your browser. It does not charge a payment method and does not automatically transmit the order to NORETTI GROUP. Information is sent only when you choose to send it through your email application or WhatsApp, or when you copy and send it yourself.
- Contact forms: information entered into the current Website contact form is handled in the browser and is not transmitted to a NORETTI GROUP server by that form. To communicate with us, use the published email, telephone, or WhatsApp channels.
- External channels: when you send an email or WhatsApp message, your service provider and the receiving provider process and store the communication under their own terms. Do not include sensitive financial credentials, identity documents, or controlled technical material in these messages.
4. Browser-local storage
The Website uses website-specific entries in your browser’s local storage to save cart contents and catalog preferences on your device. They can contain product identifiers, quantities, descriptions, displayed catalog prices, and other catalog data entered or selected in that browser.
Local-storage data remains on your device until you remove it, clear browser data, or the relevant browser or device resets it. It is not automatically synchronized to a NORETTI GROUP account or sent to us merely because it is saved. Anyone with access to your browser profile or device may be able to access it. Do not place confidential, financial, identity, payment, or sensitive personal information in carts, notes, or shared-browser storage.
5. Technical information, hosting, security, and analytics
When you visit a hosted website, technical information is ordinarily processed to deliver and protect it. Our hosting and infrastructure provider, Cloudflare, may process requested URLs, timestamps, browser and device information, network information including IP addresses, approximate region, security events, and diagnostic logs. Cloudflare Web Analytics is enabled for norettigroup.com and records website activity such as page views and visits.
This information may be used to deliver pages, prevent abuse, maintain security, diagnose failures, understand aggregate Website use, and improve content. We do not interpret analytics visits as identified sales leads or confirmed customers. Internal security configurations, risk rules, and investigative details are not publicly disclosed.
6. External resources, widgets, and links
The Website loads or links to third-party resources, including Google Fonts, Font Awesome through cdnjs, TradingView, Arincen market information, WhatsApp, payment-service websites, and other external destinations. Your browser or device may disclose technical information such as your IP address, requested resource, browser data, and referring page when it connects to those providers.
External payment icons are links to official services; they do not transmit card or bank credentials to NORETTI GROUP. Never enter payment credentials in a message to NORETTI GROUP. Market widgets and third-party content may have different availability, tracking, and data practices. Review the relevant provider’s privacy policy and verify the destination before using an external service.
7. Cookies and similar technologies
The current cart functionality described above uses local storage rather than requiring a NORETTI GROUP customer-account cookie. Cloudflare, embedded market-data providers, external fonts, or services you choose to open may use cookies or similar technologies where permitted by their own configuration and policies.
You can control or delete cookies and site data through your browser. Blocking some technologies may affect security, external widgets, saved carts, or other features. We do not use checkout data to create cross-context behavioral advertising profiles.
8. How we use information
Subject to the actual channel used, information may be used to:
- respond to inquiries and provide aircraft, product, procurement, logistics, or service information;
- prepare quotations, order requests, contracts, inspection arrangements, shipping coordination, and after-sales support;
- verify business identity, authority, transaction eligibility, sanctions and export-control compliance, and fraud or security risks;
- operate, secure, troubleshoot, and improve the Website and understand aggregate usage;
- protect confidential business information, prevent unauthorized disclosure, maintain business records, establish or defend legal claims, enforce agreements, resolve disputes, and comply with tax, customs, accounting, aviation, and other legal obligations; and
- communicate service or transaction updates. Marketing consent will be obtained separately where required.
9. Legal bases where required
Where laws such as the GDPR or LGPD require a legal basis, we rely as applicable on: steps requested before entering a contract and performance of a contract; legitimate interests in operating a secure B2B service, responding to business inquiries, preventing fraud, and developing commercial opportunities, balanced against your rights; compliance with legal obligations; and consent for activities that require it.
You may withdraw consent at any time for future processing, without affecting processing already lawfully performed. We may still need to retain or process information on another lawful basis.
10. When information may be disclosed
We do not sell personal information for money. We limit disclosures to information reasonably necessary for the relevant purpose. Information may be disclosed only as reasonably necessary to:
- hosting, infrastructure, analytics, communications, email, WhatsApp, document, payment, escrow, banking, logistics, inspection, and IT providers supporting an inquiry or transaction;
- relevant buyers, sellers, brokers, manufacturers, maintenance organizations, customs brokers, carriers, or professional advisers when necessary for the requested transaction and subject to appropriate confidentiality or professional duties;
- regulators, courts, law-enforcement, customs, sanctions, aviation, tax, or other authorities where legally required or necessary to protect rights, security, and safety; and
- a successor in a genuine business restructuring or transaction, subject to applicable notice and safeguards.
We do not publicly disclose non-public transaction structures, margins, commissions, banking details, customer or supplier identities, internal risk criteria, or security configurations. This does not prevent disclosures that are legally required or reasonably necessary to establish, exercise, or defend legal rights. We do not authorize providers to use transaction information for their own unrelated purposes where contractual restrictions are required.
11. International processing and transfers
NORETTI GROUP conducts international business. Information may be processed in countries outside your own, including where our personnel, counterparties, communication providers, hosting providers, or transaction partners operate. Data-protection rules may differ.
Where required, we will use an applicable legal transfer mechanism and reasonable safeguards, such as contractual protections and assessments required by the relevant law. Where China’s PIPL, the LGPD, or EEA/UK rules impose specific cross-border conditions or separate consent requirements, those requirements must be addressed before the relevant transfer.
12. Retention
We retain personal information only as long as reasonably necessary for the purpose collected, including responding to inquiries, performing agreements, maintaining transaction and compliance records, enforcing rights, resolving disputes, and meeting legal obligations. Retention periods vary by the communication, transaction, jurisdiction, and required evidentiary or regulatory record. Information subject to an actual or reasonably anticipated dispute, investigation, audit, or legal hold may be retained for as long as legally necessary.
Browser-local data remains until you or your browser removes it. Email, WhatsApp, and provider retention is also governed by the relevant provider and your own account settings. Information no longer required is deleted, anonymized, or securely isolated where deletion is not immediately practicable.
13. Security
We use reasonable organizational and technical measures appropriate to the information and channel, including access controls and secure hosting arrangements. Sensitive documents should be shared only through a specifically agreed channel and limited to authorized recipients. No website, device, email service, messaging platform, or transmission method is completely secure, and we cannot promise absolute prevention of unauthorized access or disclosure.
You are responsible for protecting your devices, accounts, attachments, and message recipients; checking links and sender identities; and independently verifying payment instructions and any requested account change through a previously established company contact. Do not disclose passwords, one-time codes, or banking credentials to anyone claiming to represent NORETTI GROUP.
14. Your privacy rights
Subject to your location and applicable law, you may have rights to request confirmation of processing, access, correction, deletion, restriction, portability, information about disclosures, objection to certain processing, withdrawal of consent, and review of automated decisions where applicable. You may also have the right to complain to a data-protection authority.
Send requests to [email protected]. Do not attach identity documents or other sensitive verification material unless specifically requested through an appropriate channel. We may need to verify identity and authority and may retain information where an exemption or legal obligation applies. Authorized agents must provide proof of authority where required. Responses may be limited where necessary to protect another person’s rights, legally privileged material, confidential commercial information, security, or an ongoing legal claim, subject to applicable law.
15. Regional notices
Brazil: where the LGPD applies, you may exercise the rights of confirmation, access, correction, anonymization, blocking, deletion of unnecessary or excessive data, portability where applicable, information about public and private disclosures, and revocation of consent, subject to legal exceptions.
EEA and United Kingdom: where the GDPR applies, you may object to processing based on legitimate interests and lodge a complaint with your supervisory authority. Required transfer safeguards are addressed under Section 11.
California and other U.S. states: applicable rights may include knowing, accessing, correcting, deleting, and obtaining portable copies of personal information. NORETTI GROUP does not sell personal information for money and does not use Website checkout information for cross-context behavioral advertising.
Hong Kong and mainland China: where the PDPO or PIPL applies, rights and obligations will be handled under the relevant law, including applicable notice, consent, protection, and cross-border requirements.
16. Children
The Website is a B2B service and is not directed to children. Do not use it to submit information about a person under 18. If we learn that a child’s information was provided inappropriately, we will take reasonable steps to delete or otherwise handle it as required by law.
17. Changes to this Policy
We may revise this Policy to reflect changes to the Website, providers, transactions, or legal requirements. The “Last updated” date identifies the current version. Material changes will be presented with additional notice where required. Changes do not reduce signed contractual protections without the agreement required by law.
18. Contact and complaints
For privacy questions, rights requests, or complaints, contact NORETTI GROUP Privacy at [email protected] with the subject “Privacy request.”
Hong Kong: +86 198 7672 2773
United States: +1 352 890 9244
Brazil: +55 11 95279 2276
You may also contact the competent data-protection authority in your jurisdiction.