Privacy Policy

Last updated: 8 October 2026

This Privacy Policy explains how ATM JET collects, uses, shares and protects personal data when you visit atmjet.com (the "website") or contact us about private jet charter, yacht charter, or the sale of aircraft and yachts.

1. Who we are

ATM JET ("ATM JET", "we", "us") is based in Dubai, United Arab Emirates. We decide why and how your personal data is processed, so we are its controller.

You can contact us about this policy or your personal data:

by email: info@atmjet.com;
by phone: +971 (50) 458-99-26.

2. Which laws apply

We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"). If you are in the European Union, the European Economic Area or the United Kingdom, the EU General Data Protection Regulation or the UK GDPR (together, the "GDPR") also applies to the processing described here, because we offer our services to you.

3. What personal data we collect

3.1 When you send us an enquiry

When you send an enquiry through the booking or contact form on the website, we collect:

your name, phone number and email address;
the topics you tick, if any, such as a partnership request;
the trip details you enter, such as the departure and arrival airports, the dates and the number of passengers or, for a yacht, the date, the number of hours and the number of guests.

With your enquiry, the website automatically records:

the address of the page you sent it from, including any campaign parameters in that address (such as utm_source or utm_campaign), and the part of the page you used;
the language version of the website;
your browser's user-agent string, which names your browser, its version and your operating system;
the date and time of the enquiry.

We need your name, phone number and email address to reply to you, and we cannot handle an enquiry without them. Everything else is optional, but it helps us prepare an accurate offer.

Please do not include health information or other sensitive personal data in the website form.

3.2 When you contact us directly

When you call us, email us, or write to us on WhatsApp, Telegram or Instagram, we receive your contact details and whatever you choose to tell us. These messaging services process your messages under their own privacy policies.

3.3 When you browse the website

Technical data. When your browser requests a page, our hosting provider processes your IP address, the address of the page, your browser's user-agent string and the date and time of the request, to deliver the page and keep the website secure.
Spam protection. When you send the form, your IP address is used to limit how many enquiries can be sent from one address in an hour. It is held only in the server's working memory and is never written to our database.
Statistics. We use Vercel Web Analytics and Vercel Speed Insights to understand how the website is used and how fast it loads. They do not use cookies; see section 8.
Cookies. See section 8.

3.4 Personal data about other people

If you send us details of other people, such as the passengers you are booking for, please make sure they know about this policy.

4. Why we use personal data, and on what legal basis

To reply to your enquiry, prepare offers and arrange the service you ask for (contact and trip details). This is necessary to take steps at your request before entering into a contract with you (GDPR Article 6(1)(b); PDPL Article 4(10)).
To keep the website and the form secure and free of spam (IP address, user-agent string and technical data). Our legitimate interest in protecting the website and our team (GDPR Article 6(1)(f)).
To understand which pages and campaigns bring enquiries (page address and campaign parameters). Our legitimate interest in improving the website and our advertising (GDPR Article 6(1)(f)).
To produce anonymous statistics on how the website is used and how fast it loads. Our legitimate interest in improving the website (GDPR Article 6(1)(f)).
To remember your cookie choices and your language. This is necessary to provide the website as you asked for it.
To comply with the law and to establish, exercise or defend legal claims. GDPR Article 6(1)(c) and (f); PDPL Articles 4(3) and 4(11).

Under the PDPL, processing requires your consent unless one of the cases listed in Article 4 of the PDPL applies, such as those cited above.

We use your contact details only to deal with your enquiry. We do not send newsletters or promotional messages; if we want to in the future, we will ask for your consent first.

We do not make decisions about you based solely on automated processing, including profiling.

5. Who we share personal data with

Our team. Your enquiry is available to the ATM JET employees who handle it. Enquiries stored in our website database can be accessed only by authorised administrators.
Travel and charter providers. To prepare offers and arrange the service you ask for, we share the details needed for that purpose with aircraft operators, yacht owners and brokers, and ground service providers such as airports, FBOs, handling agents, transfer companies and caterers. They use the data as independent controllers, under their own privacy policies and the laws of the countries where they operate.
Service providers who process data on our behalf. Vercel Inc. (United States) hosts the website, handles the requests your browser makes and provides the statistics described in section 8. Neon (Databricks, Inc., United States) hosts our website database in Frankfurt, Germany. Amazon Web Services stores the images and documents shown on the website in Stockholm, Sweden; when your browser loads some of these files directly, Amazon Web Services receives your IP address.
Telegram. Each new enquiry is delivered to our team through a Telegram bot, so it is also stored in our team's chat on Telegram's servers. Telegram Messenger Inc. operates that service under its own privacy policy.
Authorities and advisers. Courts, regulators, law enforcement and our professional advisers, where the law requires it or where we need to establish, exercise or defend legal claims.

We do not sell personal data.

6. International transfers

We are based in the UAE, and our website database is in Germany. Your personal data is also processed by Vercel in the United States and on its global network, by Telegram on servers in several countries and, when we arrange a trip or a charter for you, by providers in the countries that service involves.

We transfer personal data outside the UAE only in the cases permitted by Articles 22 and 23 of the PDPL, in particular where the transfer is necessary to perform a contract with you or with a third party in your interest, or under a contract that obliges the recipient to protect the data.

Where the GDPR applies, transfers to our hosting, database and file-storage providers rely on the European Commission's Standard Contractual Clauses included in their data processing terms, and transfers to the travel and charter providers needed for your request rely on Article 49(1)(b) of the GDPR. You can ask us for more information about these safeguards.

7. How long we keep personal data

Enquiries in our website database: 24 months from the date you send them; we then delete them.
Enquiry notifications in our team's Telegram chat, and our correspondence with you by email or messenger: as long as we need them to deal with your request and any business relationship that follows from it; we then delete them.
If your enquiry leads to a contract: as long as the contract and UAE commercial and tax law require.
Technical logs kept by our hosting provider: up to 30 days.
IP addresses used for spam protection: only in the server's working memory, until that server instance stops; they are never written to storage.
Cookies: see section 8.

Deleted data may remain in our providers' backups for a limited period, until those backups are overwritten.

8. Cookies and similar technologies

Cookies are small text files that a website stores in your browser. The website sets only these cookies:

cookie-consent records that you have answered the cookie question. It is kept for one year.
marketing-consent records your choice for the "Marketing cookies" category. It is kept for one year.
personal-consent records your choice for the "Personal cookies" category. It is kept for one year.
NEXT_LOCALE remembers the language you switched to, if it differs from your browser's language. It is deleted when you close your browser.

These cookies are necessary for the website to work as you asked, and they are set by the website itself.

We do not currently use advertising cookies or third-party analytics cookies. Your choices for the "Marketing cookies" and "Personal cookies" categories are kept so that, if we add such tools in the future, they run only with your consent. We will update this policy before we add them.

Vercel Web Analytics and Vercel Speed Insights do not use cookies. According to Vercel, they record each page view anonymously: the page address, the referring page, the approximate location (country, region and city), the type of device, the operating system and the browser, and, for Speed Insights, measurements of loading speed and network speed. Vercel Web Analytics tells visits apart by a hash calculated from the request, which is discarded after 24 hours.

To change your cookie choice, delete the cookies for atmjet.com in your browser settings; the website will ask you again on your next visit. You can also block or delete cookies in your browser at any time.

9. Your rights

Under the PDPL, you have the right to:

obtain information about the personal data we process about you, why we process it, who we share it with, how long we keep it and how it is protected when transferred abroad (Article 13);
receive the personal data you have given us in a structured, machine-readable format, and have it transferred to another controller where technically feasible (Article 14);
have inaccurate personal data corrected or completed, and have your personal data erased in the cases the law sets out (Article 15);
have the processing of your personal data restricted (Article 16);
object to the processing of your personal data and have it stopped, including processing for direct marketing (Article 17);
object to decisions based on automated processing that have legal consequences for you or seriously affect you (Article 18);
withdraw your consent at any time, without affecting the processing carried out before you withdrew it (Article 6);
file a complaint with the UAE Data Office (Article 24).

Where the GDPR applies, you have the right to:

access your personal data (Article 15);
have it rectified (Article 16) or erased (Article 17);
have its processing restricted (Article 18);
receive it in a portable format (Article 20);
object at any time to processing based on our legitimate interests (Article 21);
withdraw your consent at any time, without affecting the lawfulness of the processing before you withdrew it (Article 7(3));
lodge a complaint with a supervisory authority, in particular in the EU or EEA country where you live or work or where an alleged infringement took place (Article 77). In the United Kingdom, this is the Information Commissioner's Office.

To exercise any of these rights, email us at info@atmjet.com. We may ask you to confirm your identity before we act on a request. We will reply within one month of receiving your request; if a request is complex or we receive many requests, we may extend this by up to two further months and will tell you why. Exercising your rights is free of charge.

10. How we protect personal data

We use technical and organisational measures suited to the risk, including:

encrypted (HTTPS) connections between your browser and the website;
access to enquiries in our website database only for authorised administrators with personal accounts, with repeated failed sign-in attempts blocked;
automatic protection of the form against spam and abuse.

If a personal data breach could prejudice the privacy, confidentiality or security of your personal data, we will notify the UAE Data Office and you, as Article 9 of the PDPL requires, and, where the GDPR applies, the competent supervisory authority and you, as the GDPR requires.

11. Children

The website and our services are intended for adults aged 18 and over. We do not knowingly collect personal data from children through the website. The details of children travelling with you are provided by their parent or guardian. If you believe a child has sent us personal data, contact us and we will delete it.

12. Other websites and services

The website links to WhatsApp, Telegram, Instagram and other websites. Their operators process personal data under their own privacy policies, which we encourage you to read.

13. Changes to this policy

We may update this policy when our processing or the law changes. We will publish the new version on this page with a new "Last updated" date.