Privacy policy

CAP10INSURANCE is a site of the CAP10AVIATION ecosystem. This page describes the data we collect, why, how long we keep it, and how you stay in control of it.

Who processes your data

The data controller is [CAP10 legal entity name], [legal form], trade licence [number], [registered address], Dubai, United Arab Emirates, which operates CAP10INSURANCE within the CAP10AVIATION ecosystem. Any request about your data goes through the contact form.

What we collect

We only collect what you send us willingly:

• Identity and contact details: business email address and, if you provide them, first name, last name, company, job title, country and phone or WhatsApp number.
• Context of your request: your profile (looking for insurance, insurance professional or other), the insurance family concerned, your markets and regions if you are a professional, the topic chosen and the message you write.
• Platform accounts: the connected platform is in a pre-launch test phase, reached only by invitation or through a test entry. If you hold an account, we process your email address, your password (stored only as a hash by Supabase Auth), the details of your organization and what you enter in it: insurance requests, aircraft and risk information, documents and messages.
• Insurance files, once the platform opens: proposals received, your selection, electronic signature evidence (document fingerprint, time, account, IP address and browser), payment declarations and cover confirmations recorded by the insurer or broker. We ask for no health data.
• Technical origin: page and button of origin, campaign parameters, language, time stamp, and a truncated fingerprint of your IP address used only to rate limit automated submissions.

We buy no database and we run no advertising profiling.

Why

• Tell you when CAP10INSURANCE opens, if you asked for it on the priority access page.
• Keep the context of your request, so we do not ask for it again at opening.
• Route your request to the right person in the CAP10AVIATION team, depending on whether you are looking for cover or offering it.
• Answer your messages and qualify your request.
• Run your platform account and the requests you file in it, and keep a journal of the actions taken on each request.
• Read the documents you upload automatically to pre-fill your request, only with your consent given at upload. Every value read remains a suggestion until you confirm it.
• Protect the site against automated submissions and abuse.

Legal bases

Under the UAE personal data protection law (Federal Decree-Law No. 45 of 2021) and, for users in the European Union, the GDPR, we rely on the performance of the contract with you or your organisation, on our legitimate interest in securing the service and keeping proof of each step, on your consent for automatic document reading and for communications, and on our legal obligations.

Who has access

Your data is processed by the CAP10AVIATION team and by the technical providers strictly required to run the service:

• The insurers and brokers you select, for your request only. Each of them processes your file under its own responsibility.
• A serverless hosting provider, for the site and its server functions.
• A hosting and database provider located in the European Union, for the database, authentication and file storage.
• An automated document-reading provider, only for the documents you choose to have read. It processes them on our behalf, does not use them to train its models and does not keep them once processed [to be confirmed against its contract].
• A transactional email provider, once enabled, for account and notification emails, which never carry an amount or the content of a file.
• The internal CAP10AVIATION CRM, where your details join those of the other platforms of the ecosystem. When an organization is created on the platform, its name, type and country, your email address and, for a professional, the families, territories and markets declared are sent there too. No insurance request, document or message is.
• Google Fonts, for font loading. Your browser then contacts Google servers, which receive your IP address.

Some of these providers are located outside the United Arab Emirates and outside the European Union. These transfers are covered by contractual safeguards, such as the standard contractual clauses of the European Commission.

Your data is not sold, not rented, and not passed to third parties for commercial purposes. A request or a message is never published nor made indexable.

How long

Contact requests and priority access requests are kept for three years from the last exchange. Anti-abuse technical logs are kept for twelve months at most. The data of a platform account is kept while the account exists. The records of an insurance file (what was sent, proposed, chosen, signed and confirmed) are kept for [ten] years after the end of the related policy, a period to be confirmed during legal review, then deleted or anonymised. You can ask for your data to be deleted at any time, within the limits of these records.

Your rights

You can ask for access to your data, its correction, its deletion, the restriction of its processing, its portability, and object to its use. You can withdraw your consent to communications at any time, without affecting processing already carried out. Write to us through the contact form, we answer within thirty days. You may also lodge a complaint with the UAE Data Office or, in the European Union, with your supervisory authority.

Security

• The public pages ask for no password. Platform passwords are handled by Supabase Auth and stored only as a hash, and two step verification is available on the platform.
• No secret key exists in your browser. The public forms reach the database only through the CAP10INSURANCE server functions; the platform uses a public key that grants no access by itself.
• Every table is protected by row level security: an account only reads the data of its own organizations, and every write goes through a controlled database function.
• Exchanges are encrypted in transit, and the site applies a strict content security policy.
• Forms are protected by an invisible decoy, a form timing measure and server side rate limiting.

No system is infallible. Should an incident affect your data, we inform the people concerned as quickly as possible.

Changes

This policy will evolve with the platform. The version date at the top of the page shows the last update. A significant change is announced on this page.