Privacy Notice

1. Controller

Dutch Aviation Services sp. z o.o. (“DAS”, “we”) operates FlyEASA and is the controller for the processing described here.

Privacy requests: [email protected].

2. Data processed at this stage

When a page is requested, the website host may process technical data such as IP address, request time, requested resource, browser information and security events to deliver and protect the site.

When a page loads, our website platform sets a security cookie (__cf_bm, provided by Cloudflare) and a visitor identifier (msgsndr_id, 12 months). Both are set before any choice and are listed in the Device Storage and Cookie Notice.

Platform visit statistics and attribution. On every page, our website platform records visit statistics and attribution when the page loads, before any cookie choice and whatever you choose in the cookie banner. It writes visit-history and session entries to your browser’s local storage and sends the platform operator the address of each page you open, the referring address, the source, keyword and campaign parameters of your visit and a session identifier, together with the visitor identifier (msgsndr_id) and technical data such as your IP address. These entries are listed in the Device Storage and Cookie Notice. Withdrawing a cookie choice does not remove them; you can delete them by clearing the site data in your browser.

Every page on this website also carries a technical hint (a browser preconnect) to Google’s font server, added by our website platform. The pages themselves use fonts served from this website, but the hint causes your browser to open a connection to Google, which discloses your IP address. This happens on every page load. The blog pages (the blog index and the articles) are an exception: when you open one, it loads its typefaces from Bunny Fonts, a font service operated in the European Union, before any cookie choice, so your IP address and browser details are sent to Bunny Fonts. The Contact page shows the enquiry form in a frame supplied by our website platform. That frame downloads its typefaces from Bunny Fonts, a font service operated in the European Union, loads two script files from Google’s file-storage service, runs Cloudflare’s automated-abuse check and keeps form-session entries in your browser, so when the form is displayed your IP address and browser details are sent to Bunny Fonts, Google and Cloudflare before any cookie choice. The legal basis is our legitimate interest in operating the website and a working, protected enquiry form on the infrastructure our platform provides (Article 6(1)(f) GDPR). You may object to this processing at any time (section 8), and you can always contact DAS by email instead of using the form. We state it here because these are connections to third parties that may process data outside the EEA.

If you contact DAS directly by email, telephone or WhatsApp, we process the contact details, message and correspondence you choose to provide so that we can answer you.

The website contains two enquiry forms. A submitted form goes directly into the DAS customer-relationship system (CRM) on the Avantwerk platform.

• Pilot enquiry form (Contact page): first name, last name, email address, telephone number, country of residence, the programme you are interested in, where you are in your training, whether you hold an EASA Class 1 medical certificate (Yes, Booked, Not yet or Not sure) and your preferred contact method (email, phone or WhatsApp).
• ATO partnership enquiry form (For ATOs page): the organisation’s name, website and ATO registration number, the representative’s first name, last name, email address and telephone number, the training modules the ATO provides and the preferred contact method (email, phone or WhatsApp).

Both forms also record the privacy acknowledgement, any optional consent you tick (section 3), the page and the time of submission. Apart from the answer to the medical-certificate question, do not send medical, health, psychometric, passport, identity-document, payment, criminal-record or other sensitive information. ATO representatives must not send student or trainee personal data through the initial enquiry route.

FlyEASA does not currently send website enquiry data to ATOs, financial partners, assessment providers, airlines or aviation authorities.

3. Purposes and legal bases

• Technical request data is used to deliver and secure the website on the basis of DAS’s legitimate interest in operating a reliable and secure service, Article 6(1)(f) GDPR.
• The website platform’s visit statistics and attribution (pages opened, referring address, campaign parameters and a session identifier, sent to the platform operator with the visitor identifier) show how the website is reached and used. The legal basis DAS relies on is its legitimate interest in knowing that, Article 6(1)(f) GDPR; you may object at any time (section 8).
• An individual’s request about FlyEASA's service is handled to take steps requested before a possible contract, Article 6(1)(b) GDPR.
• An ATO or other business enquiry is handled on DAS’s legitimate interest in answering correspondence and developing prospective business relationships, Article 6(1)(f) GDPR.
• If you ask for a reply by telephone or WhatsApp, that channel is used to answer the enquiry. Choosing it does not by itself authorise later marketing.
• If you tick the optional “Consent — marketing email (FlyEASA)” box on either form, DAS sends you news, offers and updates about FlyEASA by email, on the basis of your consent, Article 6(1)(a) GDPR, until you withdraw it and in any event for no longer than 36 months from your last engagement. You can withdraw it at any time with the unsubscribe link in any message or by writing to [email protected].
• If you tick the optional “Consent — phone/WhatsApp (FlyEASA)” box on either form, DAS may contact you by telephone or WhatsApp with follow-up and marketing information about its services, on the basis of your consent, Article 6(1)(a) GDPR, until you withdraw it and in any event for no longer than 36 months from your last engagement. You can withdraw it at any time by telling us on that channel or by writing to [email protected].
• Where you have accepted analytics cookies, Google Analytics measures how the website is used, on the basis of your consent, Article 6(1)(a) GDPR, until you withdraw it; the cookie lifetimes are listed in the Device Storage and Cookie Notice.

Both marketing consents are optional and separate from the required privacy acknowledgement. Declining them does not affect the answer to your enquiry, and DAS does not add an enquirer to a marketing list unless the enquirer ticked one of them. Withdrawing a consent does not affect processing carried out before the withdrawal.

4. Recipients and service providers

DAS is the controller. Access is limited to authorised DAS personnel and providers needed to operate the website and communications. Bennovate sp. z o.o., operating as Avantwerk in Poland, provides and administers the FlyEASA website, its forms and CRM on DAS's instructions, acting as a processor for that work, and engages its own infrastructure providers as sub-processors, some of which process data outside the EEA (see section 5). The settings panel separates analytics and advertising, and its purpose/configuration version changes before a newly configured optional identifier can use an earlier choice. No advertising or social-media pixel is used on this website. With analytics consent, Google Analytics (Google Ireland Limited) measures how the website is used; without that choice it is not loaded. Where a video call or online meeting is arranged, Zoom processes the meeting data. If a payment is ever taken online, Stripe processes the card payment and DAS never receives or stores a full card number. Email, telephone and WhatsApp providers process data only where needed for the selected service or reply channel.

DAS does not disclose an initial enquiry to an ATO, financial partner, assessment provider, airline or aviation authority unless a later discussion requires it and an appropriate basis and notice apply.

The providers behind those categories are:

• Avantwerk, operated by Bennovate sp. z o.o. - Supplies and administers the website, CRM, forms and email sending, and engages its own infrastructure providers as sub-processors, some of which are outside the EEA. Established in Poland, with sub-processors outside the EEA. Transfers are made under Standard Contractual Clauses in the platform's data-processing terms.
• Zoom - Calls or online meetings, where one is arranged. Established in the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback.
• Stripe - If a payment is ever taken online: card payments. A full card number is never received or stored by the controller. Established in the United States / Ireland. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback.
• Google Ireland Limited - Analytics. Established in Ireland, with transfers to the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback. Loads only after the analytics choice, or after “Accept all”.
• Cloudflare - Protects the website and forms against automated abuse, and delivers the pages. Established in the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback.
• Google (script files for the enquiry form) - The enquiry-form frame supplied by our website platform loads two script files from Google's file-storage service (storage.googleapis.com) before any cookie choice, which discloses your IP address to Google. No cookie was observed for this.

This list is kept current; a provider may be replaced by another of the same kind.

5. International transfers

The pilot and ATO enquiry forms transmit the information described above directly into the DAS CRM on the Avantwerk platform. Parts of that platform, and the analytics provider named in section 4, are established in the United States. For a restricted transfer of EEA personal data, the applicable data-processing terms apply transfer mechanisms in this order: a valid European Commission adequacy decision, including the EU-US Data Privacy Framework where it applies; otherwise the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, using Module Two for a controller-to-processor transfer or Module Three for a processor-to-subprocessor transfer, as applicable; or another lawful transfer mechanism where permitted. The Standard Contractual Clauses prevail over conflicting terms in those data-processing terms. A copy of the terms that apply to a given provider is available from DAS on request.

6. Retention

Technical data is kept only for as long as needed to operate, secure and troubleshoot the website and investigate abuse, then deleted or anonymised under the applicable hosting rotation.

Enquiry records and correspondence are kept while DAS answers the enquiry and for the period reasonably needed to document the discussion and establish, exercise or defend legal claims. If the discussion leads to a separate relationship, the applicable agreement and statutory retention duties govern the resulting records. Backup copies expire through the providers' ordinary backup cycles. Where you gave an optional marketing consent, your contact details are kept for that purpose until you withdraw it, and in any event for no longer than 36 months from your last engagement.

7. Required and optional information

On the pilot enquiry form every field listed in section 2 is required, including the telephone number and the answer to the medical-certificate question, together with the privacy acknowledgement. On the ATO partnership enquiry form every field listed in section 2 is required, together with the privacy acknowledgement. Without a required answer the form cannot be sent; you can always contact DAS by email instead. The marketing-email and phone/WhatsApp consents are optional on both forms, and no promotional choice is required.

8. Your rights

Depending on the circumstances, you may request access, rectification, erasure, restriction or portability, object to legitimate-interest processing, and withdraw any consent that applies to a separate activity. You may also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl, or with the supervisory authority of the EU or EEA country where you live, work, or where you believe the infringement took place.

9. Automated decisions

FlyEASA does not currently make decisions producing legal or similarly significant effects solely by automated means and does not perform psychometric profiling through this website.

DAS uses artificial-intelligence tools to help prepare and format written correspondence and documents. Anything produced that way is reviewed and approved by a person before it is sent, and such tools are not used to decide anything about you. Personal data given to them is processed under a written data-processing agreement, on the same basis as the rest of your enquiry.

10. Changes

Material changes will be published on this page. This notice is Version 1.5, effective 29 October 2026. This version describes exactly what each enquiry form asks for and which answers are required, adds the optional marketing-email and phone/WhatsApp consents the forms offer, states that submissions go directly into the DAS CRM, and removes the description of the Meta Pixel, which is not used on this website. Version 1.4, effective 21 October 2026, added Google Analytics, on the basis of your consent, to the legal bases in section 3.