Data Processing Agreement

apron:pilot provides the Controller with the apron:pilot application in accordance with the Terms of Use and, for paid modules, the Terms of Service (hereinafter the Main Agreement). In doing so, apron:pilot processes on the Controller's behalf personal data that the Controller records in the application about its members and other persons.

This agreement applies for the entire duration of the Controller's use of the application and ends with the deletion of the group.

The agreement is concluded when an administrator accepts it on behalf of the group: at registration or, for existing groups, at the next login of an administrator. The administrator thereby confirms that they are authorised to represent the group. The acceptance of one administrator applies to the whole group.

In the event of contradictions, the provisions of this agreement take precedence over those of the Main Agreement in matters of data protection.

Purpose: provision, operation, maintenance, backup and support of the application for organising the Controller's flight operations, members, aircraft, invoicing and training.

Nature of the processing: collecting, storing, organising, displaying and evaluating within the functions of the application, sending e-mails, transmitting to destinations specified by the Controller (e.g. exports to SFTP or WebDAV destinations), backing up, restoring and deleting.

Categories of data subjects: members of the group (administrators, users, instructors, examiners, student pilots), emergency contacts of the members, invoice recipients and other persons the Controller records in the application (e.g. speakers, course participants).

Categories of personal data: depending on use and subscribed modules, in particular

1. master and contact data of the members: name, e-mail address, address, telephone numbers, profile picture, role and functions, customer number, billing address, notification settings, last login to the group,
2. emergency contacts,
3. ratings, check flights and information on medical certificates (type and validity),
4. reservations including the waiting list and calendar subscription,
5. logbook and flight data: flights, times, aerodromes, pilot, supervising instructor,
6. data on aircraft, maintenance and defects including the reporting person,
7. information, messages and NOTAMs,
8. invoicing data: invoices, credit notes, bank details, payment runs (SEPA),
9. training data (TRAINING module): student files, training status, learning points, assessments, debriefings, feedback, courses, sessions, acceptances and declines, attendance, announcements, documents and files, exports,
10. e-mails of the application to the members, with recipients, subject, time and delivery status.

Special categories: Information on medical certificates may be health data within the meaning of Art. 9 GDPR. apron:pilot protects it with the measures described in Annex 2, in particular through encryption and role-based access. The Controller is responsible for the existence of a legal basis.

Place of processing: Processing takes place in the European Union. Processing in third countries only takes place through the sub-processors listed in Annex 1 and only under the conditions of Art. 44 et seq. GDPR.

The Controller is responsible for the lawfulness of the processing, in particular for recording the data of its members and other persons lawfully, informing them and, where necessary, obtaining consents, such as that of the parents or legal guardians of minor users.

Through its settings in the application, the Controller determines who within the group sees and edits which data, and assigns roles and functions with care.

The Controller informs apron:pilot without undue delay if it detects errors or irregularities in the processing.

apron:pilot processes the data only on documented instructions from the Controller, unless apron:pilot is required to process it by Union or Member State law; in that case, apron:pilot informs the Controller of that legal requirement before processing, unless that law prohibits such information.

If an authority or a court demands that apron:pilot disclose data of the Controller, apron:pilot informs the Controller without undue delay, where legally permitted, and refers the authority to the Controller.

The Controller's instructions are conclusively laid down in this agreement and in the Main Agreement and are given by using the functions of the application (e.g. recording, changing, deleting, exporting data, settings). Further instructions are given by an administrator by e-mail to dataprivacy@apron-pilot.com. apron:pilot carries out instructions that go beyond the scope of services of the Main Agreement against payment for the effort, after sending a quote in advance and receiving the Controller's consent.

If apron:pilot considers that an instruction infringes data protection provisions, apron:pilot informs the Controller without undue delay and may suspend its implementation until it is confirmed or changed.

Confidentiality: apron:pilot ensures that all persons who have access to the data are committed to confidentiality in writing before taking up their activity or are under a statutory obligation of confidentiality. The commitment continues after the end of their activity. Currently, only the owner of apron:pilot has access.

Security: apron:pilot takes the technical and organisational measures pursuant to Art. 32 GDPR described in Annex 2. apron:pilot may adapt these measures to the state of the art, provided the level of protection is not reduced.

Access to data: apron:pilot only accesses the Controller's data insofar as this is necessary for operation, troubleshooting, backup or a support request from the Controller.

Record: apron:pilot keeps a record of processing activities pursuant to Art. 30(2) GDPR.

Use for own purposes: apron:pilot does not use the data for its own purposes. An exception is the evaluation in anonymised and aggregated form pursuant to point 5.5 of the Terms of Use, which does not allow any conclusions about individual groups or persons.

Rights of data subjects: apron:pilot assists the Controller in fulfilling requests for access, rectification, erasure, restriction, data portability and objection primarily through the functions of the application (editing, deleting, exporting). apron:pilot designs the application so that the Controller can fulfil these requests within the statutory deadlines. If a data subject contacts apron:pilot directly, apron:pilot forwards the request to the Controller without undue delay and informs the data subject of this. apron:pilot provides assistance going beyond the functions of the application against payment for the effort and after sending a quote in advance.

Personal data breaches: apron:pilot informs the Controller without undue delay, at the latest within 72 hours after becoming aware of a personal data breach, by e-mail to the administrators and to the office e-mail address of the group. The information contains, as far as known, the nature and extent of the breach, the categories of data and persons concerned, the likely consequences and the measures taken. Information not yet available is provided subsequently.

Taking into account the nature of the processing and the information available to it, apron:pilot assists the Controller in complying with its obligations under Art. 32 to 36 GDPR: security of processing, notification of personal data breaches to the supervisory authority, communication to the data subjects, data protection impact assessment and prior consultation of the supervisory authority. apron:pilot provides assistance going beyond the information under point 6.2 and the functions of the application against payment for the effort and after sending a quote in advance.

The Controller consents to the use of the sub-processors listed in Annex 1. apron:pilot contractually binds each sub-processor to data protection obligations corresponding to this agreement. If a sub-processor fails to fulfil its data protection obligations, apron:pilot remains liable to the Controller for the performance of these obligations (Art. 28(4) GDPR).

apron:pilot informs the administrators by e-mail at least 14 days in advance before a new sub-processor is engaged or an existing one is replaced. If the change has to be made at short notice due to an error, an outage or for security reasons, apron:pilot informs them without undue delay.

The Controller may object to the change for an important reason under data protection law within 14 days of the information by e-mail to dataprivacy@apron-pilot.com. In the event of an objection, the Controller may end the use of the application and this agreement free of charge; for ongoing subscriptions, the fee for the remaining term is refunded pro rata.

Service providers that have no access to personal data (e.g. for monitoring availability) are not sub-processors.

On request, apron:pilot provides the Controller with all information necessary to demonstrate compliance with this agreement, in particular this description of the technical and organisational measures, the list of sub-processors and their certifications and evidence (e.g. the ISO/IEC 27001 certification of the data centre operator).

The data is processed exclusively in the data centres of the sub-processors; apron:pilot does not maintain any premises of its own in which data is processed or stored. Audits are therefore carried out by providing information and evidence pursuant to point 8.1. Further audits, for example by an auditor commissioned by the Controller and bound to confidentiality, must be agreed in writing; the costs are borne by the Controller.

The Controller can retrieve its data at any time during use with the export functions of the application in common formats (e.g. CSV, Excel, PDF). After the end, it can choose whether its data is deleted or returned to it beforehand; the return takes place via these export functions and, for the TRAINING module, additionally in accordance with point 10.3 of the Terms of Service. apron:pilot provides any return going beyond this against payment for the effort and after sending a quote in advance.

After the end of use – through deletion of the group at the request of an administrator, through deletion due to inactivity (point 3.8 of the Terms of Use) or through termination of free use (point 3.6 of the Terms of Use) – apron:pilot deletes all personal data of the Controller, unless there is a legal obligation to retain it. For the end of paid modules, the Terms of Service additionally apply.

The data is removed from the backups when their retention period expires, at the latest after 12 months. Until then, it is only accessed to restore the entire system.

On request, apron:pilot confirms the deletion by e-mail.

Liability is governed by point 6 of the Terms of Use, unless Art. 82 GDPR mandatorily provides otherwise.

apron:pilot notifies the administrators of changes to this agreement; they take effect when an administrator accepts them at their next login. Changes to the list of sub-processors are made in accordance with point 7.

Controllers outside the EU: If the Controller has its registered office in Switzerland, this agreement also constitutes an agreement on processing by a processor pursuant to Art. 9 of the Swiss Federal Act on Data Protection (FADP). References to the GDPR are to be read as references to the corresponding provisions of the FADP; the competent supervisory authority in this respect is the Federal Data Protection and Information Commissioner (FDPIC). For Controllers with their registered office in the United Kingdom, this applies accordingly to the UK GDPR.

Austrian law applies. In all other respects, the final provisions of the Terms of Use apply. Should a provision of this agreement be invalid, the remaining provisions remain valid.