1. Who we are
The data controller is the operator of EUPDB. Its full legal name and address are stated in the Terms you accept when you register, and are provided on request. For any data protection enquiry, write to [email protected].
2. The data we hold
2.1 Pilots and aspiring pilots
Registration asks for your name, where you are based, and whether you hold a pilot licence. No documents are collected at registration. Everything else is added by you, from your dashboard, and you can change or remove any of it at any time. The categories we hold are:
- Identity and contact details. Name, email address, a password (hashed) if you set one, and, if you choose to give them, date of birth and a profile photo.
- Right to work and nationality. Nationality, the passports you hold, your base or country of residence, and the states where you are entitled to work.
- Licence. Whether you hold a pilot licence or are an aspiring pilot, and for a licence held, its type, its issuing authority and state, and its number.
- Ratings. Type ratings and the instrument rating with their validity dates, training certificates, and instructor or examiner certificates where held.
- Flight time. The figures you enter, including total time, pilot in command time, time on type and recent experience.
- Medical certificate. Class, issuing authority and expiry date only. We do not ask for the examination itself, and you must not upload it or any other health information.
- Language proficiency. ICAO English level and any other language levels, with their expiry dates.
- Employment history. The roles and periods you enter, and the rank you are seeking.
- Preferences. Availability, base, contract and relocation preferences, and any operator you have excluded.
- Uploaded documents. The files you choose to upload, such as a licence, a medical certificate, training certificates, logbook pages or a CV. Uploading is optional and the files stay private to you.
- Messages you send and receive on the platform.
Verification is optional. If you ask for it, you show your pilot licence once. What we keep afterwards is the fact that your profile is verified and the date. The file itself is not kept.
2.2 Airline accounts
- Name and corporate email address of the authorised representative
- Operator name, IATA and ICAO codes, and country of registration
- Account activity records and messages sent on the platform
2.3 Technical data
- IP address, browser type and version, and operating system, recorded when you use the site
- Log data, meaning access times, pages opened and error records
- Your session token, held in your browser's local storage rather than in a cookie
3. Why we hold it
- Your account, creating and running your account and your profile
- Profile visibility, showing your profile to the airline accounts you have not excluded
- Messaging, carrying messages between accounts on the platform
- Documents, keeping the files you upload in your private area, and sending you a reminder before a dated document expires
- Verification, the single check described above, after which only the flag and the date remain
- Email, account confirmation, password reset, expiry reminders, and a notice when a message is waiting for you. The content of a message is never put in an email
- Legal compliance, answering lawful requests and enforcing our terms
- Security, fraud detection, abuse prevention and audit logging
4. Legal basis
- Contract performance, Art. 6(1)(b) GDPR. Processing needed to give you the service you signed up for
- Consent, Art. 6(1)(a) GDPR. Listing your profile in the database, showing it to airline accounts, and the optional verification. You may exclude any operator, withdraw your consent, or delete your account at any time from your dashboard
- Legitimate interests, Art. 6(1)(f) GDPR. Security, fraud prevention and improvement of the platform
- Legal obligation, Art. 6(1)(c) GDPR. Compliance with applicable law
We do not ask you for special categories of data, health information included, and you must not put any in your profile, in your documents or in a message. The class, the authority and the expiry date of a medical certificate are held as validity data only. Do not upload examination results or medical reports. If you send us such data anyway, for example in an email to support, we use it only to answer you.
5. Who receives it
We do not sell personal data. It reaches only these categories of recipient:
- Airline accounts on the platform. What you put on your profile is visible to them, and never to an operator you have excluded. Your uploaded documents and your email address are not shared with them
- Training organisations, only if you are an aspiring pilot and have ticked that they may contact you about courses. What reaches them is what you gave us in your profile or in the route check, never your uploaded documents. Write to [email protected] to withdraw this at any time
- Service providers acting for us, in the categories of hosting, database, file storage and email delivery, each under a written data processing agreement. The current list of these providers is available on request at [email protected]
- Public authorities, where a court order or applicable law requires it
6. International transfers
Our database is hosted in the European Union and file storage uses data centres in the EU. Where a transfer outside the EEA takes place, we rely on the EU Standard Contractual Clauses or on an adequacy decision.
7. Retention
- Active accounts. Profile data and messages are kept for as long as your account exists
- Uploaded documents. Kept until you delete them or delete your account
- Verification files. Not kept after the check
- Deleted accounts. All personal data is erased within 30 days of deletion, except what law or regulation requires us to keep, which is held for up to 6 years
- Application logs. Kept for 90 days for security purposes
8. Your rights
Under the GDPR you have the right to:
- Access, Art. 15. Ask for a copy of your personal data
- Rectification, Art. 16. Correct data that is wrong
- Erasure, Art. 17. Delete your account and your data, from your dashboard or by writing to us
- Restriction, Art. 18. Restrict processing in the cases the law provides
- Portability, Art. 20. Export your data in a machine readable format
- Objection, Art. 21. Object to processing based on legitimate interests
- Withdraw consent at any time, without affecting processing carried out lawfully before that
To use any of these rights, write to [email protected]. We answer within 30 days. You may also lodge a complaint with a supervisory authority. If you are in Poland, that authority is the Urząd Ochrony Danych Osobowych (UODO), uodo.gov.pl. If you are elsewhere in the EEA, you may complain to the authority of the country where you live or work.
9. Cookies and tracking
EUPDB.EU uses no analytics, advertising or tracking cookies. There is no Google Analytics, no advertising pixel, and no behavioural tracker of any kind.
What is stored on your device is strictly necessary or functional: your sign in session, held in your browser's local storage so that you stay signed in, and small functional cookies that may be set only when you use a specific feature such as signing in or completing a security check. Under the ePrivacy Directive these are exempt from consent, so no cookie banner is required. If we ever add analytics or advertising, we will ask for your consent first.
Fonts and icons. Our typeface and our icon set are hosted on eupdb.eu. No font or icon file is loaded from a third party, so opening our pages sends nothing to any advertising or profiling network.
10. Security
We apply technical and organisational measures including:
- TLS encryption in transit
- Access rules at database level, so that an account reaches only its own data
- Time limited links for the documents you upload, issued only to you
- Token based authentication validated on the server
- Access controls that limit which staff can reach personal data
If a personal data breach occurs, we will inform the competent supervisory authority within 72 hours as required by Art. 33 GDPR, and the people affected without undue delay where Art. 34 GDPR applies.
11. Children
EUPDB.EU is a professional platform. We do not knowingly hold data about anyone under the age of 16. If you believe we have received data from a minor, write to [email protected] and we will erase it.
12. Changes to this policy
We may update this policy. A material change is announced by email, or by a notice on the platform, at least 14 days before it takes effect.
13. Contact
Data protection enquiries: [email protected]
Support: [email protected]
Website: eupdb.eu