Data Protection & GDPR Information

Last updated: April 04, 2026

This page provides additional information about how personal data is processed on the Aviation OJT Trace platform, with a focus on compliance with the EU General Data Protection Regulation (GDPR) and Italian data protection law (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018). It should be read together with our Privacy Policy and Terms of Service.

1. Data Controller and Data Processor

Aviation OJT Trace operates as a multi-tenant SaaS platform. In this context, the roles under GDPR are defined as follows:

  • Data Controller: your employer or subscribing organization — the entity that determines the purposes and means of processing its employees' personal data through the platform.
  • Data Processor: Aviation OJT Trace — we process personal data solely on behalf of and under the instructions of the Data Controller, in accordance with a Data Processing Agreement (DPA).

Each subscribing organization is responsible for ensuring it has a valid legal basis for processing its employees' data and for informing its users of this Privacy Policy.

2. Categories of Personal Data Processed

The following categories of personal data may be processed on the platform, depending on user role:

  • Identification data: full name, email address, assigned role (Candidate/Trainee, Mentor/Instructor, Manager/Quality Assurance, Administrator), company, and base/station.
  • Authentication data: username, hashed passwords, session tokens, and security logs.
  • OJT training data: task records, digital endorsements, evaluations, instructor comments, qualification statuses, and training history.
  • Branding assets: company logos uploaded for report personalization — these remain the exclusive property of the uploading organization.
  • System metadata: IP addresses, browser information, access timestamps, and audit logs.
  • Usage data: anonymized analytics used to monitor and improve platform performance.

3. Purposes of Processing

Personal data is processed for the following purposes:

  • Managing user accounts, roles, and authentication.
  • Recording, tracking, and validating OJT tasks, endorsements, and qualifications.
  • Generating personalized training reports and documentation.
  • Ensuring platform security, integrity, and audit trail maintenance.
  • Supporting Managers/Quality Assurance and Administrators in monitoring training compliance.
  • Aggregated and anonymized reporting and analytics (where permitted by the organization).
  • Complying with applicable aviation regulatory requirements regarding training records.

4. Legal Bases for Processing

Processing of personal data is carried out under one or more of the following legal bases (GDPR Art. 6):

  • Performance of a contract (Art. 6(1)(b)): processing necessary to provide the Service under the subscription agreement.
  • Legal obligation (Art. 6(1)(c)): compliance with aviation regulations and mandatory record-keeping requirements (e.g. EASA, ENAC, DGAC, AESA, and other national/international aviation authority requirements).
  • Legitimate interests (Art. 6(1)(f)): platform security, fraud prevention, and service improvement, where such interests are not overridden by the rights of data subjects.
  • Consent (Art. 6(1)(a)): where explicitly requested, such as for non-essential analytics or marketing cookies.

5. Data Recipients and Third-Party Transfers

Access to personal data is strictly limited. Recipients may include:

  • Authorized users within your organization: Trainees may access their own data; Instructors may access data of assigned trainees; HR Managers and Administrators may access organization-wide data within their tenant.
  • Third-party service providers: infrastructure providers (hosting, database, email delivery) acting as sub-processors under Data Processing Agreements, bound by GDPR-equivalent obligations.
  • Regulatory and supervisory authorities: when disclosure is required by Italian law, EU regulation, or applicable aviation authority requirements.

Data is strictly isolated per tenant. No personal data is accessible to or shared with other subscribing organizations. Any transfer of data outside the EU/EEA is carried out under appropriate safeguards (Standard Contractual Clauses or adequacy decisions) as required by GDPR Chapter V.

6. Data Retention Periods

Personal data is retained only for as long as necessary to fulfill the purposes described above or as required by applicable law. In particular:

  • Active accounts: data is retained for the duration of the subscription.
  • OJT training records: may be subject to extended retention in accordance with aviation regulatory requirements (e.g. EASA Part-ORA, ENAC rules).
  • Upon subscription termination: data is retained for a limited grace period (as defined in the subscription agreement) before being permanently and securely deleted.
  • Security and audit logs: retained for a defined period for security and compliance purposes, then deleted.

Users may request early deletion of their data, subject to any mandatory legal retention obligations that cannot be waived.

7. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR, exercisable subject to applicable conditions and limitations:

  • Right of access (Art. 15): obtain confirmation of whether your data is processed and receive a copy.
  • Right to rectification (Art. 16): request correction of inaccurate or incomplete personal data.
  • Right to erasure (Art. 17): request deletion of your data where no longer necessary or where consent is withdrawn, subject to legal retention obligations.
  • Right to restriction of processing (Art. 18): request that processing be temporarily limited under certain conditions.
  • Right to data portability (Art. 20): receive your data in a structured, machine-readable format and transfer it to another controller.
  • Right to object (Art. 21): object to processing based on legitimate interests.
  • Right to withdraw consent (Art. 7(3)): withdraw consent at any time where processing is consent-based, without affecting the lawfulness of prior processing.
  • Right to lodge a complaint: you have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of your EU country of residence.

To exercise your rights, please contact your organization's administrator in the first instance, or reach us directly via the Contact us page. We will respond within 30 days as required by GDPR.

8. Security Measures

Aviation OJT Trace implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Measures include:

  • Encrypted data transmission using TLS/HTTPS.
  • Hashed storage of user passwords (no plaintext storage).
  • Role-based access controls (RBAC) ensuring users only access data relevant to their role.
  • Tenant data isolation preventing cross-organization data access.
  • Regular security monitoring, logging, and audit trails.
  • Periodic security reviews and updates.

In the event of a personal data breach, we will notify the affected Data Controller(s) without undue delay and, where required, the Garante per la protezione dei dati personali within 72 hours, in accordance with GDPR Art. 33–34.

9. Data Processing Agreement (DPA)

As a Data Processor, Aviation OJT Trace is available to enter into a Data Processing Agreement (DPA) with subscribing organizations as required by GDPR Art. 28. The DPA governs the specific terms under which we process personal data on behalf of the Data Controller. Organizations requiring a DPA may request one via the Contact us page.

This document provides an overview of data protection practices for the Aviation OJT Trace platform and does not replace any formal Data Processing Agreement between us and your organization. For legally binding terms, please refer to your organization's contractual documents and applicable data protection legislation. This page is governed by Italian law and EU GDPR. The competent supervisory authority is the Garante per la protezione dei dati personali.