Privacy Policy

Last updated: April 18, 2026

This Privacy Policy explains how Aviation OJT Trace collects, uses, stores, and protects your personal data when you use our platform. We are committed to complying with the General Data Protection Regulation (GDPR) and other applicable international privacy laws.

1. Who We Are

Aviation OJT Trace is a multi-tenant SaaS platform designed for managing On-the-Job Training (OJT) in the aviation sector, operated by:

Barbiera Daniele (Sole Trader / Ditta Individuale)
VAT Number (P. IVA): IT05805580874
Tax Code (Codice Fiscale): BRBDNL74A02L331V
REA Number: CT-434945
Registered with the Chamber of Commerce of Catania (CCIAA di Catania)
Email: privacy@aviationojttrace.com

Your organization acts as the Data Controller, while Aviation OJT Trace (Daniele Barbiera) acts as the Data Processor.

Aviation OJT Trace processes personal data exclusively on documented instructions from the Data Controller and does not independently determine the purposes or means of processing.

2. Data We Collect

  • Full name
  • Email address
  • Date of birth
  • License number
  • User role and company
  • Login data and session logs
  • IP address, browser user-agent, and device information collected for security and audit purposes (Recital 30 GDPR)
  • Access timestamps and activity logs within the platform

3. How We Use Your Data

  • Creating and managing user accounts, including user registration and profile administration
  • Providing platform functionality
  • Authentication and access control
  • Tracking OJT training and records
  • Security, fraud prevention and audit logs
  • Compliance with aviation regulations
  • Responding to user requests and support enquiries, including handling questions, complaints, or technical support requests submitted by users or their organization

4. Legal Basis

  • Art. 6(1)(b) GDPR – Processing necessary for the performance of a contract
  • Art. 6(1)(f) GDPR – Legitimate interest (platform security, fraud prevention, service improvement)
  • Art. 6(1)(c) GDPR – Compliance with a legal obligation

5. Data Sharing

We do not sell personal data.

  • Within your organization (authorized users only)
  • Service providers (hosting, infrastructure) under appropriate Data Processing Agreements
  • Authorities when legally required

Personal data is never sold, rented, or shared with third parties for marketing or commercial purposes. Any sharing occurs strictly for the provision of the Service or where required by law, and always under appropriate contractual safeguards.

Personal data is not disclosed, transferred, or otherwise made available to third parties for purposes unrelated to the provision of the Service unless the data subject has given prior explicit consent, or such disclosure is required or permitted by applicable law.

6. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected, or as required by applicable law. The following retention criteria apply:

  • Active user accounts: data is retained for the duration of the active subscription between the subscribing organization and Aviation OJT Trace.
  • After subscription termination: personal data and training records are retained for a maximum of 12 months following the end of the subscription, to allow for data export requests and regulatory audit requirements, after which they are securely and permanently deleted.
  • Security and audit logs: retained for a maximum of 12 months for security and fraud prevention purposes.
  • Legal obligations: where applicable law requires longer retention (e.g. tax or accounting records), data will be retained for the period mandated by law, after which it will be securely deleted.

Upon expiry of the applicable retention period, personal data is deleted or anonymised in a manner that prevents re-identification.

7. Security

  • TLS encryption in transit
  • Hashed and salted passwords (bcrypt)
  • Role-based access control
  • Audit logs
  • Multi-factor authentication (TOTP) available for administrative accounts

8. International Transfers

Aviation OJT Trace primarily processes and stores data within the European Economic Area (EEA). In certain cases, backup data or infrastructure services may involve transfers to the United States or other third countries. Where such transfers occur, they are carried out under appropriate safeguards in accordance with Chapter V GDPR, including:

  • Standard Contractual Clauses (SCCs) approved by the European Commission; and/or
  • The EU-US Data Privacy Framework (where applicable).

You may request further information about international transfer safeguards by contacting us at privacy@aviationojttrace.com.

9. Your Rights

Under the GDPR, data subjects have the following rights with respect to their personal data:

  • Right of access (Art. 15) – obtain a copy of the personal data held about you
  • Right to rectification (Art. 16) – request correction of inaccurate or incomplete data
  • Right to erasure (Art. 17) – request deletion of personal data ("right to be forgotten")
  • Right to restriction of processing (Art. 18) – request that processing be limited
  • Right to data portability (Art. 20) – receive your data in a structured, machine-readable format
  • Right to object (Art. 21) – object to processing based on legitimate interest

To exercise any of the above rights, please contact your organization's administrator in the first instance, as your organization is the Data Controller for your personal data. You may also contact us directly at privacy@aviationojttrace.com.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with the competent data protection supervisory authority at any time. In Italy, the competent authority is the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it). You may also lodge a complaint with the supervisory authority of your country of residence or place of work within the European Economic Area.

10. Cookies

Only strictly necessary and functional cookies are used for session management, authentication, and user interface preferences. No tracking or advertising cookies are used.

The fonts used on this website are hosted locally on our own server and are loaded directly from our domain. No connection to Google servers is established for font delivery and, in this context, no personal data is transmitted to Google for rendering fonts.

Certain other third-party resources (such as CDN-delivered libraries) may technically receive your IP address as part of the content delivery process; these are described in full in our Cookie Policy.

11. Automated Decision-Making and Profiling

Aviation OJT Trace does not perform automated decision-making or profiling under Article 22 GDPR. All decisions are made by authorized human users within their respective organizations.

12. Web Scraping

Automated data extraction (web scraping) of any part of the platform is strictly prohibited unless explicitly authorized in writing by Aviation OJT Trace.

13. Data Protection Officer

Aviation OJT Trace has not appointed a Data Protection Officer (DPO), as the processing activities carried out do not meet the thresholds requiring mandatory DPO designation under Article 37 GDPR. All data protection enquiries may be addressed to privacy@aviationojttrace.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated to Company Administrators via email in advance.

15. Contact

For any privacy-related enquiries or to exercise your rights, please contact us at: privacy@aviationojttrace.com