Data processing
Data processing agreement
Draft – to be reviewed by a legal expert before use.
1. Subject
The processor runs the Aerodrome Helper app with the booked modules for the controller and processes personal data only on its behalf and on its instructions, which are usually given through the functions of the app.
2. Data and data subjects
Contact and master data of pilots, tenants, friends of the aerodrome, applicants and users; data on aircraft, places, movements, requests, receipts, working time and payments, depending on the booked modules.
3. Duties of the processor
- confidentiality of everyone involved;
- appropriate technical and organisational measures: data separated per aerodrome with server-side checks, encrypted transfer, encrypted credentials for third-party systems, audit log with checksum, daily backup;
- support with disclosure, correction and deletion;
- notification of a data security breach without delay;
- after the end of the contract, handover of the data in a common format and subsequent deletion.
4. Sub-processors
- data centre for servers and database (Germany);
- e-mail sending through the mail server of the aerodrome or of the processor;
- Stripe Payments Europe (payments, module payments only; the aerodrome's account);
- Anthropic (reading receipt photos, module fuel log only; transfer to the USA);
- Anthropic (translation of public texts and – only when the management clicks – of the location and remarks of a drone request, module translation only; transfer to the USA);
- push services of the browser vendors (encrypted messages to the users' devices).
The processor announces new sub-processors in advance; the controller may object for good reason.
5. Audit
The controller may request information on compliance; the app shows audit log, users and booked modules at any time.
6. Term and law
The agreement applies as long as the licence runs. Swiss law (FADP) applies, supplemented by the GDPR where applicable. Place of jurisdiction is the processor's seat.