Privacy and Data Protection Notice

New Bridge AeroFinance Limited

Last updated: 12 September 2026

This Privacy Notice explains how New Bridge AeroFinance Limited ("we", "us", "our") collects, uses, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

Important information and who we are

Data controller

New Bridge AeroFinance Limited is the data controller responsible for your personal data.

Company Registration Number: 17437819

Registered Office Address: 4th Floor, 140 Aldersgate Street, London, EC1A 4HY, United Kingdom.

Information Commissioner's Office (ICO) Registration Number: to be confirmed (application no. C2030977).

Contact details

If you have any questions about this Privacy Notice or our data protection practices, please contact our Data Protection Lead:

Contact Title / Name: William Glaister

Email: notices@newbridgeaero.com

The personal data we collect

We may collect, use, store, and transfer different kinds of personal data about you, categorized as follows:

  • Identity Data: First name, last name, title, date of birth, job title, and company name.
  • Contact Data: Billing address, delivery address, email address, and telephone numbers.
  • Financial Data: Bank account and payment card details (where applicable for transactions).
  • Transaction Data: Details about payments to and from you, and details of products or services purchased from us.
  • Technical Data: Internet protocol (IP) address, login data, browser type and version, time zone setting, browser plug-in types, operating system, and platform.
  • Usage Data: Information about how you use our website, products, and services.
  • Marketing and Communications Data: Your preferences in receiving marketing from us and your communication preferences.

We do not routinely collect any Special Category Data (e.g., details about race, ethnicity, religious beliefs, sexual orientation, health information) or criminal conviction data, unless strictly necessary and with explicit statutory justification or consent.

How we collect your personal data

We use different methods to collect data from and about you, including:

  • Direct Interactions: You provide Identity, Contact, and Financial Data by filling in forms, corresponding with us by phone, email, post, or entering into contracts with us.
  • Automated Technologies: As you interact with our website, we automatically collect Technical Data about your equipment, browsing actions, and patterns via cookies, server logs, and similar technologies.
  • Third Parties or Publicly Available Sources: We may receive personal data about you from third parties, including analytics providers (such as Google Analytics), credit reference agencies, Companies House, and electoral registers based inside the UK.

Lawful bases and purposes for processing

Under UK GDPR, we must have a valid lawful basis to process your personal data. We rely on the following bases:

  • To register you as a new customer/client. Data: Identity, Contact. Lawful basis: Performance of a contract with you.
  • To deliver services/products and process payments. Data: Identity, Contact, Financial, Transaction. Lawful basis: (a) Performance of a contract; (b) Necessary for our legitimate interests (payment collection).
  • To manage our relationship with you (notices, updates). Data: Identity, Contact, Marketing/Comms. Lawful basis: (a) Performance of a contract; (b) Compliance with a legal obligation.
  • To administer and protect our business and website (troubleshooting, system maintenance). Data: Identity, Contact, Technical. Lawful basis: (a) Legitimate interests (running our business, network security); (b) Compliance with a legal obligation.
  • To deliver relevant marketing communications. Data: Identity, Contact, Usage, Marketing/Comms. Lawful basis: (a) Legitimate interests (business growth); (b) Consent (where legally required under PECR).
  • To comply with legal and regulatory duties (e.g., HMRC, fraud prevention). Data: Identity, Contact, Financial, Transaction. Lawful basis: Compliance with a legal obligation.

Disclosures of your personal data

We may share your personal data with selected third parties who act as data processors or independent data controllers:

  • Service Providers: IT, cloud hosting, software, and system administration services.
  • Professional Advisers: Lawyers, bankers, auditors, and insurers providing consultancy, legal, banking, and accounting services.
  • Regulators and Authorities: HM Revenue & Customs (HMRC), the Financial Conduct Authority (FCA), the Information Commissioner’s Office (ICO), and law enforcement authorities where required by law.
  • Corporate Transactions: Third parties to whom we may choose to sell, transfer, or merge parts of our business or assets.

All third-party service providers are required to respect the security of your personal data and treat it in accordance with the law.

International data transfers

If we transfer your personal data outside the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

  • Transferring data to countries deemed by the UK Government to provide an adequate level of protection for personal data.
  • Using specific contracts approved for use in the UK, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs).

Data security and retention

Security

We have put in place appropriate technical and organizational security measures to prevent your personal data from being accidentally lost, used, altered, disclosed, or accessed in an unauthorized way. Access to your data is strictly limited to employees, agents, contractors, and other third parties on a business need-to-know basis.

Retention period

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, tax, or regulatory reporting requirements.

  • Statutory Records & Accounting Data: Retained for a minimum of 6 years following the end of the financial year to comply with UK tax and company law requirements.
  • Contractual Records: Retained for up to 6 years after contract termination (in line with standard UK limitation periods for contract claims).

Your legal rights

Under UK data protection laws, you have rights regarding your personal data:

  • Right of Access (Subject Access Request): Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete personal data.
  • Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where there is no good reason for us continuing to process it.
  • Right to Object: Object to processing based on legitimate interests or direct marketing.
  • Right to Restriction: Request the suspension of processing your personal data in certain scenarios.
  • Right to Data Portability: Request the transfer of your personal data to you or a third party in a structured, commonly used format.
  • Right to Withdraw Consent: Withdraw consent at any time where we rely on consent to process your data.

To exercise any of these rights, contact us at notices@newbridgeaero.com. We aim to respond to all legitimate requests within one calendar month.

Right to lodge a complaint

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues:

  • Website: www.ico.org.uk
  • Helpline: 0303 123 1113
  • Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the chance to address your concerns before you approach the ICO, so please contact us in the first instance.

Changes to this notice

We review and update this notice periodically. Any changes will be posted on this page with an updated revision date.