Privacy Policy
Version 3.0
Last updated: February 2026
Table of Contents
1. Data Controller
For users in the European Union, the Data Controller for personal data processing is:
Data Controller (EU)
Cleared Aerospace SRL
Brescia, Italy
Email: privacy@cleared.aero
Platform Operator
Cleared Tech FZE
SRTI Park, Block B-42-139, Sharjah, UAE
Global Distributor
Cleared Aerospace DWC-LLC
Dubai South, UAE
Cleared Aerospace SRL (Italy) operates as:
- Data Controller for EU user data collected directly (demo requests, accounts, CRM)
- Data Processor pursuant to Art. 28 GDPR for Client Organization data
Data Protection Officer: dpo@cleared.aero
2. Definitions
| Term | Definition |
|---|---|
| Platform | The Cleared Crew software, including web, mobile applications and APIs |
| Client Organization | Flight school, ATO, Flying Club or air operator using the Platform |
| End User | Pilot, student, instructor or other member of the Client Organization |
| Personal Data | Any information relating to an identified or identifiable natural person |
| CrewChain | Cleared's proprietary blockchain for document immutability |
3. Scope
This Privacy Policy applies to the processing of personal data of:
- Visitors to the cleared.aero website
- Demo requesters who complete contact forms
- Representatives of Client Organizations
- End Users (pilots, students, instructors, staff)
- Vendors and Business Partners
4. Personal Data Categories
4.1 Identification and Contact Data
| Data | Description |
|---|---|
| Full Name | Personal identification |
| Date of Birth | Age and requirements verification |
| Tax ID | Tax identification |
| Email Address | Communications and access |
| Phone Number | Contact and notifications |
| Residential Address | Legal documentation |
4.2 Professional Aviation Data
| Data | Legal Basis |
|---|---|
| Flight License Number | Reg. UE 1178/2011 |
| License Type (LAPL, PPL, CPL, ATPL) | Reg. UE 1178/2011 |
| Ratings (SEP, MEP, IR, Night, FI) | Reg. UE 1178/2011 |
| Flight Hours (total, PIC, Dual, Night, IFR) | Reg. UE 1178/2011 |
4.3 Health Data (Art. 9 GDPR)
Health data is processed exclusively to comply with European aviation regulations (EU Reg. 1178/2011) and is subject to enhanced security measures.
| Data | Legal Basis |
|---|---|
| Medical Certificate Class (1, 2, LAPL) | Art. 9(2)(b)(g) GDPR |
| Certificate Expiry Date | Art. 9(2)(b)(g) GDPR |
| Medical Limitations | Art. 9(2)(b)(g) GDPR |
4.4 Flight Operational Data
- Bookings (dates, times, aircraft, routes)
- Flight Logs (ATL - Aircraft Technical Log)
- Safety Reports (safety occurrences)
- Training Briefings and Debriefings
4.5 Financial Data
We process the following financial data:
- Pilot Account Balance
- Transaction History
- Payment References (tokenized Stripe/PayPal IDs)
We never store complete credit card numbers.
4.6 Authentication Data
- Password (never stored in plain text, Argon2id hash)
- 2FA Token (TOTP, encrypted secret)
- Active Sessions (JWT tokens with expiration)
4.7 Blockchain Data (CrewChain)
Blockchain data consists of cryptographic hashes (SHA-256), not plain text personal data. The hash cannot be reversed to obtain the original content without access to the source document.
5. Purposes and Legal Bases
| Purpose | Legal Basis | GDPR Art. |
|---|---|---|
| Service delivery | Contract performance | Art. 6(1)(b) |
| Aviation regulatory compliance | Legal obligation | Art. 6(1)(c) |
| Health data processing | Legal obligation + Public interest | Art. 9(2)(b)(g) |
| Safety Management System | Legal obligation (EU Reg. 376/2014) | Art. 6(1)(c) |
| IT security | Legitimate interest | Art. 6(1)(f) |
| Direct marketing | Consent | Art. 6(1)(a) |
6. Data Recipients
Personal data may be disclosed to the following categories of recipients:
- Client Organization - Independent controller for its members' data
- Amazon Web Services - Sub-processor for hosting (EU-Frankfurt)
- Stripe Ireland - Sub-processor for payment processing
- Aviation Authorities (CAA, EASA) - For mandatory regulatory compliance
- Aviation Safety Authority - For mandatory safety reports (EU Reg. 376/2014)
Data is NOT sold, rented or shared with third parties for marketing, advertising profiling or any other commercial purpose.
7. International Transfers
Data is primarily stored within the European Union:
| Data Type | Location | Provider |
|---|---|---|
| Primary database | UE (Frankfurt) | AWS |
| Backup | UE (Ireland) | AWS |
| Payments | UE (Ireland) | Stripe |
| Transactional emails | USA | Resend (SCCs) |
For transfers to third countries (USA), we adopt Standard Contractual Clauses (SCCs), data encryption and Transfer Impact Assessment (TIA).
8. Data Retention
| Data Category | Period | Legal Basis |
|---|---|---|
| Account and profile data | Duration of relationship + 10 years | Tax obligations |
| Flight logs (ATL) | 5 years from aircraft deregistration | Reg. UE 1321/2014 |
| ATO training documentation | 5 years from training completion | Reg. UE 1178/2011 |
| Safety reports | Minimum 5 years | Reg. UE 376/2014 |
| Access/security logs | 12 months | IT security |
| Blockchain hashes | Permanent (immutable) | Document integrity |
9. Data Subject Rights
Under Articles 15-22 of the GDPR, Data Subjects have the following rights:
Right of Access (Art. 15)
Obtain confirmation of processing and a copy of personal data
Right to Rectification (Art. 16)
Correct inaccurate or incomplete data
Right to Erasure (Art. 17)
Request deletion of data ('right to be forgotten'), within legal limits
Right to Restriction (Art. 18)
Restrict processing in certain circumstances
Right to Data Portability (Art. 20)
Receive data in structured format (JSON/CSV) and transfer to another controller
Right to Object (Art. 21)
Object to processing based on legitimate interest
How to Exercise Your Rights
- Via Platform: Settings > Privacy > GDPR Requests
- Email: privacy@cleared.aero
- PEC: cleared@pec.it
Response Time
We will respond within 30 days of the request (extendable by an additional 60 days in complex cases).
Complaint to Authority
You have the right to lodge a complaint with the Data Protection Authority:
Garante per la Protezione dei Dati Personali
Piazza Venezia 11 - 00187 Roma
Email: protocollo@gpdp.it
Web: www.garanteprivacy.it
10. Data Security
We implement appropriate technical and organizational measures pursuant to Art. 32 GDPR:
Technical Measures
- Data encryption in transit (TLS 1.3) and at rest (AES-256)
- Password hashing with Argon2id
- Two-factor authentication (2FA) available
- Daily encrypted backups
- Continuous monitoring and access logging
Organizational Measures
- Role-based access control (RBAC)
- Complete audit log of operations
- Staff security training
- Periodic penetration testing
For more details, see our Security Policy
12. Contact
For any questions or requests regarding personal data processing:
General privacy inquiries: privacy@cleared.aero
Exercise of GDPR rights: gdpr@cleared.aero
Data Protection Officer: dpo@cleared.aero
PEC: cleared@pec.it
Cleared Technologies S.r.l.
legal.privacy.controller.address