Privacy notice

1. Controller and contact

The data controller is IANAI S.R.L.S., trading as IANAI Private Jet. Registered office: Via Francesco Donati 62D, 00126 Rome (RM), Italy. VAT and tax number: 18533621001; REA RM - 1790778. Certified e-mail (PEC): ianai@pec.it. Operational and privacy contact: operations@ianaiprivatejet.com.

2. Data and configurator

The configurator uses your name, e-mail, optional phone number, route, dates, passenger count, selected services and notes. The summary is prepared in your browser; your request is sent to the desk through the actions described below. If you consent to analytics, the Clarity collection described in section 8 also applies. When you select “Send request from website”, your contact details and summary are passed to Web3Forms for delivery to operations@ianaiprivatejet.com. The website shows a confirmation when the service accepts the submission. When you click a WhatsApp link with a completed mission, the website also passes the prepared brief and any completed contact details to Web3Forms and the Operations mailbox for recording in the Microsoft 365 archive. It is recorded separately as “WhatsApp - brief sito”, with sending unverified, and does not trigger a confirmation email to you. The brief in the link is also passed to WhatsApp to prepare your message; IANAI receives the WhatsApp message when you send it. The website cannot detect later changes in the app or verify sending. Generic links without a completed mission do not record a brief. You can submit the form without opening an e-mail app. Do not enter medical reports, diagnoses, identity documents or health data in the notes. Assistance requirements need a separate process with appropriate information and legal conditions.

3. Purposes and legal bases

Details received are used to respond, contact you about your request, check availability and prepare travel proposals: steps taken at your request before entering into a contract and, where relevant, performance of a contract (GDPR Article 6(1)(b)). Legal obligations are covered by Article 6(1)(c). Your request and contact details are recorded in IANAI’s commercial archive on Microsoft 365/SharePoint, with the date, channel, travel details and case status, to maintain continuity in handling the request and analyse outcomes. A travel request does not give consent to newsletters or advertising. Technical logs are processed for website operation and security.

Only if you select the optional boxes may IANAI send offers and updates through your chosen channel (email and/or WhatsApp), including offers relating to destinations you have requested. The legal basis is consent (GDPR Article 6(1)(a) and Article 130 of the Italian Privacy Code). We record the channel, date, version and wording of consent. Refusing does not limit the requested service. You may withdraw each channel free of charge by emailing operations@ianaiprivatejet.com or replying STOP on WhatsApp. Withdrawals are recorded before further campaigns. Clicking a WhatsApp button alone does not authorise promotional messages.

4. Providing details

The configurator requires your name and e-mail to prepare a request; phone and notes are optional. A phone number is required if you opt in to WhatsApp promotions. Without necessary details the desk may be unable to reply or prepare a proposal. You may also contact the desk directly. You can edit or delete the summary before sending.

5. Recipients and services

Authorised staff and, as necessary for your request, air operators, handling providers, chauffeur services, accommodation and destination providers may process the details received. Hosting processes technical browsing data such as IP address, time and browser information. The website uses ChatGPT Sites and Google Fonts; font requests disclose technical data to Google. WhatsApp is contacted when you choose its link. The form uses Web3Forms, a Web3Creative service, to process the details entered and deliver them to the Operations mailbox, which uses Microsoft 365. Infrastructure and sub-processors are described in the provider’s privacy policy and Data Processing Agreement.

6. Transfers outside the EEA

Hosting, Google Fonts, WhatsApp, Web3Forms, e-mail and travel operators may involve processing data outside the European Economic Area (EEA). Web3Forms states that it operates from India and uses infrastructure in multiple regions; its DPA provides Standard Contractual Clauses for transfers. Information about destinations, applicable safeguards and how to obtain a copy can be requested from the controller at operations@ianaiprivatejet.com.

7. Retention

Requests without a contract: deletion or anonymisation within 12 months after the last contact, unless a documented need justifies a different period. The technical copy of submissions held by Web3Forms is deleted after 7 days, according to the retention configured for this form; correspondence in the Operations mailbox and identifying details in the commercial archive follow the period stated above. Statistics may be retained anonymously. Contact details and interests used for promotions with consent are retained until withdrawal and for no longer than 24 months from consent, unless renewed. Consent evidence and a minimal suppression record may be retained to document choices and prevent unwanted messages. Contractual and administrative records: the retention periods required by applicable law. Hosting logs are retained in accordance with the provider’s retention periods and policies, based on the service’s technical and security needs.

8. Cookies, measurement and automated decisions

You may choose navigation analytics and campaign measurement separately; both are optional. “Navigation analytics (GA4 and Clarity)” enables Google Analytics 4 to measure visits, traffic sources, engagement time while the page is in focus, viewed sections, scrolling, configurator progress, contact clicks and submitted requests. Processing includes pseudonymous identifiers, technical device and browser data, visited pages, campaign identifiers and navigation events. User-level event retention is configured for 2 months; aggregated reports may follow different service retention periods.

“Google Ads measurement” measures WhatsApp and e-mail link clicks and confirmed form submissions, attributing them to advertising campaigns. A click means opening a contact channel; the form event is recorded only after Web3Forms confirms that it accepted the submission. Neither event confirms a sale. Analytics and Ads are linked for campaign performance analysis: form submissions already measured directly in Ads are not imported a second time from Analytics.

Tags load only after consent for their respective purpose. Google Signals, ad personalisation and automatic outbound-link and form detection are disabled. We do not send Google names, e-mail addresses, phone numbers, routes, travel dates, notes or message contents. Page addresses are limited to paths and campaign attribution parameters; Analytics does not collect the contents of WhatsApp links. The website and request forms work even if both purposes are rejected.

The technical ianai_consent cookie remembers your choice for 182 days. Google Ads cookies beginning with _gcl_ may last up to 90 days; Analytics cookies beginning with _ga are configured for a maximum of 180 days. You can reject or withdraw each purpose through “Cookie preferences”. Withdrawal stops new events for the affected purpose and removes the related cookies managed by the website. Google services may involve transfers outside the EEA: Google privacy policy, how Google uses data from sites using its services and data processing information. Hosting may use technical cookies and logs required for operation and security. The configurator makes no automated decisions with legal or similarly significant effects.

The same category enables Microsoft Clarity to analyse browsing sessions, create click and scroll heatmaps and identify configurator difficulties. Clarity may capture summaries displayed on the page and the complete addresses of clicked links. This includes the complete WhatsApp link containing the brief: route, dates, passengers, services, notes and any name, email address and phone number included. Automatic input-field masking does not remove WhatsApp link contents. Processing relies on analytics consent; rejecting it does not limit the configurator or contact options. Clarity loads only after that consent, passed through Microsoft’s Consent API; sharing for Microsoft advertising is disabled. It uses _clck and _clsk cookies and retention periods described in Microsoft documentation. The service may involve transfers outside the EEA: Microsoft privacy statement. You may withdraw consent through cookie preferences.

9. Your rights

Where applicable, you can request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. If a separate processing activity relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Contact operations@ianaiprivatejet.com. You may lodge a complaint with the Italian data protection authority or another competent authority. IANAI will respond within the GDPR time limits.