Privacy Policy

The purpose of this Privacy Policy (“Policy”) is to explain how, when and why L’Aeroclub collects information about individuals, and how, for what purposes and on what basis this “Personal Data” is subsequently processed, who processes it. and what rights people have in relation to their personal data.

• This Policy also explains L’Aeroclub’s practices in the use of cookies and other technologies to store information on the devices of others and retrieve information from such devices.

• When we refer to “L’Aeroclub” or use the word “we” or “our”, we refer to the Barcelona-Sabadell Aeroclub, with registered office at Sabadell Airport, 08205 Sabadell, Barcelona, and registered in the Commercial Registry of Barcelona to Volume 2021, Book 1425 of section 2, Folio 245, Sheet number 21131, Inscription 23, which can be commercially presented under the trademarks “L’Aeroclub” or “Barcelona Flight School” interchangeably.

• By “You”, we mean the person reading this text, that is, you as an individual (and not any company or other organization with which you may be associated).

• Some words and phrases in this Policy are enclosed in single quotes (for example, “controller”, “processor” and “data owner”). These are legal terms that have the same meaning as given to them in the EU General Data Protection Regulation, i.e. Regulation (EU) 2016/679 (“GDPR”).

1.

This Policy applies to data processing that is carried out through or in connection with the following:

• the provision of the services inherent to the activity of L’Aeroclub to its Members, either through the use of aircraft and facilities owned by L’Aeroclub under the conditions established by current legislation and the Statutes of the club itself, or through of the use of software owned by L’Aeroclub or third-party companies and that it makes available to its partners in relation to the provision of the aforementioned services (by “software” we refer to computer programs in any form, including local installations such such as desktop and mobile applications, as well as software in the form of on-demand services, such as web and cloud applications). We will use the word “Service” or “Services” in this Policy to designate all of the above, and the same word will designate any service, resource or other benefit that L’Aeroclub or any of the companies designated by it offers as part of said Service or in relation to said Service;

• the use of the website https://aeroclub.es, https://barcelonaflightschool.com or any other website owned by L’Aeroclub (we will use the word “website” to designate any of these sites);

• the communication or interaction between you and L’Aeroclub, by any means;

all of this to the extent that the above activities are not subject to other policies that have been established by L’Aeroclub in its Statutes or similar document.

2.

This Privacy Policy affects you in an essentially the same way if you are an active Member of L’Aeroclub, or if you have only transferred your Personal Data to us in order for us to keep you informed of our activities and news by subscribing to any of our communications. The following sections specify the difference in relation to the categories of Personal Data that are part of the scope that we can process in each case.

3.

When we talk about “Personal Data”, we mean any information about an individual from which that person can be identified (the proper legal definition of “Personal Data” is “any information relating to an identified or identifiable natural person”, being known as the person to whom said information refers as the “Information Owner”).

Personal data does not include information by which it is not possible to reasonably identify an individual, that is, anonymous information or de-identified personal data in such a way that the individual is not, or is no longer, identifiable (anonymous or de-identified information ). This Policy does not apply to such information.

4.

This Policy complements other policies of L’Aeroclub, for example in the field of use of the Service, or Security Management, and in particular complements all those terms of use established in the Statutes of mandatory compliance for members, and in no case does it intend to cancel them.

5.

L’Aeroclub’s own activity is to provide its Members with all types of services related to aeronautical, social and training activities (forming an integral part of the “Service”), and for this it is necessary to process data in one way or another. .

We need to process various data in various ways so that we can carry out our business on a continuous and satisfactory basis for the partner, including to provide, maintain and manage the Service and the Websites, and to communicate with you. Not all of this information constitutes Personal Data, and some of the processing is controlled by third parties that are not part of L’Aeroclub.

6.

L’Aeroclub is the “controller” (responsible and/or processor) of the Personal Data that is collected by us or third parties on our behalf through the activities listed in section 1 of this Policy, or that is otherwise processed. for the purposes of our activity. The following sections explain the collection and further processing of this data in more detail.

7.

L’Aeroclub collects, generates and receives information in a variety of ways. Some of this information constitutes Personal Data and the rest does not. We will use the word “Information” to designate any and all data that we collect, generate or process in any way, whether by ourselves or by a third party on our behalf. This part of the Policy describes what information and how it is collected or generated through the activities listed in section 1.

8.

“Member account”

We collect information about you in the course of negotiating, preparing, concluding and modifying agreements between you and L’Aeroclub with the aim of registering you as a Member. The information collected may include the data provided in such agreements and any information that you provide for the purpose of negotiating, concluding or modifying such agreements, and/or that is subsequently required for the provision of the Service. For example, when you register, we ask you for your full name, age, postal address, telephone number and email address, nationality and country of residence, and other identifying information such as DNI, passport or NIE. In order to comply with L’Aeroclub’s legal obligations in relation to aeronautical legislation and provide you with the Service in accordance with them, we also collect information about your aeronautical licenses and ratings, aeronautical medical certificate and flight experience, as well as their renewal. . We will also assign you a membership number linked to your account. All this information is stored in our database and we may use it to, among others, link your access to the flight activity under different conditions (according to your experience, licenses and ratings in force), or to alert you about the next expiration of your aeronautical documentation.

9.

“Billing information”

As a requirement for the payment of the fees that allow you to maintain your status as an active Member of L’Aeroclub, we ask that you provide us with the full name of the person or entity that will be responsible for the payment, your physical address, your bank account for the purposes of direct debit payment and, if applicable, the VAT number (i.e. the registration number of a “taxable person” in relation to value added tax). The payer of the dues may or may not be the member themselves, so we may receive the above information about you from another user. In the case of services subject to payment of additional amounts (for example, training courses, aircraft rental, airport taxes, or the purchase of materials in our store) we do not collect any information about your payment methods or instruments.

10.

“Usage information”

Like most flying clubs and to the extent required by the Spanish Aviation Safety Agency and applicable aviation legislation, certain data is collected automatically when you use the Service and this information is recorded in the corresponding files. For example, when you make a reservation through the Aircraft Reservation online tool (Private-Radar), all data related to it is stored linked to your “Member Account”. Likewise, when you make a flight on a L’Aeroclub aircraft, certain parameters such as the computed flight time, the origin and destination of the flight, the type of aircraft or the number of passengers may be recorded in your account. L’Aeroclub uses this data in different ways: to comply with its legal obligations, to maintain the Airworthiness status of the aircraft, to manage the flight safety program (SGS), to schedule mechanical inspections or also to certify the flight hours carried out with us, among others.

11.

“Cookie information”

When you use our web or cloud applications, visit websites, or retrieve resources (for example, files or other information) that are part of a website, certain data known as cookies is sent to the device you are using and will be stored over there. Your web browser stores them either at our request or at the request of a third party whose services we use. Each cookie, in one way or another, distinguishes you from other users and visitors to the website.

In this Policy, the word “cookie” also refers to objects delivered by those techniques. Cookies vary by nature and purpose. For example, a “session cookie” only exists in the temporary memory of your device, that is, for the duration of your Service session or visit a website, and is generally deleted when you close your web browser. A “persistent cookie”, on the other hand, has a longer lifespan: it remains on your device until you delete it (i.e. tell your browser to do so) or until it expires. A “secure cookie” can only be sent over a “secure” (encrypted) connection, making it difficult for others to intercept information. A “first-party cookie” belongs to us and a “third-party cookie” belongs to someone other than L’Aeroclub, for example, a company that provides us with services or website analysis services or that delivers our messages (such as advertisements) to through the Internet.

Some of the above cookies are associated with your user account and certain profile information, to log into the service and remember that you are logged in (which allows you to use the service, improve security and help us show you the correct content ). Other cookies allow us (or third parties we have engaged) to recognize and count the number of visitors to a website, see how they move around the site when using it, what links they follow and who reads what, or selectively record and analyze how and with what means users interact with our applications (only specific data is collected and without identifying users).

Some cookies are used to recognize you when you return to a website, allowing us to personalize our content and remember your preferences, for example your choice of language. And, more importantly from a privacy aspect, there are third-party cookies that collect information about your browsing activities over time and across different websites after use (i.e. tracking your online behavior) , which may result in advertisements or other messages being displayed based on your browsing history.

You will encounter all of these cookies when you interact with our applications, websites or online web resources. Cookies are vital for the use of the websites. However, you can delete them (individually, in selections, or all in one sweep) and it is possible to refuse their use entirely or reject certain types of them (your browser tools or support pages will tell you how to do this). But if you don’t allow first-party cookies, your experience on the websites will be noticeably inferior, or at least not as intended. Typically, third-party cookies can be managed by tools provided by those parties. Some of these tools are available here:

• https://adssettings.google.com (Google advertising settings);

• https://tools.google.com/dlpage/gaoptout (disabling Google Analytics);

• https://www.facebook.com/policies/cookies (Facebook cookie and opt-out policy);

At the end of this policy, you will always find an updated list of all cookies used on our websites. We cannot use such cookies unless you agree to it, and by accepting this Policy, we understand that you give us your consent to do so. If the device you are using is not your own (for example, if you are using the Service or visiting a Website on another person’s computer or smart device), we expect that you have permission from the owner to store our cookies on the device and recover information from it as described in this Policy. By using the device, you are confirming to us that you are authorized.

12.

“Contact information”

We receive from you information that you provide to us by filling out forms (for example, information requests or questionnaires) on a website or through the Service; or when you participate in our campaigns or programs related to the service, registering to receive current or future notifications, newsletters or other communications from us; requesting assistance in using the Service; interacting with our social media accounts; or when you communicate with L’Aeroclub through written correspondence or by any other means.

If you email us or send us a letter or message, we may keep a record of that communication, including your name and address, email address or telephone number (as applicable), the content of your communication, and our response. . We may supplement this data with other Information.

13.

The purposes for which the information is processed and the legal reasons for such processing are varied and depend on the nature of the information, although in part they have been set out in the previous points. If the information is anonymous or de-identified, we may collect, use, disclose or otherwise process it for any purpose. Our processing of personal data is, however, limited to the purposes set out in this Policy.

14.

Typically, we will process your Personal Data in the following circumstances:

• if we need to perfect an agreement you have with us or if it is necessary to take pre-contractual steps at your request before entering into such an agreement (we will refer to these reasons as “Contractual“);

• when we have to comply with a legal obligation, for example, derived from aeronautical legislation or regulations on taxes, accounting, financial information, prevention of terrorism or money laundering, or judicial or administrative process (“legal reasons”);

• if justified by our legitimate interests or those of a third party and such interests are not overridden by yours or your fundamental rights and freedoms (in this case, processing would be based on “Interest” grounds);

• if we have your unambiguous consent before processing your Personal Data in that specific situation (which allows us to process this data on the basis of “Consent“).

15.

Each of the categories of information described in sections 8 – 12 may include your Personal Data, but not all of those categories may apply to you (for example, if you are not a Member, we are unlikely to have information about you, and the The only categories of information relevant to you would be “Cookie Information” if you visit our website and “Contact Information” if you have given us your consent to receive communications from us or have requested information from us by some means).

The table below sets out the purposes for which your Personal Data in the specified category of Information will or may be stored, used, disclosed or processed in any way, and the above reasons on which we rely when doing so. Where processing is based on interest, we have also identified what the legitimate interest is in that particular case.

Please note that we may need to process the same pieces of your Personal Data for several purposes simultaneously and for more than one reason (for example, for contractual reasons, as well as based on interest, and perhaps also based on a legal requirement). Please also note that not all Personal Data in a particular category of Information is processed for all of the purposes specified in relation to that category (and on the grounds corresponding to those purposes).

Please contact us if you would like to know precisely which of the above purposes and in what circumstances applies to the processing of a specific piece of your personal data. Our contact details are provided at the end of this Policy.

Table 1. Why and for what purposes we may use your Personal Data

16.

The communications we initiate with you can be broadly classified as:

• Service Messages: technical messages related to the Service, administrative and/or commercial, legal, and promotional communications that we direct to the Members of L’Aeroclub and that only the Members of L’Aeroclub receive and

• Marketing Messages: messages about products, services, events and other matters in which you have shown your interest or that we believe may interest you, and that you can receive by prior subscription, regardless of whether you are a Member of L’Aeroclub or not.

17.

You can unsubscribe from certain messages by following the instructions provided in the message. However, there are some messages that form an essential part of the Service (for example, alerts or communications related to Flight Safety, among others) and that you cannot opt out of receiving while you remain an active Member of L’Aeroclub.

Regarding marketing messages, you can always opt out, but the variety of procedures for doing so may depend on the nature of the message. For example, in email communications, you can request that your email address be removed from our communication list, or change your preferences through the links at the bottom of the message.

If you have trouble unsubscribing from such messages, please contact us (our details are at the end of this Policy) and we will exclude you. Please note that this will prevent you from receiving Marketing Messages but you will continue to receive Service Messages as long as you maintain your active status as a L’Aeroclub Member.

18.

In general, no one is obliged to give us their Personal Data, but failure to do so may mean (or depending on the circumstances, will mean) that we are not able to achieve the data processing purposes specified for the case in question (as listed in Table 1 in section 15) and the Information Owner in particular may lose (or, respectively, will lose) the benefits corresponding to that purpose for which the Data was collected by L’Aeroclub.

19.

If we need to collect your Personal Data by law or under the terms of a contract we have with you, or to enter into such a contract, and you do not provide that data when requested (such as for your registration as a Member of L’Aeroclub, your enrollment in an aeronautical training course, or your consent to receive communications from L’Aeroclub), we may not be able to make or enter into the corresponding contract (which may be a contract for the provision of said Service or some other benefit).

If this is the case, we may have to cancel the Service that we were going to provide or that we had been providing to you (for example, stop receiving information about offers, courses or discounts).

20.

If you limit a website’s ability to set cookies, it may, and in some cases definitely will, prevent you from using that application or site or some of its features, or may worsen your user experience (such as the website in question does not appear personalized for you). It may also prevent you from saving personalized settings and you may be required to validate your access to the Website more frequently during your browsing session.

21.

We only store your Personal Data for as long as it is necessary in light of (or compatible with) the purposes for which the data was collected (for example, maintaining your Member status active under your agreement with us, or receiving the communications from L’Aeroclub in accordance with your subscription preferences, if that was their sole purpose), plus the additional period required by law.

22.

Legal retention periods vary depending on the type of information in question, and can be quite long. For example, Personal Data relevant to our accounting or tax purposes (which is likely to be the case for some of the Personal Data in the Membership Account and Billing Information categories, and may also apply to other Personal Data) must be retained for at least 3 years after the primary purpose of your processing no longer applies (for example, 3 years after the financial year in which our business relationship with you ended and the last transaction between us occurred).

In some cases, such as information related to your flight activity and the use of our aircraft, the retention period may be significantly longer (up to 10 years) to be able to certify said activity if we are required at any time, either by the Spanish Aviation Safety Agency (AESA) within the framework of our certification as ATO, or by yourself if you require it in the future.

23.

This part of the Policy describes the circumstances in which we may disclose or transmit your Personal Data to third parties. Please note that the following sections only address disclosures and transmissions of Personal Data and not, for example, Anonymous or De-identified Information (which we may transmit and disclose at any time to anyone anywhere, in any way and for any purpose) .

24.

Occasionally we may offer you services or products from external suppliers for which we have negotiated exclusive conditions for L’Aeroclub members (discounts or special rates). In such cases we will only share the Personal Data that is necessary with the external service provider if you require us to do so.

In any case, please note that we are not responsible for the privacy practices (or other actions or omissions) of such third-party service providers, so it would be advisable for you to ensure, before accepting such service or product, that You trust the service and provider in question and are satisfied with their policies.

25.

We use third-party service providers to help us provide, maintain, develop, protect and promote the Service and the Websites. We may, for example, use such providers to host a website, send service messages or marketing messages, provide or offer customer support services, perform analytics related to the Service or a website, or process payments.

We may also store personal data in locations outside our direct control, for example, on third-party cloud infrastructure or platforms (IaaS / PaaS / SaaS) or on cloud infrastructure whose operation we have entrusted to other parties. These service providers may have access to your Personal Data for the limited purpose of providing the service we have requested from them. Most importantly for you as the Data Subject, our use of such service providers may involve the transmission of your Personal Data to jurisdictions other than the one in which you reside. In this case, section 32 will apply.

26.

In relation to the previous point, and more specifically, we will share the Personal Data necessary to offer you the Online Reservation Service with an external provider designated by L’Aeroclub for the sole purpose specified. In the same way, said provider will share with L’Aeroclub the information collected by the Reservation system during its use, in order to complete the provision of said service and store the result thereof, all in accordance with the provisions of this Policy.

27.

We may share your personal data with external accountants, lawyers and auditors for the purposes specified in section 15.

28.

We may encounter situations where we are legally required to disclose some or all of your Personal Data or where we believe we are reasonably required to do so. This may arise if we receive a request for information from a competent Aeronautical Authority, or if there is a law or regulation that requires us to make a disclosure without a specific request (for example, if this is necessary to comply with national Aeronautical Regulations). or international).

We may also be required to disclose your Personal Data by judicial, arbitral, administrative or other mandatory order or judgment. Where any of the above applies, we will make the disclosure and may not be able to tell you that your Personal Data has been disclosed.

29.

There may also be situations where we may consider that the disclosure of your Personal Data is necessary to exercise, enforce or defend our rights, freedoms or legitimate interests, or to protect the rights, freedoms or legitimate interests of a third party (e.g. to address an insurance claim, accident or other legal requirement).

30.

We will also disclose your Personal Data if you ask us to do so, or give us your consent to do so (unless it is legally prohibited, the request is impracticable, or it involves unreasonable effort or expense).

31.

We may transfer your Personal Data to jurisdictions other than the one in which you reside, subject to section 32.

32.

We will not transfer your Personal Data from countries that participate in the European Economic Area (“EEA”) to those that do not, or from the EEA to international organizations, unless the recipient country or the particular person or entity receiving the data guarantee a level of protection of the data received, or, if it does not, without applying the legally required safeguards and/or without the transfer being subject to other conditions that the law establishes for this type of transfers.

For example, if we are transferring your Personal Data from the EEA to a recipient in the United States (which is likely to happen when using some of the service providers mentioned in section 25), we will ensure that the recipient participates in the EU-US Privacy Shield Framework, having also self-certified as ensuring a level of protection of Personal Data that is essentially equivalent to that guaranteed under GDPR.

33.

We will maintain appropriate technical and organizational measures to ensure such level of security in our processing of personal data as appropriate in the given circumstances. When assessing whether a measure is appropriate and what level of security is appropriate, we consider the nature of the personal data we are processing and the nature of the processing operations we carry out, the risks to which you are exposed by our processing of your personal data . the state of the art, implementation costs and other matters that may be relevant in the particular circumstances.

34.

The measures referred to in the previous section address in particular the following:

• the protection of Personal Data against unauthorized or unlawful processing and against accidental loss, alteration or destruction;

• the integrity and confidentiality of personal data;

• the availability and resilience of features of the Service related to the processing of Personal Data; and

our ability to restore the availability of and access to Personal Data in a timely manner following a failure of the Service.

35.

However, keep in mind that no security measure is perfect. Despite our efforts, we cannot guarantee that your Personal Data, while transmitted over the Internet or stored on our systems or those of our service providers or while in our care, will be absolutely safe from unauthorized or unlawful processing. or accidental loss, alteration or destruction, or that will in fact be intact and confidential at all times, or available promptly, after any incident on the Service.

Please also note that we cannot control, and are not responsible for, the actions of other parties with whom you share (or direct us to share) your Personal Data.

36.

“Data subjects” in the EEA have certain legal rights under the GDPR in respect of the personal data we hold about them. This part of the Policy is intended to provide you with a general understanding of these rights and we encourage you to deepen this understanding by studying the GDPR yourself. To facilitate this, we have provided, in relation to each of the rights listed below, a reference to the specific provision of the GDPR from which that right arises. Specifically, and subject to any legal exceptions that apply in your particular case, your rights as a Data Subject include the following:

37.

Right of access / GDPR Article 15

You have the right to request and obtain confirmation from us as to whether or not we process your Personal Data. At any time, you can request access to that data and ask us to give you a copy. If you are a Member, or have simply provided us with your data to subscribe to our communications, you can access all the personal data we have about you by contacting the L’Aeroclub Front Desk, using the contact information at the end of this page. Policy and indicating that you want to exercise your “right of access”.

38.

Right to rectification / GDPR Article 16

If the personal data we hold about you is incorrect, you have the right to request that we correct that data and, in some circumstances, you may have the right to request that your incomplete Personal Data be completed (but in each of these cases we may need to verify the accuracy of the information you provide us). As with the “right of access”, Users can and are encouraged to update Personal Data by contacting the Front Desk.

39.

Right to erasure (right to be forgotten) / GDPR Article 17

You have the right to request that we delete or erase the Personal Data we hold about you, where there is no good reason for us continuing to process it. Please note that we may not always be able to comply with your request as there may be specific legal reasons that justify processing. If this is the case, we will inform you accordingly at the time of your request.

40.

Right to object / GDPR Article 21

You have the right to object to our processing of your Personal Data, when the processing is based on Interest and you have some reason related to your particular situation that prompts you to object to the processing on those grounds, or when you think it impacts your interests or fundamental rights and freedoms. However, there may be occasions when we demonstrate that we have sufficient legitimate reasons to process your Personal Data (i.e. that our legitimate interests or those of a third party override yours and your fundamental rights and freedoms) and therefore we do not take into account count your objection. Where we process your Personal Data for direct marketing purposes, you can object to such processing at any time and we will not process your Personal Data for such purposes.

41.

Right to restriction of processing / GDPR Article 18

You have the right to request that we suspend the processing of your Personal Data where any of the following applies:

• you have disputed the accuracy of the data and it must be verified;

• the processing is unlawful but you do not want us to erase the data we are processing;

• you need us to keep the data even if we no longer need it, as it is necessary for the establishment, exercise or defense of legal claims; either

• you have objected to the processing as described in section 40, but we must verify whether we have a legitimate ground for the processing.

42.

Right to data portability / GDPR Article 20

If our processing of Personal Data that you have provided to us is based on a Contractual Agreement or Consent and the processing is carried out by automated means, you have the right to have that data available to you in a structured, commonly used format. and machine-readable so that you can transmit them to another person (another “controller”). You can also ask us to transmit this data to that other “controller” directly, and we will do so, if technically feasible.

43.

Right to withdraw consent / GDPR Article 13, subsection (2) (c)

If we are processing your Personal Data based on consent, you can withdraw that consent at any time (but this will not affect the lawfulness of processing activities carried out based on your consent before its withdrawal).

44.

As indicated above, you may be able to exercise some of your rights as the Owner of the Information (such as the “right of access” and the “right to rectification”) through the communication itself (links in the email), of the access to your User Account on the website or through the Online Reservation Service itself. If you are unable to do so, especially if you do not have a User Account, or if the right in question cannot be exercised, please use the contact details at the end of this Policy to contact us via the Front Desk and we will do what we can. we reasonably can to facilitate the exercise of your rights.

45.

We aim to respond to any legitimate request within one month of receipt, but it may take longer if your request is particularly complex or if you have made several requests. If that is the case, we will keep you promptly informed throughout the process.

46.

We will not charge you any fee for exercising the above rights unless your requests are clearly unfounded or excessive (for example, due to their repetitive nature), in which case we may charge you a reasonable fee. Alternatively, we may reject your request in such circumstances.

47.

In the event that you believe that we are processing your Personal Data in breach of the GDPR, you have the right to lodge a complaint with the “supervisory authority” located in the EEA country where you reside or work, or where the alleged infringement occurred, or you may file the complaint to our “supervisory authority” the Spanish Data Protection Agency (aepd.es)

48.

We may revise this Policy from time to time to reflect changes to the Service, websites, applicable laws, regulations or standards or other changes that may occur in our business. We will post the revised Policy (or, as applicable, our new privacy policy) on the same web page where we post this Policy or on another web page that we may regularly use to post materials such as the Policy.

We may also use the Service, email or other means to notify Users of such policy changes. The revised (or, as applicable, new) Policy will be effective when posted as described, unless the document itself specifies a later time for its entry into force.

49.

Please do not hesitate to contact us if you have any questions about this Policy or our data processing practices or if you wish to exercise any of your rights as a Data Subject with respect to the Personal Data we hold about you.

Send us an email: protecciondedatos@aeroclub.es or call us at +34 937 101 952

Aeroclub de Barcelona-Sabadell
Aeroport de Sabadell
08205 Sabadell
Barcelona

Policy in force as of May 25, 2018

Cookie Information