1. Controller
Dutch Aviation Services sp. z o.o. (“DAS”, “we”) operates FlyEASA and is the controller for the processing described here.
Dutch Aviation Services sp. z o.o.ul. Piotrkowska 222/3
90-369 Łódź, Poland
KRS 0000838546 · NIP 7252299781
Privacy requests: [email protected].
2. Data processed at this stage
When a page is requested, the website host may process technical data such as IP address, request time, requested resource, browser information and security events to deliver and protect the site.
If you contact DAS directly by email, telephone or WhatsApp, we process the contact details, message and correspondence you choose to provide so that we can answer you.
The website contains separate pilot and ATO enquiry forms. When submitted, they process the selected enquiry route, name where provided, email address, organisation where relevant, preferred reply channel, telephone number where requested, message, page and submission time. Do not send medical, health, psychometric, passport, identity-document, payment, criminal-record or other sensitive information. ATO representatives must not send student or trainee personal data through the initial enquiry route.
FlyEASA does not currently send website enquiry data to ATOs, financial partners, assessment providers, airlines or aviation authorities.
3. Purposes and legal bases
- Technical request data is used to deliver and secure the website on the basis of DAS’s legitimate interest in operating a reliable and secure service, Article 6(1)(f) GDPR.
- An individual’s request about FlyEASA's service is handled to take steps requested before a possible contract, Article 6(1)(b) GDPR.
- An ATO or other business enquiry is handled on DAS’s legitimate interest in answering correspondence and developing prospective business relationships, Article 6(1)(f) GDPR.
- If you ask for a reply by telephone or WhatsApp, that channel is used only to answer the enquiry. It does not authorise later marketing.
The enquiry forms do not request marketing consent. DAS will not add an enquirer to a marketing list merely because they submitted a form.
4. Recipients and service providers
DAS is the controller. Access is limited to authorised DAS personnel and providers needed to operate the website and communications. Bennovate sp. z o.o., operating as Avantwerk in Poland, provides and administers the FlyEASA website, the contact relay and the CRM on DAS's instructions, acting as a processor for that work, and engages its own infrastructure providers as sub-processors, some of which process data outside the EEA (see section 5). Where a video call or online meeting is arranged, Zoom processes the meeting data. If a payment is ever taken online, Stripe processes the card payment and DAS never receives or stores a full card number. When analytics or advertising is enabled on this website, Google Analytics (Google Ireland Limited) and the Meta Pixel (Meta Platforms Ireland Limited) load only after you choose “Accept all” in the cookie banner; for the Meta Pixel, DAS and Meta act as joint controllers under Article 26 GDPR. Email, telephone and WhatsApp providers process data only where needed for the selected service or reply channel.
DAS does not disclose an initial enquiry to an ATO, financial partner, assessment provider, airline or aviation authority unless a later discussion requires it and an appropriate basis and notice apply.
The providers behind those categories are:
- Avantwerk, operated by Bennovate sp. z o.o. — Supplies and administers the website, CRM, forms and email sending, and engages its own infrastructure providers as sub-processors, some of which are outside the EEA. Established in Poland, with sub-processors outside the EEA. Transfers are made under Standard Contractual Clauses in the platform's data-processing terms.
- Zoom — Where a video call or online meeting is arranged: assessment interviews, consultations and online meetings. Established in the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback.
- Stripe — If a payment is ever taken online: card payments. A full card number is never received or stored by the controller. Established in the United States / Ireland. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback.
- Google Ireland Limited — When analytics or advertising is enabled on this website: analytics and advertising. Established in Ireland, with transfers to the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback. Loads only after you choose “Accept all” in the cookie banner.
- Meta Platforms Ireland Limited — When analytics or advertising is enabled on this website: advertising measurement and audiences on Facebook and Instagram. Established in Ireland, with transfers to the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback. Loads only after you choose “Accept all” in the cookie banner.
- Cloudflare — Protects the website, forms and chat against automated abuse, and delivers the pages. Established in the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback.
This list is kept current; a provider may be replaced by another of the same kind.
5. International transfers
The pilot and ATO enquiry forms transmit the information described above through the Avantwerk contact relay into the DAS CRM. Parts of that platform, and the analytics and advertising providers named in section 4, are established in the United States. For a restricted transfer of EEA personal data, the applicable data-processing terms apply transfer mechanisms in this order: a valid European Commission adequacy decision, including the EU-US Data Privacy Framework where it applies; otherwise the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, using Module Two for a controller-to-processor transfer or Module Three for a processor-to-subprocessor transfer, as applicable; or another lawful transfer mechanism where permitted. The Standard Contractual Clauses prevail over conflicting terms in those data-processing terms. A copy of the terms that apply to a given provider is available from DAS on request.
6. Retention
Technical data is kept only for as long as needed to operate, secure and troubleshoot the website and investigate abuse, then deleted or anonymised under the applicable hosting rotation.
Enquiry records and correspondence are kept while DAS answers the enquiry and for the period reasonably needed to document the discussion and establish, exercise or defend legal claims. If the discussion leads to a separate relationship, the applicable agreement and statutory retention duties govern the resulting records. Backup copies expire through the providers' ordinary backup cycles. No marketing list is created from these enquiry forms.
7. Required and optional information
An email address, message and privacy acknowledgement are required to use the applicable form. Without them, the form cannot send or DAS cannot answer through that route. A name is optional on the pilot form. Organisation and representative details are required on the ATO form. A telephone number is required only if telephone or WhatsApp is selected as the preferred reply. No promotional choice is required.
8. Your rights
Depending on the circumstances, you may request access, rectification, erasure, restriction or portability, object to legitimate-interest processing, and withdraw any consent that applies to a separate activity. You may also complain to the President of the Personal Data Protection Office. See Your Data-Protection Rights for details.
9. Automated decisions
FlyEASA does not currently make decisions producing legal or similarly significant effects solely by automated means and does not perform psychometric profiling through this website.
DAS uses artificial-intelligence tools to help prepare and format written correspondence and documents. Anything produced that way is reviewed and approved by a person before it is sent, and such tools are not used to decide anything about you. Personal data given to them is processed under a written data-processing agreement, on the same basis as the rest of your enquiry.
10. Changes
Material changes will be published on this page. This notice must be reviewed again before any form, assessment, payment, protected-funds or student-account functionality is activated.