Privacy notice

This notice describes how this service handles personal data of people who register, subscribe, or request access to a classified flight.

Who is responsible

Assets Portal operator
support@secd.eu

Set the operator's legal name and contact address with CONTROLLER_NAME and CONTROLLER_EMAIL before this service is offered to the public. The operator also needs contracts with the mail host and with PayPal.

What is processed

• A username chosen at registration, the email address used to sign in, a subject identifier, and a passkey held by the identity provider, so the account can be recognised in the portal and in QGIS. A password is not collected.
• Whether the email has been verified. A one-time link is emailed to that address so you can confirm it.
• The PayPal subscription id, the monthly price, and the date the current period ends. PayPal holds the payment method. This service does not store a card number.
• Certificates for included flights, and the status of a classified request.
• For a classified request, one email to the operator containing your email, the flight id, and the order id.
• A sign-in cookie on this site. The identity token used to sign you out is kept in that browser and is not written to the database.

The username is the greeting in the portal. PayPal sees the subscription and the amount. This service does not send your email to PayPal.

Why

The account, the subscription, and the classified-request email are used to provide the certificate you asked for. After a subscription ends, the certificates for included flights are cancelled. The subscription record and a cancelled certificate stay so the payment can still be accounted for, without a link to your account once you delete it.

How long

• A sign-in session ends when you sign out, and otherwise after 1 hour.
• An unpaid subscription that was never confirmed is deleted after 30 days.
• A denied request is deleted after 90 days.
• A subscription record, and a certificate or grant, is deleted after 7 years.

Your choices

From Account you can download the data held for you and delete the account. Deletion removes the account, open and denied requests, and the link between you and any completed order. The completed order itself is kept, without your identity, until the period above ends. An email change is done at the identity provider, linked from Account.

You can also complain to the data protection authority in your country.