Privacy Notice (GDPR)

1. Data controller

This notice explains how we process your personal data under the EU General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).

2. Data we process

• Identity: first name, last name
• Contact: e-mail address, phone number
• Address: street address, city, postal code, country
• Profile photo (optional): a small image you upload yourself; only you can see it, and you can remove it at any time
• Account security: a one-way hashed password (we never store your password in readable form)
• Preferences: the colour theme you choose while signed in, so the site looks the same on every device you sign in on
• Consent records: the date, time and version of the privacy notice you accepted, and your marketing preference

Website membership does not include any academic, enrolment, attendance or assessment records.

3. Purposes and legal basis

• Creating and managing your member account — performance of a contract (GDPR art. 6(1)(b))
• Answering your questions about our training programmes — steps prior to entering into a contract and our legitimate interest (GDPR art. 6(1)(b) and (f))
• Keeping proof of consent and securing the website — legal obligation and legitimate interest (GDPR art. 6(1)(c) and (f))
• Sending news and course announcements — only with your separate, optional consent (GDPR art. 6(1)(a))
• Showing your optional profile photo in your account — your own choice to upload it, which you can undo at any time (GDPR art. 6(1)(a))

4. Retention

Account data is kept while your account is active. When you delete your account, your profile is erased immediately. A pseudonymised consent record (without your name or contact details) is kept for up to 5 years to demonstrate compliance.

5. Sharing and transfers

We do not sell your data and do not share it with third parties, except with hosting providers acting on our instructions (processors) or where required by law. Data is hosted within the European Economic Area. If data were ever transferred outside the EEA, we would only do so with appropriate safeguards, such as the European Commission's standard contractual clauses. To keep automated sign-ups away, the registration and password-reset forms use Cloudflare Turnstile, a security check that processes technical data such as your IP address and browser characteristics on our behalf (legitimate interest, GDPR art. 6(1)(f)); it does not set advertising cookies.

6. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection (GDPR art. 15–21), and the right to withdraw your consent at any time without affecting processing carried out before the withdrawal (GDPR art. 7(3)). You can edit, download or delete your data from your account page, or contact [email protected]. We respond within one month.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl).

7. Cookies

We use only strictly necessary cookies: a secure session cookie to keep you signed in, and preference cookies for colour theme and sidebar state. These do not require consent. We do not set tracking or advertising cookies ourselves.

Aviation videos on the home page come from YouTube (Google Ireland Ltd.). While you browse, the preview images are delivered by our own server, so no connection to YouTube is made. Only when you press play is the video loaded in YouTube's privacy-enhanced mode (youtube-nocookie.com): Google then receives technical data such as your IP address and may store information in your browser; Google's privacy policy applies, and data may be transferred to the United States under the EU–US Data Privacy Framework. Playing a video is your own choice; if you do not press play, no data is sent to YouTube.

The Contact Us page can show a map of our office from Google Maps (Google Ireland Ltd.). The map is only loaded when you press “Show map”: Google then receives technical data such as your IP address and may store information in your browser; Google's privacy policy applies, and data may be transferred to the United States under the EU–US Data Privacy Framework. The links “Open in Google Maps” and “Get directions” open Google's own website. If you do not load the map, no data is sent to Google.

8. Required data and automated decisions

The data marked as required on the registration form is needed to create your account; without it we cannot provide one. We do not use automated decision-making or profiling.

9. Acknowledgement

By ticking the box on the registration form, you confirm that you have read this notice. Your account data is processed to provide your account, not on the basis of consent; marketing e-mails are only sent if you separately opt in.