Privacy Policy

Last updated: April 04, 2026

This Privacy Policy explains how Aviation OJT Trace collects, uses, stores, and protects your personal data when you use our platform. We are committed to complying with the General Data Protection Regulation (GDPR) and other applicable international privacy laws.

1. Who We Are

Aviation OJT Trace is a multi-tenant SaaS platform designed for managing On-the-Job Training (OJT) in the aviation sector. The platform serves multiple organizations ("Companies"), each operating within their own isolated workspace. For the purposes of GDPR, your employer or subscribing organization acts as the Data Controller, while Aviation OJT Trace acts as the Data Processor on their behalf.

2. Data We Collect

Depending on your role within the platform, we may collect and process the following personal data:

  • Account data: full name, email address, assigned role (Trainee, Instructor, HR Manager, Administrator), and company affiliation.
  • Authentication data: login credentials (stored in hashed form), session tokens, and login history.
  • OJT training data: task records, progress evaluations, digital signatures, instructor assessments, and qualification statuses.
  • Company branding assets: organization logos uploaded for the purpose of report personalization (see Section 6).
  • System and security logs: IP addresses, access timestamps, and security events for audit and platform integrity purposes.
  • Usage data: anonymized analytics and performance metrics used to improve the platform.

3. How We Use Your Data

Personal data is processed for the following purposes:

  • Providing and operating the Aviation OJT Trace service.
  • User authentication, role management, and access control.
  • Tracking and managing OJT progress, tasks, and qualifications.
  • Generating training reports and certificates personalized with your organization's branding.
  • Ensuring platform security, detecting fraud, and maintaining audit trails.
  • Improving platform performance through anonymized usage analytics.
  • Complying with legal and regulatory obligations applicable to aviation training records.

4. Legal Basis for Processing

We process personal data under the following legal bases as defined by GDPR Article 6:

  • Contractual necessity (Art. 6(1)(b)): processing required to deliver the Service as agreed.
  • Legitimate interest (Art. 6(1)(f)): platform security, fraud prevention, and service improvement.
  • Legal obligation (Art. 6(1)(c)): compliance with applicable aviation regulations and data retention requirements.
  • Consent (Art. 6(1)(a)): where explicitly requested, such as for non-essential cookies or analytics.

5. Data Sharing

We do not sell personal data. Data may be shared only in the following limited circumstances:

  • Within your organization: data is accessible to authorized users (Instructors, HR Managers, Administrators) within your company's workspace, as necessary for OJT management.
  • Service providers: trusted third-party providers supporting platform infrastructure (e.g., hosting, database services), bound by data processing agreements.
  • Regulatory authorities: when legally required by applicable aviation regulations or law enforcement.
  • Between companies: data is strictly isolated per tenant — no data is shared between different subscribing organizations.

6. Company Logos and Branding Assets

Logos and trademarks uploaded by your organization remain the exclusive property of that organization. Aviation OJT Trace does not claim any rights over uploaded logos. They are used solely to identify your organization within the platform and to personalize reports and documents generated on your behalf. Logos are not shared with other organizations, used for marketing purposes, or displayed outside your organization's own workspace and reports.

7. Data Retention

Personal data is retained for as long as necessary to provide the Service or as required by applicable law, including aviation regulatory record-keeping obligations. Upon termination of a subscription, organizational data will be retained for a limited grace period before being permanently and securely deleted. Users may request earlier deletion subject to legal retention requirements.

8. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These include encrypted data transmission (TLS), hashed password storage, role-based access controls, and regular security monitoring. In the event of a data breach, we will notify affected organizations and relevant supervisory authorities as required by GDPR.

9. International Data Transfers

Backup copies of platform data are stored on servers located in the United States, operated by DigitalOcean LLC. This transfer is carried out under appropriate safeguards in compliance with GDPR Chapter V, specifically:

  • Standard Contractual Clauses (SCCs) — Commission Implementing Decision (EU) 2021/914 of 4 June 2021, incorporated by reference into DigitalOcean's Data Processing Agreement (DPA), which is automatically accepted upon use of their services.
  • EU-U.S. Data Privacy Framework (DPF) — DigitalOcean LLC is certified under the EU-U.S. DPF as set forth by the U.S. Department of Commerce, providing an additional adequacy safeguard for transatlantic data transfers.

All other personal data processed by the platform remains within the European Economic Area (EEA). No personal data is transferred to any other third country without equivalent safeguards in place.

10. Your Rights

Under GDPR, you have the following rights regarding your personal data:

  • Right to access (Art. 15): request a copy of the data we hold about you.
  • Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17): request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
  • Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
  • Right to restrict processing (Art. 18): request that we limit how we process your data.
  • Right to object (Art. 21): object to processing based on legitimate interest.
  • Right to withdraw consent (Art. 7(3)): withdraw consent at any time where processing is consent-based.

To exercise your rights, please contact your organization's administrator or reach us directly via the Contact us page. We will respond within 30 days as required by GDPR.

11. Cookies

We use strictly necessary cookies to operate the platform (e.g., session management). Where non-essential cookies are used (e.g., analytics), we will request your consent. You can manage cookie preferences through your browser settings at any time.

12. Changes to This Policy

We may update this Privacy Policy periodically. When we do, we will revise the "Last updated" date above and, where appropriate, notify Company Administrators. Continued use of the Service constitutes acceptance of the updated policy.

13. Contact

For any questions or requests regarding this Privacy Policy, please contact us via the Contact us page.

This document is provided for general informational purposes and does not constitute legal advice. We recommend that your organization's legal department or advisor reviews this Policy before formal adoption.