Airdeck Management — data protection declaration

1. Contact addresses

Responsible for processing of personal data:

Airdeck Management is a multi-tenant service. Each flight school or club that uses the platform is itself a controller for the personal data of its own members (pilots, instructors, mechanics). We act as a processor for that tenant data under a data processing agreement with each tenant. We are the controller only for the account-level data we need to operate the service (billing contact, support contact, platform telemetry).

Data protection representation in the European Economic Area (EEA)

Airdeck does not currently maintain an establishment in the EEA. If and when processing of personal data of individuals in the EEA reaches a scale that triggers Art. 27 GDPR, we will appoint a representative and update this declaration.

2. Processing of personal data

2.1 Definitions

Personal data means all information relating to an identified or identifiable natural person. A data subject is a natural person whose personal data is processed.

Processing means any handling of personal data — storage, disclosure, acquisition, collection, erasure, alteration, destruction and use.

2.2 Legal bases

We process personal data in compliance with Swiss data protection law, in particular the Federal Act on Data Protection (nFADP). We generally store personal data in the European Union (EU — Frankfurt) via our managed-database provider.

If and insofar as the General Data Protection Regulation (GDPR) is applicable, we process personal data according to at least one of the following legal bases:

• Art. 6(1)(b) GDPR — necessary to perform the contract with the tenant (operating the platform for the flight school) or with the individual member (operating their account inside that tenant).
• Art. 6(1)(f) GDPR — our legitimate interests in providing the service in a user-friendly, secure and reliable manner, information security, protection against misuse, and the exercise of our own legal claims.
• Art. 6(1)(c) GDPR — compliance with legal obligations applicable to the operation of a flight-school platform: aviation retention requirements (FOCA/BAZL, EASA Part-ML, FLC.050), Swiss accounting law for invoicing data.
• Art. 6(1)(a) GDPR — on the basis of consent, for example optional communications or marketing opt-ins.
• Art. 6(1)(d) GDPR — necessary to protect vital interests of the data subject or another natural person (e.g. in the event of an aviation safety incident).

2.3 Type, extent and purpose

We process the personal data that is necessary to operate Airdeck Management and to meet the regulatory obligations attached to a flight-school management platform. Depending on your role in the tenant and how it is configured, the data may fall into the following categories:

• Account and membership data: name, email address, phone number, postal address, country, locale preference, display name, your role in the tenant (pilot, instructor, mechanic, admin, …), authentication identifiers.
• Browser and device data: IP address, user-agent, referrer, access status, timestamps — in server log files (see §5.2).
• Pilot and flight data: reservations, returned flights (date, aircraft, from/to airports, block times, flight times, landings, pilot function, remarks), cross-charges to the invoice.
• Airworthiness and licence data: certifying-staff (CS) and airworthiness-review-staff (ARS) licence numbers, airworthiness-organisation membership, maintenance records, Certificates of Release to Service (CRS), Airworthiness Review Certificates (ARC) — including the signatory’s name, licence number, organisation, timestamp and IP address at the moment of signing. These snapshots are immutable; corrections are entered as new, separately-signed counter-records.
• Training data: enrolments, lessons, evaluations, instructor sign-offs on individual flights.
• Airfield movement data: departures and arrivals at the home airfield, back-filled from returned flights, visible on the airfield-manager module.
• Billing data: charges, Swiss QR-bill invoices, payment status.
• Content data: free-text remarks on reservations, techlog entries, mentions in messages, attached files (e.g. defect photos).
• Meta, peripheral and usage data: record timestamps, actor identifiers for signed records, audit-trail metadata.

We process personal data for the period required for the relevant purpose(s) or required by law. For airworthiness records (CRS, ARC, techlog entries, signed flights) the retention period follows the applicable aviation regulations — typically for the life of the aircraft or as separately required by FOCA/EASA. Account and membership data is retained for as long as the account exists; on request, account data is erased subject to any overriding regulatory retention obligations and to the tenant’s own retention policy.

As a matter of principle we process personal data only after obtaining the data subject’s consent unless processing is permissible for other legal reasons — such as to perform a contract, in response to justified requests from competent authorities (in particular the Federal Office of Civil Aviation (FOCA) and the Swiss Transportation Safety Investigation Board (STSB)), or to safeguard overriding legitimate interests.

In addition to data you provide directly, we may process personal data that reaches us via third parties — in particular when a flight-school administrator invites you as a member of their tenant, or when another tenant member mentions you in a reservation remark or techlog entry.

2.4 Processing of personal data by third parties, also abroad

We can have personal data processed by contracted third parties, or process it together with or with the help of third parties, as well as transmit this data to third parties — in particular the service providers listed in §7. Where we use such third parties, we ensure an adequate level of data protection: typically by selecting providers located in Switzerland or the EEA, by using providers covered by an adequacy decision of the Swiss FDPIC and — if the GDPR applies — the European Commission, or on the basis of EU Standard Contractual Clauses.

3. Multi-tenant data isolation

Airdeck Management is a multi-tenant service. Each tenant (flight school or club) has its own members and its own data. Access to a tenant’s data is restricted both at the application layer, by the tenant-aware authorisation model, and at the database layer, by Row-Level Security policies that filter every query by tenant. A tenant administrator can access the data of their own tenant’s members in line with the operational purpose of running the club (reservations, techlog, training, invoicing). Data is not shared across tenants.

4. Your rights

4.1 Data protection claims

You have the following rights under applicable data protection law:

• Information: request confirmation of whether we process personal data about you and, if so, what — including the purpose, retention duration, disclosures and sources.
• Correction and limitation: have inaccurate personal data corrected, incomplete data completed, and the processing of your data restricted.
• Deletion and objection: have personal data deleted and object to the processing of your data with effect for the future.
• Portability: receive your personal data in a structured, commonly used, machine-readable format.

Because tenants are controllers for their members’ data, requests from a tenant member should normally be addressed to the tenant administrator first. We will forward requests to the responsible tenant and support both sides where needed.

We may suspend, restrict or refuse the exercise of these rights to the extent permitted by law. In particular, we may refuse to delete personal data that we are required to retain under aviation regulations (airworthiness records, signed logbook entries, CRS, ARC).

4.2 Right to complain

You have the right to enforce your data protection claims through legal channels or to lodge a complaint with a competent data protection supervisory authority. The authority for private data controllers in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC). If and to the extent the GDPR applies, you may also lodge a complaint with a competent European data protection supervisory authority.

5. Data security

We take appropriate technical and organisational measures to ensure data protection and data security. These include transport encryption (SSL/TLS, via HTTPS) for all traffic; access controls at the application and database layer; signed and immutable audit snapshots for airworthiness- relevant records; daily encrypted backups and point-in-time recovery of our managed database; and role-based authorisation enforced at both the application and the database layer. Despite these measures, no system is absolutely secure, and we cannot guarantee absolute data security.

6. Use of the website

6.1 Cookies and local storage

We use the smallest set of cookies and comparable local storage necessary to run the platform. We do not use advertising or tracking cookies.

• Authentication cookies (strictly necessary) — set by our authentication provider to keep you signed in. Removing them signs you out.
• UI preferences — your theme, calendar view and hidden-aircraft filters stored in your browser’s localStorage / sessionStorage.

We do not currently use third-party analytics, advertising or marketing cookies. If we add any in the future, we will update this declaration and ask for consent via a cookie banner.

6.2 Server log files

Each time you access the platform we may log the following information insofar as your browser transmits it or our infrastructure identifies it: date and time including time zone; IP address; HTTP status code; user-agent (operating system, browser and version); the pages that were retrieved including the transmitted data volume; and the referring page. This information is necessary to provide the service reliably and to detect and investigate security issues.

7. Notifications and messages

We send transactional notifications by email — for example when a reservation is created or cancelled, when a maintenance block affects your booking, when you are mentioned in a techlog entry, or when an invoice is issued. These notifications are necessary for the operation of the service.

Non-essential notifications can be adjusted or disabled from your account settings. We do not currently operate a marketing newsletter; if we introduce one, it will use a double-opt-in consent flow and provide a one-click unsubscribe link.

7.1 Service provider for notifications and messages

Transactional email is relayed via Register.it (Register.it S.p.A., Italy — authenticated SMTP at authsmtp.register.it), acting as a data processor for us. The message body, subject and recipient address are shared with the provider for the sole purpose of delivering the message. Register.it is located in the European Union; no additional transfer safeguards are required.

8. Third-party services

We use services provided by specialised third parties in order to run Airdeck Management durably, securely and reliably.

8.1 Digital infrastructure

• Vercel — application hosting and content delivery network. Provider: Vercel Inc. (USA), with request routing optimised for the user’s region. Transfers outside the EEA are covered by Vercel’s GDPR data processing addendum and EU Standard Contractual Clauses. See Vercel privacy policy.
• Supabase — managed PostgreSQL database, authentication, and object storage. Provider: Supabase Inc. (USA), operating infrastructure in the EU (Frankfurt region). Tenant data, signatures and pilot logbook entries are stored on this infrastructure. See Supabase privacy policy.
• Register.it — domain and transactional email relay for airdeck.ch addresses. Provider: Register.it S.p.A. (Italy). See Register.it privacy information.

8.2 Maps

Airdeck Management uses map tiles from the OpenStreetMap Foundation (OSMF, United Kingdom) to render airfield locations and the fleet map. When a map is opened, your browser connects to infrastructure operated by or on behalf of OSMF. OSMF processes personal data as an independent controller; further information is available in the OSMF privacy policy. The legal basis for our processing in this context is Art. 6(1)(f) GDPR, with our legitimate interest being to provide reliable map-based functionality.

9. Concluding provisions

We may adjust or supplement this data protection declaration at any time. We will provide notification of such adjustments in an appropriate form — in particular by publishing the updated declaration on this page.