Version 1.1 — 4 October 2026
This policy explains what Triple Seven Aviation Services S.A.L. ("Triple Seven", "we") does with personal data submitted through this website. We provide flight-support services — overflight and landing permits, fuel, ground handling, charter, air ambulance coordination, dispatch and crew logistics — and delivering them requires handling information about operators, crews and, in medical flights, patients.
We are the data controller for that information. It is governed by Lebanese Law No. 81 of 2018 on Electronic Transactions and Personal Data, and, where we serve customers in the European Economic Area, by the EU General Data Protection Regulation (GDPR).
| Category | Examples | When |
|---|---|---|
| Contact details | Name, company, email address, telephone number | Every request |
| Operational details | Aircraft type and registration, callsign, routing, dates and times, passenger and cargo figures, fuel quantities | Most requests |
| Operator documents | Air Operator Certificate, Certificate of Registration, Certificate of Airworthiness, insurance certificates, operations specifications, noise certificates | Permit and dispatch requests |
| Crew and passenger data | Crew lists, passport copies, nationalities, General Declarations, passenger manifests | Permits, handling, crew and visa services; Beirut meet & assist (the lead passenger's name only) |
| Health data | Patient condition, diagnosis and medical summary, medical reports, fit-to-fly certificates, medical equipment required | Air ambulance requests only |
| Commercial details | Fleet information, insured values, operating profile, claims history | Insurance introductions |
| Partner details | Company details, licences and approvals held, insurance, references, a 24/7 contact | Trade and station partner applications |
| Mission ratings | Stars (1 to 5) and an optional comment | Only if you rate a completed mission in the client portal |
If you rate a completed mission in the client portal, we keep your stars and comment with that mission's reference. Only our operations team sees them; we never publish them.
Our hosting provider records standard technical data such as IP address, browser type and the pages requested, for security and to keep the service running. We do not use advertising cookies or third-party trackers, and we do not profile visitors.
Medical information submitted for an air ambulance request is special category data under GDPR Article 9 and sensitive data under Lebanese law. We ask for it only because a medical transfer cannot be arranged without it — the aircraft, medical crew and equipment are selected from the patient's condition. We handle it strictly as described below, and we ask you not to send medical information for any other type of request.
| Purpose | Legal basis (GDPR) |
|---|---|
| Preparing quotes and delivering the service you requested | Performance of a contract, or steps taken at your request before entering one — Article 6(1)(b) |
| Submitting applications to civil aviation authorities and airports on your behalf | Contract performance, and compliance with legal obligations that apply to flight operations — Article 6(1)(b) and 6(1)(c) |
| Arranging fuel, handling, catering, hotels and transport with suppliers | Contract performance — Article 6(1)(b) |
| Coordinating an air ambulance flight, including medical information | Explicit consent — Article 9(2)(a); or where the patient cannot give consent, protection of vital interests — Article 9(2)(c) |
| Keeping records of missions we have handled | Legal obligation and our legitimate interest in maintaining operational and accounting records — Article 6(1)(c) and 6(1)(f) |
| Security, fraud prevention and keeping the site available | Legitimate interests — Article 6(1)(f) |
Under Lebanese Law 81/2018 we process personal data lawfully and transparently, only for the specific purposes described here, only to the extent necessary, and no longer than needed.
Flight support cannot be delivered without passing information to third parties. Depending on what you ask us to arrange, we may disclose the relevant parts of your request to:
We share only what is necessary for the task. We do not sell personal data, and we do not share it for marketing.
Triple Seven operates from Lebanon and the United Arab Emirates, and this website is hosted on infrastructure operated by Cloudflare. Requests submitted here are therefore stored and accessed outside the European Economic Area, and the authorities and suppliers we deal with are located worldwide, including in countries the European Commission has not found to provide an adequate level of protection.
Where we transfer data of people in the EEA, we rely on Chapter V of the GDPR: appropriate safeguards such as Standard Contractual Clauses with our processors, or, for transfers to aviation authorities that are necessary to obtain a permit for your flight, the derogations in Article 49 — the transfer being necessary to perform the contract you asked us to carry out. Under Lebanese law, transfers are made where the recipient offers adequate protection, or with your consent, or where otherwise permitted.
| Data | Retention |
|---|---|
| Mission records and correspondence | For the duration of the business relationship and then as required for accounting, tax and aviation record-keeping obligations |
| Operator documents (AOC, insurance and similar) | Until they expire or are superseded, and then for the record-keeping period above |
| Crew and passenger documents, including passport copies | Only as long as needed to complete the mission and satisfy the authority that required them |
| Medical information | Deleted once the medevac mission is complete and any related billing or insurance matter is closed, unless we are legally required to keep it |
| Enquiries that do not lead to a mission | A limited period, then deleted |
Exact periods will be confirmed with our advisers before this policy takes effect.
Under both Lebanese Law 81/2018 and the GDPR you may:
Write to Operations@triple7.aero and we will respond within one month. There is no charge. If you are in the EEA and are unhappy with our response, you may complain to your national data protection authority; in Lebanon, the Ministry of Economy and Trade oversees Law 81/2018.
No system is perfectly secure. If a breach occurs that is likely to present a risk to people, we will notify the competent authority and, where required, the individuals affected.
This is a business service and is not directed at children. We only receive information about a minor where it is provided by an operator, a family member or a medical provider in connection with a flight — most commonly a patient on a medical transfer — and we treat it with the same protection as other sensitive data.
If we change this policy we will update the version and date at the top. Material changes affecting how we use existing data will be notified to affected customers directly.
Questions about this policy, or requests about your data, go to Operations@triple7.aero, or by post to our head office at the address in the footer below. If we appoint a Data Protection Officer — which Lebanese law expects for large-scale or sensitive processing — their details will be published here.