Privacy Policy

1. Data controller

The data controller is the operator of the independent FlightDesk project and can be contacted at:

2. Personal data processed

Data provided directly by users

• first name, last name, email address and telephone number;
• the aeroclub, flight school or professional profile supplied;
• messages submitted during registration or through contact forms;
• data entered in personal platform functions;
• account data and application preferences.

Technical data

• IP address;
• date and time of requests;
• browser and device technical information;
• security and diagnostic logs;
• data required to manage authenticated sessions.

FlightDesk does not intentionally request special categories of personal data, such as health or biometric data or information concerning political or religious beliefs.

3. Purposes and legal bases

Registration and account management

Data is used to create and manage accounts, provide access to services and send communications required for their operation. The legal basis is performance of the relationship with the user or steps requested by the data subject.

Provision of platform services

Account data and information entered in restricted functions are processed to provide requested tools and manage the user’s relationship with the platform.

Support and communications

Data submitted through the contact form is used solely to handle and respond to the request.

Security and abuse prevention

Technical logs, IP addresses and session information may be processed on the basis of the controller’s legitimate interest in protecting the website and preventing unauthorized access, fraud and security incidents.

Technical analysis and improvement

Aggregated website usage statistics may be collected to understand operation and improve performance, navigation and reliability.

4. Retention periods

• contact and support requests are retained for as long as required to handle them and normally no longer than 24 months, unless legal or security requirements apply;
• account data is retained while the account remains active and subsequently for the period required to manage obligations or disputes;
• technical and security logs are retained for periods proportionate to diagnostic and protection purposes;
• data voluntarily entered in personal functions remains available until deleted or the account is closed.

5. Providers and external services

The website may use technical providers that process data on behalf of FlightDesk or as independent controllers under their respective terms.

• hosting, email and database providers;
• authentication services, including sign-in with Google;
• analytics services such as Google Analytics and Umami Analytics, enabled only with consent;
• mapping and weather services including OpenStreetMap, CARTO, Cesium ion and Open-Meteo, subject to their respective terms;
• security, backup and maintenance providers.

When signing in with Google, users authorize the sharing of essential profile information required for authentication, normally their name, email address and account identifier.

6. Disclosure and international transfers

Data may be disclosed to technical providers, advisers or public authorities where necessary to operate the service, comply with the law or protect the controller’s rights.

Some providers may process data outside the European Economic Area. In such cases, processing is based on safeguards provided by applicable law, including adequacy decisions or standard contractual clauses.

7. Security

Reasonable technical and organizational measures are used to limit unauthorized access, loss, alteration or disclosure. These may include HTTPS connections, access controls, hashed passwords, passkeys, session protection, backups and security-event logging.

8. Data subject rights

Where provided by Regulation (EU) 2016/679, data subjects may request:

• access to their personal data;
• rectification or updating;
• erasure;
• restriction of processing;
• objection to processing;
• data portability, where applicable;
• withdrawal of consent, without affecting prior processing.

Requests may be sent to:

Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority.

9. Children

Registration by minors may be subject to additional checks and, where required, the consent or authorization of a person exercising parental responsibility.

10. Cookies and analytics

The website uses technical cookies required for operation and, only with consent, Google Analytics and Umami Analytics for statistics and aggregated events such as starting or completing registration. These events do not contain information entered in forms. Preferences can be changed at any time using the footer link. See the Cookie Policy for details.

11. Changes to this notice

This notice may be updated when services, providers or processing methods change. The current version and its effective date will be published on this page.