Privacy Policy

<h5>The purpose of this Privacy Policy (“Policy”) is to explain how, when, and why L’Aeroclub collects information about individuals, and how, for what purposes, and on what legal basis such “Personal Data” is subsequently processed, who processes it, and what rights individuals have in relation to their Personal Data.</h5>
&nbsp;

• This Policy also explains L’Aeroclub’s practices regarding the use of cookies and other technologies to store information on users’ devices and to access information from those devices.

• When we refer to “L’Aeroclub” or use the terms “we”, “us”, or “our”, we mean Aeroclub de Barcelona-Sabadell, with its registered office at Sabadell Airport, 08205 Sabadell, Barcelona, Spain, and registered with the Barcelona Mercantile Registry, Volume 2021, Book 1425 of Section 2, Folio 245, Sheet No. 21131, Entry 23. Commercially, it may operate under the trade names “L’Aeroclub” or “Barcelona Flight School”.

• By “you”, we mean the individual reading this Policy, that is, you as a natural person (and not any company or other organization with which you may be associated).

• Certain words and phrases in this Policy appear in quotation marks (for example, “Data Controller”, “Data Processor”, and “Data Subject”). These are legal terms that have the meanings assigned to them under the European Union General Data Protection Regulation, Regulation (EU) 2016/679 (“GDPR”).

1.

This Policy applies to the processing of Personal Data carried out through or in connection with the following:

• the provision of L’Aeroclub’s services to its Members, whether through the use of aircraft and facilities owned by L’Aeroclub under the conditions established by applicable legislation and the Club’s Articles of Association, or through the use of software owned by L’Aeroclub or by third parties and made available to its Members in connection with the provision of such services (for the purposes of this Policy, “software” means computer programs in any form, including locally installed desktop and mobile applications, as well as software provided as on-demand services, such as web-based and cloud applications). Throughout this Policy, the term “Service” or “Services” refers to all of the above, as well as to any service, resource, or other benefit provided by L’Aeroclub or any company appointed by L’Aeroclub as part of, or in connection with, such Services;

• the use of the websites https://aeroclub.es, https://barcelonaflightschool.com, or any other website owned by L’Aeroclub (the term “website” in this Policy refers to any of these websites);

• any communication or interaction between you and L’Aeroclub, by any means;

provided that the above activities are not subject to other policies established by L’Aeroclub in its Articles of Association or any similar governing document.

2.

This Privacy Policy applies to you in substantially the same way whether you are a current Member of L’Aeroclub or have simply provided us with your Personal Data so that we may keep you informed about our activities and news through one of our communication channels. The following sections explain the differences regarding the categories of Personal Data that we may process in each case.

3.

When we refer to “Personal Data”, we mean any information relating to an individual by which that person can be identified (the legal definition of “Personal Data” is “any information relating to an identified or identifiable natural person”, with the person to whom such information relates being known as the “Data Subject”).

Personal Data does not include information that cannot reasonably be used to identify an individual, that is, anonymous information or Personal Data that has been anonymized in such a way that the individual is not, or is no longer, identifiable (anonymous or de-identified information). This Policy does not apply to such information.

4.

This Policy supplements other L’Aeroclub policies, including those relating to the use of the Services and Safety Management. In particular, it complements all terms of use set out in the Articles of Association that are binding on Members and is not intended to replace or override them under any circumstances.

5.

L’Aeroclub’s core activity is to provide its Members with a wide range of services related to aviation, social activities, and training (collectively, the “Service”). To do so, it is necessary to process certain data in various ways.

We need to process different types of data for different purposes in order to carry out our activities on an ongoing basis and ensure that the Service is delivered effectively and satisfactorily to our Members. This includes providing, maintaining, and managing the Service and the Websites, as well as communicating with you. Not all of this information constitutes Personal Data, and some of the processing is carried out by third parties that are not part of L’Aeroclub.

6.

L’Aeroclub is the Data Controller (and, where applicable, the Data Processor) of the Personal Data that we, or third parties acting on our behalf, collect through the activities described in Section 1 of this Policy, or that is otherwise processed for the purposes of our activities. The following sections explain the collection and subsequent processing of this data in greater detail.

7.

L’Aeroclub collects, generates, and receives information in a variety of ways. Some of this information constitutes Personal Data, while the remainder does not. Throughout this Policy, the term “Information” refers to any and all data that we collect, generate, or otherwise process, whether directly by us or by a third party acting on our behalf. This section of the Policy describes the types of Information we collect or generate, and how it is collected or generated through the activities described in Section 1.

8.

“Member Account”

We collect information about you during the negotiation, preparation, execution, and amendment of agreements between you and L’Aeroclub for the purpose of registering you as a Member. The information collected may include the data provided in such agreements, any information you provide for the purpose of negotiating, entering into, or amending those agreements, and/or any additional information subsequently required to provide the Service. For example, when you register as a Member, we ask for your full name, date of birth or age, postal address, telephone number, email address, nationality, country of residence, and other identifying information such as your national identity card, passport, or foreign identity number (NIE).

In order to comply with L’Aeroclub’s legal obligations under applicable aviation regulations and to provide the Service in accordance with those requirements, we also collect information relating to your pilot licences and ratings, aeromedical certificate, flight experience, and the renewal status of such qualifications.

We will also assign you a unique membership number linked to your Member Account. All of this information is stored in our database and may be used for purposes including, but not limited to, determining your eligibility to participate in flight activities under different conditions (according to your experience and the licences and ratings you hold), and notifying you of the upcoming expiry of your aviation documentation.

9.

“Billing Information”

To process the payment of membership fees required to maintain your status as an active Member of L’Aeroclub, we ask you to provide the full name of the individual or entity responsible for payment, their postal address, the bank account details required for direct debit payments, and, where applicable, their VAT number (i.e. the registration number of a taxable person for value-added tax purposes).

The person or entity responsible for paying the membership fees may or may not be the Member. Accordingly, we may receive the above information about you from another individual or user. For services requiring additional payments (such as training courses, aircraft rental, airport fees, or purchases from our shop), we do not collect or store any information relating to your payment methods or payment instruments.

10.

“Usage Information”

Like most flying clubs, and to the extent required by the Spanish Aviation Safety and Security Agency (AESA) and applicable aviation legislation, certain information is collected automatically when you use the Service, and such information is recorded in the relevant records and logs. For example, when you make a booking through the online Aircraft Reservation System (Private-Radar), all information relating to that booking is stored and linked to your Member Account. Likewise, when you operate a flight in a L’Aeroclub aircraft, certain data such as flight time logged, departure and destination aerodromes, aircraft type, and number of passengers may be recorded in your Member Account. L’Aeroclub uses this information for a variety of purposes, including complying with its legal obligations, maintaining the continuing airworthiness status of its aircraft, managing its Safety Management System (SMS), scheduling aircraft maintenance and inspections, and certifying the flight hours you have accumulated with us, among other purposes.

11.

“Cookie Information”

When you use our web-based or cloud applications, visit websites, or access resources (for example, files or other information) that form part of a website, certain data known as cookies is sent to the device you are using and stored there. Your web browser stores these cookies either at our request or at the request of a third party whose services we use. Each cookie, in one way or another, distinguishes you from other users and visitors to the website.

In this Policy, the term “cookie” also refers to similar technologies that perform the same or comparable functions. Cookies vary according to their nature and purpose. For example, a “session cookie” exists only in your device’s temporary memory while your Service session or website visit is active and is generally deleted when you close your web browser. A “persistent cookie”, on the other hand, has a longer lifespan: it remains on your device until you delete it (that is, instruct your browser to do so) or until it expires. A “secure cookie” can only be transmitted over a secure (encrypted) connection, making it more difficult for others to intercept the information it contains. A “first-party cookie” belongs to us, while a “third-party cookie” belongs to an organisation other than L’Aeroclub, for example, a company that provides services to us, website analytics services, or delivers our messages (such as advertisements) over the Internet.

Some of the above cookies are associated with your user account and certain profile information in order to sign you in to the Service and remember that you are signed in (allowing you to use the Service, improving security, and helping us display the correct content to you). Other cookies enable us (or third parties acting on our behalf) to recognise and count the number of visitors to a website, understand how visitors move around the site, identify which links they follow and which content they view, or selectively record and analyse how and by what means users interact with our applications (only specific, non-identifiable data is collected).

Some cookies are used to recognise you when you return to a website, allowing us to personalise our content and remember your preferences, such as your language selection. More importantly from a privacy perspective, certain third-party cookies collect information about your browsing activities over time and across different websites after your visit (that is, tracking your online behaviour), which may result in advertisements or other messages being displayed based on your browsing history.

You will encounter all of these cookies when interacting with our applications, websites, or online resources. Cookies are essential for the proper operation of websites. However, you may delete them (individually, selectively, or all at once), refuse their use entirely, or reject specific categories of cookies (your browser settings or support pages will explain how to do this). However, if you do not allow first-party cookies, your experience on our websites will be significantly reduced or may not function as intended. Third-party cookies can generally be managed using the tools provided by those third parties. Some of these tools are available here:

• https://adssettings.google.com (Google Ads Settings);

• https://tools.google.com/dlpage/gaoptout (Google Analytics Opt-out Browser Add-on);

• https://www.facebook.com/policies/cookies (Facebook Cookies Policy and Opt-out Information);

At the end of this Policy, you will always find an up-to-date list of all cookies used on our websites. We will not use such cookies unless you have accepted them, and by accepting this Policy, we understand that you consent to their use. If the device you are using does not belong to you (for example, if you are using the Service or visiting a Website on someone else’s computer or smart device), we expect that you have the owner’s permission to store our cookies on the device and retrieve information from it as described in this Policy. By using the device, you confirm that you are authorised to do so.

12.

“Contact Information”

We receive the information you provide when you complete forms (for example, information requests or questionnaires) on a website or through the Service; when you participate in our Service-related campaigns or programmes; when you register to receive notifications, newsletters, or other current or future communications from us; when you request assistance in using the Service; when you interact with our social media accounts; or when you contact L’Aeroclub by written correspondence or by any other means.

If you send us an email, letter, or other message, we may keep a record of that communication, including your name and address, email address or telephone number (as applicable), the content of your communication, and our response. We may combine this information with other Information.

13.

The purposes for which Information is processed, and the legal bases for such processing, vary depending on the nature of the Information, although some have already been described in the preceding sections. Where Information is anonymous or does not identify an individual, we may collect, use, disclose, or otherwise process it for any lawful purpose. The processing of Personal Data, however, is limited to the purposes set out in this Policy.

14.

Normally, we will process your Personal Data in the following circumstances:

• where it is necessary to perform a contract with you or to take steps at your request prior to entering into such a contract (we refer to these as “Contractual” grounds);

• where we are required to comply with a legal obligation, for example, arising under aviation legislation or regulations relating to taxation, accounting, financial reporting, anti-terrorism, anti-money laundering, or judicial or administrative proceedings (“Legal” grounds);

• where processing is justified by our legitimate interests or those of a third party, provided that such interests are not overridden by your interests or your fundamental rights and freedoms (in this case, processing is based on “Legitimate Interests” grounds);

• where we have obtained your explicit consent before processing your Personal Data for a specific purpose (allowing us to process such data on the basis of “Consent“).

15.

Table 1. Why and what for we may use your Personal Data

16.

• Service Messages: technical messages related to the Service, administrative and/or commercial, legal, and promotional communications that we direct to L’Aeroclub Members and, which are only received by L’Aeroclub Members and

• Marketing Messages: messages about products, services, events and other matters in which you have shown interest or that we believe may interest you, and which you may receive by prior subscription, regardless of whether you are a L’Aeroclub Member or not.

17.

You may opt out of certain messages by following the instructions provided in the message itself. However, some messages are an essential part of the Service (for example, alerts or communications related to Flight Safety, among others) and you cannot opt out of receiving these while you remain an active Member of L’Aeroclub.

With regard to Marketing Messages, you may always choose not to receive them, although the procedure for doing so may vary depending on the nature of the message. For example, in email communications, you may request that your email address be removed from our mailing list or update your communication preferences using the links provided at the bottom of the message.

If you experience any difficulties unsubscribing from these messages, please contact us (our contact details are provided at the end of this Policy), and we will remove you from our marketing communications. Please note that this will stop you from receiving Marketing Messages, but you will continue to receive Service Messages for as long as you remain an active Member of L’Aeroclub.

18.

As a general rule, no one is required to provide us with their Personal Data. However, failure to do so may mean (or, depending on the circumstances, will mean) that we are unable to achieve the data processing purposes specified for the relevant case (as set out in Table 1 in Section 15). Consequently, the Data Subject may lose (or, as applicable, will lose) the benefits associated with the purpose for which L’Aeroclub collected the Personal Data.

19.

If we are required to collect your Personal Data by law, under the terms of a contract we have with you, or in order to enter into such a contract, and you fail to provide the requested data (for example, for your registration as a Member of L’Aeroclub, your enrolment in an aeronautical training course, or your consent to receive communications from L’Aeroclub), we may not be able to perform or enter into the relevant contract (which may be a contract for the provision of such Service or any other benefit).

In such a case, we may have to cancel the Service that we were due to provide or are currently providing to you (for example, you may no longer receive information about offers, courses, or discounts).

20.

If you restrict a website’s ability to set cookies, you may, and in some cases certainly will, prevent the use of that application or website, or some of its features, or otherwise impair your user experience (for example, the website may no longer be personalised for you). It may also prevent you from saving your customised settings, and you may be required to verify your access to the Website more frequently during your browsing session.

21.

We only retain your Personal Data for as long as is necessary in light of (or consistent with) the purposes for which it was collected (for example, to maintain your active Membership status under the agreement you have with us, or to send you communications from L’Aeroclub in accordance with your communication preferences, where that was the sole purpose for collecting your data), plus any additional period required by applicable law.

22.

Statutory data retention periods vary depending on the type of information concerned and may be quite lengthy. For example, Personal Data relevant to our accounting or tax obligations (which is likely to include certain Personal Data within the Member Account and Billing Information categories, and may also apply to other Personal Data) must be retained for at least three (3) years after the primary purpose for its processing no longer applies (for example, three years after the financial year in which our business relationship with you ended and the last transaction between us took place).

In some cases, such as information relating to your flight activity and your use of our aircraft, the retention period may be significantly longer (up to ten (10) years) in order to enable us to certify such activity if required at any time, whether by the Spanish Aviation Safety and Security Agency (AESA) in connection with our certification as an Approved Training Organisation (ATO), or by you should you request such certification in the future.

23.

This section of the Policy describes the circumstances in which we may disclose or transfer your Personal Data to third parties. Please note that the following sections address only the disclosure and transfer of Personal Data and do not apply, for example, to anonymous or de-identified information, which we may disclose or transfer at any time, to any person, anywhere, in any manner, and for any purpose.

24.

From time to time, we may offer you services or products from third-party providers for which we have negotiated exclusive terms for L’Aeroclub members (such as discounts or special rates). In such cases, we will only share the Personal Data that is necessary with the third-party service provider if you request us to do so.

In any event, please note that we are not responsible for the privacy practices (or any other actions or omissions) of such third-party service providers. Therefore, before accepting any such service or product, you should ensure that you trust the relevant service and provider and are satisfied with their policies.

25.

We use third-party service providers to help us provide, maintain, develop, protect, and promote the Service and the websites. For example, we may use such providers to host a website, send service or marketing messages, provide or offer customer support services, carry out analyses relating to the Service or a website, or process payments.

26.

In relation to the previous point, and more specifically, we will share the Personal Data necessary to provide you with the Online Booking Service with a third-party provider appointed by L’Aeroclub, solely for the specific purpose stated. Likewise, such provider will share with L’Aeroclub the information collected by the Booking system during its use, in order to complete the provision of such service and store the outcome thereof, all in accordance with the provisions of this Policy.

27.

We may share your Personal Data with external accountants, lawyers, and auditors for the purposes specified in Section 15.

28.

We may find ourselves in situations where we are legally required to disclose some or all of your Personal Data or where we believe that we are reasonably required to do so. This may occur if we receive a request for information from a competent Aviation Authority, or if there is a law or regulation requiring us to make a disclosure without a specific request (for example, where this is necessary to comply with national or international Aviation Regulations).

We may also be required to disclose your Personal Data pursuant to a court, arbitration, administrative, or other legally binding order or decision. Where any of the above circumstances apply, we will make the disclosure and may not be able to inform you that your Personal Data has been disclosed.

29.

There may also be situations in which we consider that the disclosure of your Personal Data is necessary to exercise, enforce, or defend our rights, freedoms, or legitimate interests, or to protect the rights, freedoms, or legitimate interests of a third party (for example, to address an insurance claim, accident, or other legal requirement).

30.

We will also disclose your Personal Data if you request us to do so or provide us with your consent (unless this is legally prohibited, the request is impracticable, or it would involve unreasonable effort or expense).

31.

We may transfer your Personal Data to jurisdictions other than the one in which you reside, subject to Section 32.

32.

We will not transfer your Personal Data from countries participating in the European Economic Area (“EEA”) to countries that do not participate in the EEA, or from the EEA to international organisations, unless the receiving country or the particular person or entity receiving the data ensures an adequate level of protection for the transferred data, or, where this is not the case, without implementing the legally required safeguards and/or ensuring that the transfer is subject to any other conditions required by law for this type of transfer.

For example, if we are to transfer your Personal Data from the EEA to a recipient in the United States (which is likely to occur when using some of the service providers mentioned in Section 25), we will ensure that the recipient participates in the EU-U.S. Privacy Shield Framework and has self-certified that it provides a level of Personal Data protection that is essentially equivalent to that guaranteed under the GDPR.

33.

We will maintain appropriate technical and organisational measures to ensure such a level of security in our processing of Personal Data, as appropriate in the circumstances. When assessing whether a measure is appropriate and determining what level of security is suitable, we take into account the nature of the Personal Data we are processing and the nature of the processing operations we carry out, the risks to which you are exposed as a result of our processing of your Personal Data, the state of the art, the costs of implementation, and any other matters that may be relevant in the particular circumstances.

34.

The measures referred to in the previous section address, in particular, the following:

• the protection of Personal Data against unauthorised or unlawful processing and against accidental loss, alteration, or destruction;

• the integrity and confidentiality of Personal Data;

• the availability and resilience of Service features relating to the processing of Personal Data; and

our ability to restore the availability of and access to Personal Data in a timely manner following a Service failure.

35.

However, please note that no security measure is perfect. Despite our efforts, we cannot guarantee that your Personal Data, whether transmitted over the Internet, stored on our systems or those of our service providers, or otherwise under our care, will be completely protected against unauthorised or unlawful processing, or against accidental loss, alteration, or destruction, or that it will remain intact and confidential at all times, or become available within a short period following any incident affecting the Service.

Please also note that we cannot control, and are not responsible for, the actions of other parties with whom you share (or instruct us to share) your Personal Data.

36.

Data subjects in the EEA have certain legal rights under the GDPR regarding the Personal Data we hold about them. This section of the Policy is intended to provide you with a general understanding of these rights, and we encourage you to develop your understanding further by reviewing the GDPR yourself. To assist you, we have provided, in relation to each of the rights set out below, a reference to the specific GDPR provision from which that right arises. Specifically, and subject to any applicable legal exceptions in your particular case, your rights as a Data Subject include the following:

37.

Right of Access / GDPR Article 15

You have the right to request and obtain confirmation from us as to whether or not we process your Personal Data. At any time, you may request access to such data and ask us to provide you with a copy. If you are a Member, or have simply provided us with your data to subscribe to our communications, you can access all the Personal Data we hold about you by contacting the L’Aeroclub Front Desk using the contact details provided at the end of this Policy and stating that you wish to exercise your “right of access”.

38.

Right to Rectification / GDPR Article 16

If the Personal Data we hold about you is inaccurate, you have the right to request that we correct such data and, in certain circumstances, you may have the right to request that incomplete Personal Data be completed (although, in each case, we may need to verify the accuracy of the information you provide to us). As with the “right of access”, Users may, and are encouraged to, update their Personal Data by contacting the Front Desk.

39.

Right to Erasure (Right to be Forgotten) / GDPR Article 17

You have the right to request that we erase or delete the Personal Data we hold about you where there is no good reason for us to continue processing it. Please note that we may not always be able to comply with your request, as there may be specific legal grounds that justify the continued processing of your Personal Data. If this is the case, we will inform you accordingly at the time of your request.

40.

Right to Object / GDPR Article 21

You have the right to object to our processing of your Personal Data where the processing is based on Legitimate Interests and you have grounds relating to your particular situation that lead you to object to the processing on such grounds, or where you believe that it affects your interests or fundamental rights and freedoms. However, there may be circumstances in which we can demonstrate that we have sufficient legitimate grounds to process your Personal Data (i.e., that our legitimate interests, or those of a third party, override your interests and your fundamental rights and freedoms), and therefore we may not uphold your objection. Where we process your Personal Data for direct marketing purposes, you may object to such processing at any time, and we will no longer process your Personal Data for those purposes.

41.

Right to Restriction of Processing / GDPR Article 18

You have the right to request that we suspend the processing of your Personal Data where any of the following applies:

• you have contested the accuracy of the data and the data needs to be verified;

• the processing is unlawful but you do not want us to delete the data we are processing;

• you need us to retain the data even though we no longer require it, as it is needed for the establishment, exercise, or defence of legal claims; or

• you have objected to the processing as described in Section 40, but we need to verify whether we have a legitimate basis for the processing.

42.

Right to Data Portability / GDPR Article 20

Where our processing of the Personal Data you have provided to us is based on a Contractual Agreement or Consent, and the processing is carried out by automated means, you have the right to receive such data in a structured, commonly used, and machine-readable format so that you can transmit it to another person (another “controller”). You may also request that we transmit such data directly to that other “controller”, and we will do so where technically feasible.

43.

Right to Withdraw Consent / GDPR Article 13(2)(c)

If we are processing your Personal Data based on your consent, you may withdraw that consent at any time (but this will not affect the lawfulness of any processing activities carried out based on your consent before its withdrawal).

44.

As stated above, you may be able to exercise some of your rights as a Data Subject (such as the “right of access” and the “right to rectification”) through the communication itself (using the links provided in the email), by accessing your User Account on the website, or through the Online Booking Service itself. If you are unable to do so, particularly if you do not have a User Account, or if the relevant right cannot be exercised through these means, please use the contact details provided at the end of this Policy to contact us through the Front Desk, and we will take all reasonable steps to facilitate the exercise of your rights.

45.

Our aim is to respond to any legitimate request within one month of receiving it, but it may take us longer if your request is particularly complex or if you have submitted multiple requests. If this is the case, we will keep you promptly informed throughout the process.

46.

We will not charge you any fee for exercising the rights described above unless your requests are clearly unfounded or excessive (for example, due to their repetitive nature), in which case we may charge you a reasonable fee. Alternatively, we may refuse to comply with your request in such circumstances.

47.

If you believe that we are processing your Personal Data in breach of the GDPR, you have the right to lodge a complaint with the “supervisory authority” located in the EEA country where you reside or work, or where the alleged infringement took place. Alternatively, you may submit a complaint to our “supervisory authority”, the Spanish Data Protection Agency (aepd.es).

48.

We may review this Policy from time to time to reflect changes to the Service, websites, applicable laws, regulations, or standards, or other changes that may occur in our business. We will publish the revised Policy (or, where appropriate, our new privacy policy) on the same webpage where we published this Policy or on another webpage that we may regularly use to publish materials such as this Policy.

We may also use the Service, email, or other means to notify Users of such policy changes. The revised Policy (or, where applicable, the new policy) will take effect when it is published as described above, unless the document itself specifies a later effective date.

49.

Please do not hesitate to contact us if you have any questions about this Policy or our data processing practices, or if you wish to exercise any of your rights as a Data Subject in relation to the Personal Data we hold about you.

Cookie Information