How IONA JETS handles data in a charter request

Before a proposal is accepted, the Broker Partners to whom a request is referred may see the operational information needed to assess it, but not the separate contact fields listed in the current IONA JETS Privacy Policy. That separation does not guarantee anonymity: a name or another identifying detail entered in a free-text field, message or attachment may still be visible.

After a client or Shared User accepts a proposal, the selected Broker Partner receives the contact details needed for direct communication and contracting. It may subsequently request information required by the proposed operator, authorities or service providers under its own privacy documentation and contractual framework. The model is based on staged disclosure, not zero disclosure.

The Privacy Policy identifies Dimitri Memleb, trading as IONA JETS, as the controller for the personal data whose purposes and means IONA JETS determines through the Platform. It is the authoritative description of those processing activities and should be read with the Terms of Service. This article explains the published framework in practical language. It is not a substitute for either document, a compliance certification or legal advice.

This guide reflects the Privacy Policy published on 26 July 2026 and checked for this revision on 30 July 2026. Providers, features, retention periods and legal requirements can change. Always consult the live policy before relying on a particular detail or sending personal information.

What data is shared, and when?

A charter request creates several distinct flows. The request content, separate contact fields, messages, files, shared-access records and technical data do not all have the same recipients or disclosure point. The table summarizes the published sequence without replacing the detailed policy.

These are roles in a data journey, not labels that settle every legal question: a party acts as controller, joint controller or processor according to the purposes and means it actually determines. IONA JETS does not control every later processing operation performed independently by a Broker Partner, operator, authority or other provider.

Share only what the initial request needs

The policy lists identity and contact details, professional information, account credentials, flight-request data, billing fields, Client Portal messages, proposals, shared-access records, audit-log entries, technical data and cookie data among the categories the Platform may receive. Optional channels, comments, subscriptions and account tools create their own records. This does not mean every request requires every category.

An initial assessment will usually turn on the route, dates, passenger or cargo profile, baggage, timing and the service requirements that materially affect feasibility. The separate guide to preparing a first private-jet charter request explains that operational brief for private aviation. An open field in a form is not a reason to add names, complete identity documents, payment information, unrelated corporate details or extensive medical records.

A practical rule before pressing send

• Separate the mission from identity. Provide what is needed to understand the flight before adding names or direct contact details to narrative fields.
• Treat messages and files as disclosures. A signature, company letterhead, document filename, medical note or passport scan can identify someone even when separate contact fields are withheld.
• Check your authority to share another person's data. The policy states that a user providing another person's information confirms that authority and that the person has been informed of the policy. IONA JETS relies on that declaration. That declaration does not by itself determine the legal basis for processing or, where the GDPR applies, satisfy the conditions governing health data. Each controller remains responsible for its own assessment and information duties.
• Use the requested channel. If a specific document is genuinely required, confirm who requires it, why it is needed and where it should be sent.

Health, accessibility and other higher-risk information

A dietary preference, mobility requirement or medical-transport detail may be operationally relevant, but it can also reveal health information or another sensitive circumstance. The Swiss Federal Act on Data Protection treats certain personal data as sensitive, while the GDPR, where applicable, imposes separate conditions for special categories of data. Do not send full diagnoses, treatment histories or unrequested clinical documents. State the functional requirement at the least detailed level that allows the request to be assessed, then follow the responsible recipient's instructions if more information becomes necessary.

What Broker Partners may see before acceptance

According to the current policy, the operational content of a Flight Request is shared with the Broker Partner or Partners to whom it is referred. This can include flight details, dates, times, passenger count, cargo specifications and special requirements. The separate contact fields listed in the policy, including name, email address, telephone number, company name, VAT identification number, billing address and country, are withheld from Broker Partners until a proposal from one of them is accepted.

Withheld contact fields are not the same as anonymous data. A distinctive itinerary, corporate reference, unusual requirement, attachment or message may identify a person or allow a recipient to infer the client. Read the entire request as the recipient will see it. Remove identity from the operational narrative whenever the assessment does not require it; the separate fields alone are not enough.

Messages, proposals and authorized IONA JETS access

The Terms describe an access model in which each Broker Partner sees the proposal and conversation associated with that Broker Partner, not competing proposals or conversations. Authorized IONA JETS personnel may access request, proposal and message content for support, supervision, dispute resolution and quality-control purposes and may intervene under the visible identity "IONA JETS." These controls define intended access within the Platform; what a recipient may infer, copy or process after disclosure falls outside them.

The Terms also allow IONA JETS to review, moderate or edit a request, including removing or redacting direct contact details inserted into free-text fields in a way that conflicts with the referral process. Redaction is a governance measure, not a reason to place unnecessary identifiers in the request.

What changes after a proposal is accepted

Acceptance releases the contact details identified in the policy to the selected Broker Partner so the client and that partner can communicate and move toward contracting. It does not itself confirm the proposed aircraft, operator, flight, price or services. The selected Broker Partner sources an operator, finalizes the flight contract and payment arrangements, and coordinates the agreed mission within its contractual scope. The operator retains operational control.

From that point, communication, negotiation, contracting, payment, execution, changes, cancellation and disputes are handled directly under the selected Broker Partner's terms and the other applicable documents. The Broker Partner may request passenger, travel-document, payment, health, cargo or service data and may pass necessary information to an operator, airport, handler, authority or provider. The separate guide explains what a private-jet charter broker does. Before sending further data, read the selected party's privacy information and confirm the intended recipient.

IONA JETS does not negotiate the flight contract, receive the flight payment, operate the aircraft or determine every downstream party's purposes and retention practices. Its Privacy Policy governs the processing for which it is responsible, not every processing operation in the wider charter chain.

Shared access is a separate disclosure

An invited Shared User can see the information associated with the request, including its details, Broker Partner proposals, attached documents, message history and the email addresses of associated users. Under the current Terms, a Shared User can also accept a proposal, invite or remove other users and exercise the other permissions assigned by the shared-access model. Granting access is therefore a material disclosure, not a viewing convenience.

Before inviting a colleague or adviser

• Verify the email address, the person's authority and the business need for access.
• Assume the person will see the whole request record, not only one document or message.
• Explain that accepting a proposal releases the client's contact details to the selected Broker Partner.
• Review access when a role or project ends, particularly for group and event travel programs.
• Remember that revoking Platform access does not recall files, screenshots, emails or information already received outside the Platform.

A removed user loses future access through the Platform, but messages already sent may remain in the conversation record for other participants and copies already obtained cannot be remotely recovered. Share only what every authorized participant genuinely needs.

Service providers, international processing and sale

The Platform relies on providers for functions such as hosting and content delivery, database and authentication services, messages and file storage, transactional email, consent-based analytics, optional maps, WhatsApp communications, automated assistance and subscription payments. The current Privacy Policy names those providers and describes the data, locations, roles and safeguards stated for each. Some may process data on instructions from IONA JETS, while others may act independently for specified functions. Consult the live list rather than treating this article as a permanent vendor register.

The policy states that data may be processed outside Switzerland and the European Economic Area in connection with technical providers and globally operating Broker Partners. It identifies adequacy, Standard Contractual Clauses, the EU-US and Swiss-US Data Privacy Frameworks, and other recognized mechanisms as potential safeguards where applicable. The Swiss Federal Data Protection and Information Commissioner explains the conditions for cross-border disclosure. A transfer mechanism addresses a legal condition; operational, recipient and jurisdictional risk remain.

Not selling data is not the same as never disclosing it

IONA JETS states that it does not sell, rent, trade or otherwise commercially transfer personal data for marketing, advertising or purposes unrelated to the referral service, and that it does not purchase personal data from outside data brokers. Data may nevertheless be disclosed to the Broker Partners receiving a request, the selected Broker Partner, Shared Users, technical providers, authorities and other parties in the circumstances described in the policy. The distinction matters: a service-related disclosure is still a disclosure.

Calls, WhatsApp, email and cookies create separate records

The current policy states that calls to IONA JETS telephone numbers are handled by an automated assistant and recorded, with callers informed before recording and able to use another channel. It also states that the recordings are used for the purposes listed there and are not used to train artificial intelligence models. WhatsApp messages sent to the IONA JETS business number are handled by an automated assistant that identifies itself in its first reply. The policy instructs users not to send payment data, identity documents or sensitive clinical information through that channel.

Transactional email delivery, inquiry forms and optional services create different data flows. A notification service may receive an email address, first name and contextual reference; an inquiry form may create a record of the question and page; an external map or WhatsApp conversation can involve a provider acting under its own terms. Choose the channel according to the information, not only convenience.

Cookies, browser storage and similar technologies are covered by the Cookie Policy. The Privacy Policy states that optional analytics and external services follow the applicable consent choices and that preferences can be changed using "My Choices" in the footer. The presence of a consent tool is not itself evidence that every configuration is legally compliant; the live behavior and applicable law remain decisive.

Retention, account deletion and audit records

The policy publishes different periods because the purposes and legal constraints differ. As checked on 30 July 2026, Flight Request data, Client Portal messages, proposals and shared-access records were generally retained for three years, measured from the relevant interaction, submission or action. Audit-log entries use a five-year period. Call recordings and WhatsApp conversation content use twelve months, analytics uses the configured fourteen-month period, inquiry data uses twenty-four months from the last interaction, and transactional email delivery logs may remain with the provider for up to thirty days.

Where a request has an accepted Broker Partner proposal, limited transaction records may be retained for ten years from the end of the relevant year for the Swiss accounting purpose stated in the policy. These figures are a dated summary, not a universal rule. The live policy defines each category, starting event and exception.

A registered user may schedule account deletion in the Client Portal or contact IONA JETS. The published process includes a thirty-day grace period. If there is no request with an accepted proposal, the account and associated data are scheduled for deletion within the stated period. If an accepted proposal exists, identifying fields may be anonymized while limited transaction and audit records remain for their applicable retention periods. Deletion can therefore produce erasure, anonymization or continued retention depending on the record and legal basis.

The policy describes audit logs as records of defined actions that ordinary users cannot edit and that are protected by access controls. This article does not call them technically immutable, exhaustive or legally conclusive. Logging supports traceability without proving that every relevant event was captured or that every form of alteration is impossible.

Assess security claims as risk controls, not guarantees

The policy describes technical and organizational measures designed to protect Platform data. Depending on the system, it refers to encrypted transmission, infrastructure encryption at rest, access controls, password hashing, time-limited credentials, security headers, logging and vulnerability review. This article reports those statements. It is not an independent penetration test, deployment audit or security certification.

The Swiss authority and the European Data Protection Board both describe security as risk-based and requiring continued review. No electronic service is completely secure. Confidentiality, integrity or availability can be affected by compromised credentials, human error, malicious activity, provider failure or another incident.

• Use a unique password and protect the email account used for sign-in links and notifications.
• Review Shared Users and remove access that is no longer needed.
• Do not upload sensitive documents before the responsible recipient requests them.
• Confirm unexpected document or payment requests through a channel already known to you.
• Report suspected unauthorized access or an incorrect recipient promptly to IONA JETS and the relevant contractual party.

Applicable law and the rights described in the policy

IONA JETS is established in Geneva, and its processing is subject to the Swiss Federal Act on Data Protection. The General Data Protection Regulation applies where its territorial and material conditions are met, not simply because a user is European or a flight touches Europe. Broker Partners, operators, authorities and providers may also be subject to other laws for their own processing.

The current policy describes rights that may include access, rectification, erasure, restriction, portability, objection and withdrawal of consent, together with complaint routes to the competent authority. Their availability and outcome depend on the applicable law, the processing, identity verification and exceptions such as legal retention. California residents may have the additional rights described in the policy. The Swiss authority provides general guidance on asserting data-protection rights.

Registered users can use account tools to export certain account data, correct profile details, schedule deletion and cancel a pending Flight Request before a proposal has been accepted. The policy also gives the contact route for requests that cannot be completed through self-service. A request concerning processing performed independently by a Broker Partner or another party should be directed to that party.

Privacy checklist before submitting a request

• Purpose: Is each data item necessary for the current assessment or merely convenient to include?
• Recipient: Who will see the request now, and who may receive information after selection?
• Free text: Do the narrative, filenames or attachments reveal a name, employer or other identifier?
• Third-party data: Are you authorized to share it, and has the person received the required information?
• Sensitive information: Can a functional requirement be stated without a diagnosis or complete medical record?
• Shared access: Does every invited person need the entire request and authority to accept a proposal?
• Channel: Has the responsible recipient confirmed where a requested document should be sent?
• Policy version: Have you checked the current Privacy Policy, Cookie Policy and relevant downstream notice?

About this guide

This guide was written by Dimitri Memleb, founder of IONA JETS. The statements about the Platform, published data flows and retention periods were checked against the IONA JETS Privacy Policy and Terms of Service on 30 July 2026. The legal context was checked against the primary sources linked above. No specialist review is represented unless a qualified, named person has actually completed it.

The method follows the data journey of a charter request from creation to referral, proposal acceptance, downstream contracting, retention and rights. It separates direct contact fields from operational content, Platform processing from independent downstream processing, and stated security controls from verified guarantees. It does not infer a universal legal role from a contractual label.

This guide provides general information and does not constitute legal, regulatory, cybersecurity or data-protection advice. The Privacy Policy and Terms of Service remain the applicable IONA JETS documents. A person's rights and a party's obligations depend on the facts, jurisdiction and documents in force.

From referral to direct contracting

The IONA JETS referral process can be understood in four data stages. The Booking Process guide remains the reference for the interface and overall sequence:

1. Submit the operational brief through the Client Portal. IONA JETS receives the account, contact and request data described in the current Privacy Policy.
2. Participating Broker Partners may assess the mission. They may receive the operational request content made available for assessment, while the separate contact fields identified in the policy remain withheld before acceptance. Participation and proposals are not guaranteed.
3. Compare and select a proposal. The client decides whether to continue. Submitting a request does not commit the client to book, and selection does not confirm the aircraft or flight.
4. Continue with the selected Broker Partner. The contact details are disclosed for direct communication and contracting. The selected Broker Partner sources an operator, finalizes the flight contract and payment arrangements, and coordinates within its contractual scope. The operator retains operational control.

IONA JETS does not charge clients a platform fee for its standard referral service. IONA JETS may be remunerated by a Broker Partner when a referred request results in a confirmed booking. Broker Partners retain pricing autonomy, and IONA JETS does not publish a commission rate or amount.

Ready to prepare a charter request? Start with the route, dates, passenger or cargo profile, baggage and essential service requirements. Leave unrelated personal data and unrequested documents out of free-text fields, then review the complete request before choosing the form that matches the mission: private aviation, group and airline charter, or air cargo. Consult the current Privacy Policy before submitting.