A practical, plain language guide to how we handle the personal data inside your accounts when we run your marketing and sales, and what your responsibilities are as the data controller.
When you engage Air Trending to manage your marketing and sales, we work inside accounts and tools that hold personal data about your prospects, leads and customers. This guide explains, in plain language, how we handle that data, how we access your accounts, and what you need to do as the owner of the data. It complements our Data Processing Agreement, which is the binding document. If anything here differs from the DPA, the DPA prevails.
For the data inside your campaigns and CRM, you are the data controller. You decide whose data is collected and why. We are your data processor. We handle that data only to deliver the services you have engaged us for, and only on your instructions. This split matters: as controller, you are responsible for the lawfulness of the data and for the rights of the people in it.
Depending on your services, we may handle contact and identification data such as names, emails and phone numbers, marketing engagement data such as opens and clicks, message content and metadata for campaigns we run, scheduling and booking details, and basic device and log data. We do not need, and you should not place into these tools, sensitive data such as financial account numbers, government IDs or health information.
To build and run your marketing, we need access to relevant platforms, for example your CRM, advertising accounts and website.
We never sell or share your data, and we never mix one client's data with another's. The data in your accounts is processed only to deliver your services, and it remains yours. On request, and subject to settlement of any amounts due, we hand back access and help you export your data.
As controller, you are responsible for:
When we run email, SMS, voice or messaging campaigns for you, you are responsible for the lawfulness of the lists and the consent behind them. We will follow good practice, including honoring unsubscribe and STOP requests and not contacting people who have opted out, but the underlying consent and list hygiene are yours to provide. Different regions have different rules, for example the GDPR and the Spanish LSSI-CE in Europe, and laws such as the TCPA and CAN-SPAM elsewhere. Tell us about any specific constraints on your audiences.
We deliver your services using trusted platforms, including the Air Lift platform for CRM and automation, advertising and analytics platforms, a consent management tool for our website, and a payment tool. Each is engaged under data protection terms, and the current list is on our Sub-processors page. You may object to a new sub-processor on reasonable data protection grounds, as set out in the DPA.
Some of the platforms we use are based outside the EEA, the UK or Switzerland, including in the United States. Where data is transferred to them, we rely on an appropriate safeguard, in most cases the Standard Contractual Clauses with the UK Addendum and Swiss adaptations as relevant.
We apply least privilege access, secure credential handling, vetted platforms, logging of account activity, personnel confidentiality, and a documented incident response process. A fuller summary is in our Security & Compliance Overview.
If one of your contacts asks to access, correct or delete their data, that request is yours to handle as controller. If a contact contacts us directly, we will pass the request to you and not act on it except on your instructions or as required by law. We will assist you in responding, as set out in the DPA.
We keep your data only for as long as we need it to deliver your services, and as your settings and our agreement provide. On termination, and on your request, we delete or return the personal data we process for you, except where the law requires retention.
If we become aware of a personal data breach affecting the data we process for you, we will notify you without undue delay and give you the information you need to meet your own obligations. If you ever believe an account or credential has been compromised, tell us immediately so we can help contain it.
For any question about how we handle your data, or to make a request, contact us at gdpr@air-trending.com.
We use strictly necessary cookies to run this website. With your consent, we also use preferences, analytics and marketing cookies, including from Google, Meta and LinkedIn, to remember your choices, measure visits and show you relevant ads. You can accept all, reject all or choose by category, and change your mind at any time. Cookie Policy
Choose which cookies you allow. Strictly necessary cookies are always active. Cookie Policy
