Privacy Policy

1. Who we are

Step Aviation Ltd is responsible for deciding how information submitted through our enquiry form is used to handle enquiries. In that role, we are the data controller.

Company registration number: 08613304.
Registered office: 4th Floor, 1 Greek Street, London, England, W1D 4NQ.
For privacy enquiries or requests about your information, email a.stepanovs@stepaviation.co.uk.

2. Information we collect

The contact form requires your name, email address and message. You may provide a preferred name or first name; your complete legal name is not required for an initial enquiry. Company name and telephone number are optional, as is any additional personal information you choose to include in the message. We welcome enquiries from private individuals and business representatives. Please provide only information relevant to your enquiry and avoid sensitive personal information.

If you supply a telephone number, any contact using it will relate only to your enquiry or services you have requested. You can submit the form without supplying a telephone number.

We also receive your mandatory contact acknowledgement with the submission. This records your agreement to be contacted about that enquiry. It does not authorise unsolicited marketing or unrelated sales calls, and is not a general GDPR consent mechanism.

Most information comes directly from you. If someone contacts us on another person's behalf, we may receive that person's contact details and information in the message from the sender. Where required by Article 14 of the UK GDPR, we will provide the person with privacy information within one month, or earlier at our first communication or disclosure, unless a relevant exception applies.

Technical information is processed separately from the form fields. GitHub Pages, which hosts this website, logs visitors' IP addresses for security. Formspree's privacy policy describes processing such as IP addresses, browser details, access times and referring websites to operate and protect its service.

3. How we use enquiry information

Step Aviation Ltd uses personal information submitted through its contact form exclusively to respond to enquiries and discuss aircraft repair and maintenance services requested by the person contacting us. We do not use submitted information for unsolicited marketing, promotional communications or proactive sales.

We only contact you in connection with an enquiry you have submitted or subsequent communications about services you have requested. We do not use submitted contact details for unsolicited sales calls, promotional emails, marketing campaigns, newsletters or proactive offers of services.

4. Our lawful basis

We process general enquiries from private individuals and business representatives under Article 6(1)(f) of the UK GDPR. Our legitimate interests are to respond to enquiries that people initiate and discuss aircraft repair and maintenance services they request. We limit this processing to information reasonably necessary to handle the enquiry. Where processing is necessary to take steps towards a contract with an individual at that individual's request, Article 6(1)(b) of the UK GDPR may apply to that specific processing. This does not automatically apply to an employee or representative enquiring on behalf of a separate company. The contact acknowledgement records agreement to enquiry-related contact only; it is not permission for marketing and does not make consent our lawful basis.

5. Formspree and other recipients

The form sends your information over HTTPS to Formspree, our external form-processing provider. Formspree processes and stores submissions on its infrastructure. Authorised Step Aviation personnel may access submissions through its dashboard. We receive form notification emails in our configured Google Workspace mailbox.

We use Google Workspace (Gmail) to receive form notifications and communicate with customers. Google processes message contents, contact details and associated email information as our email service provider.

GitHub Pages hosts the website and processes technical information about visits. This website sends contact submissions directly to Formspree; it does not store them in the GitHub repository. GitHub also processes information for its own service and security purposes, described in its privacy statement.

Enquiry information is intended for authorised Step Aviation personnel who need it to handle enquiries and requested services. Other disclosures are limited to a valid business or legal reason, for example necessary professional advice or a lawful request from an authority.

6. How long information is kept

Formspree archive: we use Formspree's Free plan, which provides a 30-day submission archive. This submission-history period is separate from our email correspondence. It does not establish guaranteed permanent erasure from all Formspree systems after exactly 30 calendar days, including logs and backups.

Google Workspace correspondence: notification emails and enquiry correspondence are separate copies from the Formspree archive. Our retention policy, effective 17 October 2026, provides for correspondence to be retained while an enquiry or requested service remains active. Completed or inactive enquiries are due for review 12 months after closure or the last meaningful enquiry-related communication, whichever is later. The policy requires monthly reviews of eligible enquiries and deletion of personal information that is no longer necessary, including relevant email copies, attachments, downloaded copies and exports under our control. Information may be deleted sooner when no longer needed, subject to applicable obligations.

Relevant records may be retained longer where justified by ongoing services, contractual obligations, legal requirements or disputes. The reason for longer retention must be documented and reviewed every three months. A designated authorised person is responsible for performing and recording reviews. The 12-month point is a review point, not automatic deletion. Gmail copies are not automatically deleted when Formspree's 30-day archive period ends.

Formspree describes backups and separate processing of technical logs in its provider information. An expired dashboard entry does not show that every related copy has been erased. Email messages, downloaded copies and retained business records are separate from the submission archive.

7. International transfers

Formspree states that its services are hosted with Amazon Web Services in the United States and that it relies on Standard Contractual Clauses as a processor. Your information may therefore be processed outside the UK.

Google Workspace and GitHub may also process information outside the UK. Google's published transfer information identifies the UK Extension to the EU–US Data Privacy Framework for covered US transfers; its Cloud Data Processing Addendum provides further transfer terms. GitHub's privacy statement describes international processing, contractual clauses and participation in the UK Extension.

The provider information linked above describes their published transfer arrangements; it does not establish that particular safeguards have been verified for Step Aviation Ltd's accounts. Contact a.stepanovs@stepaviation.co.uk to request further information about international processing and a copy or explanation of the applicable safeguards.

8. Your data protection rights

Depending on the circumstances and lawful basis, you may have rights to be informed, access your information, correct inaccurate information, request erasure or restrict processing. You may also have rights relating to significant automated decisions, including asking for human intervention and challenging a decision where applicable.

Right to object: you may object to processing based on legitimate interests on grounds relating to your particular situation. We must stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Data portability may apply to information you provided where processing is automated and based on consent or a contract. It does not apply to every enquiry record. If we ever rely on consent, you may withdraw it without affecting processing that was lawful before withdrawal.

To make a request, contact a.stepanovs@stepaviation.co.uk. We may need information to verify your identity. You can also complain to the Information Commissioner's Office (ICO).

9. Security

Access to our Formspree and Google Workspace accounts is restricted to authorised personnel, and two-factor authentication is enabled on those accounts. The public website uses HTTPS, and the form sends submissions to Formspree over HTTPS. No internet transmission or storage system can be guaranteed completely secure.

10. Cookies, analytics and security tools

This website's code does not set cookies or use browser storage, analytics, marketing pixels, embedded third-party content or embedded CAPTCHA scripts. Images and scripts are served with the website, and fonts are provided by your device. The form connects to Formspree when submitted.

This describes the website code, not every provider's systems. Hosting security logs and Formspree's server-side anti-spam processing are separate. A provider-hosted confirmation or security challenge can have its own technologies and privacy information.

11. Your choice to provide information

You are not generally legally required to submit an enquiry. To use the form, you must provide your name, email address and message, and actively tick the acknowledgement that we may contact you about your enquiry. Company names and telephone numbers are optional. You do not need to represent a company to contact us. Without the required information and acknowledgement, the form cannot submit; you can contact us directly by email instead.

The acknowledgement covers only replies and communications relating to your enquiry or requested services. It does not permit unsolicited marketing or give blanket permission for future processing.

12. Automated decisions

The website checks required fields and contact details before sending an enquiry. These checks do not make decisions about individuals with legal or similarly significant effects. Formspree's anti-spam tools may automatically filter messages; ordinary spam filtering is different from significant automated decision-making. You can contact us directly by email if you have difficulty submitting an enquiry.

13. Changes to this policy

We may update this policy as our practices change. The latest version will be published on this page with its last updated date. Where required, we will provide information about a new use before that processing starts.