Legal
Privacy Policy
This is a courtesy translation for your convenience. In the event of any discrepancy, the German original is legally binding.
Here you can find out how Blue Aviation GmbH processes personal data when you visit this website, submit a course enquiry, use your customer account and shop.
1. Data Controller
The controller within the meaning of the GDPR is Blue Aviation GmbH, Schlehdornweg 25, 22335 Hamburg, email: kontakt@blueaviationgroup.com.
2. Data Processed & Purposes
We process personal data for the purpose of contact enquiries, course enquiries, customer account and profile management, order processing in the shop, and the connection of external learning systems (LMS) – on the basis of Art. 6(1) GDPR (contract, legitimate interest or consent).
3. Hosting & Server Log Files
When you access the website, technically necessary data (e.g. IP address, date/time, page accessed) is processed. The specific hosting provider and retention period will be added before publication.
4. Shop, Payment & Customer Account
For orders, account and billing data as well as the selected payment method are processed. We use Stripe as our payment service provider; when a payment is made, the data required for this is transmitted to Stripe (Stripe Payments Europe, Ltd.).
5. Learning Management (LMS)
After a purchase, course access and learning progress may be processed in an LMS. The provider and processing details will be added before publication.
6. Online Examinations & Live Proctoring (evaexam)
Theory examinations taken online (e.g. A2, STS) are conducted using the examination software evaexam (evasys GmbH). The examination is supervised by live proctoring (webcam and, where applicable, screen monitoring, e.g. via Proctorio) in order to ensure the integrity of the examination. In particular, image and, where applicable, audio recordings during the examination period are processed, as well as an official photo ID for identity verification. The legal basis is the performance of the training contract (Art. 6(1)(b) GDPR). The specific processors (evasys/Proctorio), retention periods and server locations will be finalised before go-live and governed by a data processing agreement. Details on the process and requirements can be found on the respective course pages under "Online examination: process, requirements & live proctoring".
7. Registration by Companies (Company Offers)
Companies and organisations can request and accept an offer for the A2 classroom training online. The company then enters the participants in the customer portal and thereby provides us with their first and last names and e-mail addresses. We use this data to invite the participants to the training and – if no customer account exists yet – to create an account through which the invitation can be accepted or declined.
The legal basis is the preparation and performance of the contract with the company (Art. 6(1)(b) GDPR) as well as our and the company’s legitimate interest in organising the training of its staff (Art. 6(1)(f) GDPR).
Initially, the company only sees name, e-mail address and the status “invited”. Only once the invited person confirms participation in the customer portal does the company see the processing status (e.g. account active, documents complete yes/no, date, attendance) – never the uploaded documents or other profile data. The company only sees the exam result if the participant expressly agrees to this in the portal; this consent (Art. 6(1)(a) GDPR) can be withdrawn in the portal at any time.
If we created a new account for an invitation and the invitation is not confirmed within 14 days without the invited person ever having logged in, we automatically delete the invitation and this account. If the invited person declines or the company removes them before confirmation, the invitation is deleted; an account newly created for the invitation that has never been used is deleted as well. If the customer account already existed before the invitation, it always remains unchanged; an unconfirmed invitation for it remains stored until the person declines it or the company removes it.
8. Cookies & Traffic Measurement
We use technically necessary cookies (e.g. for the theme selection, the shopping cart or logging in to the customer portal) without consent, as they are required for the operation of the website (Art. 6(1)(f) GDPR, Section 25(2) No. 2 TTDSG).
For traffic measurement we use Umami (Umami Cloud, a service provided by Umami Software, Inc.). Umami operates without cookies and without accessing information stored on your device; only anonymised, aggregated usage data is processed (including pages visited, referrer, browser and device type, and approximate country-level origin). The IP address is not stored, and no recognition of individual visitors or cross-site tracking takes place. The legal basis is our legitimate interest in privacy-friendly traffic measurement (Art. 6(1)(f) GDPR); consent under Section 25(1) TTDSG is not required due to the absence of any device access.
You may object to processing for analysis purposes at any time with effect for the future (Art. 21 GDPR), e.g. by email to kontakt@blueaviationgroup.com. You may also block or delete cookies generally via your browser settings; confirmation of the cookie notice is stored locally in your browser (localStorage), and the notice can be recalled at any time via "Cookie settings" in the footer below.
9. Your Rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority.
Note: This version is a draft. Before real payment/tracking activation, payment providers, hosting, cookies, LMS and email services must be specifically named and legally reviewed.