Privacy Statement

1. Introduction

Helitrax SLU (“Helitrax”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Notice explains how Helitrax collects, uses, stores and protects personal data when you:

• visit or use our website;
• contact us about our services;
• provide your contact and professional details to us as flight crew, an engineer or another aviation professional;
• instruct us to undertake a helisurface permit or similar regulatory application; or
• otherwise communicate with us electronically.

Helitrax SLU is established in the Principality of Andorra and is primarily subject to Llei 29/2021, del 28 d’octubre, qualificada de protecció de dades personals (LQPD).

Where applicable, our processing may also be subject to the EU General Data Protection Regulation (GDPR) and/or the UK General Data Protection Regulation (UK GDPR) and associated UK data-protection legislation.

Our approach is to collect and retain only the personal data reasonably necessary for the purpose for which it is required.

2. Data controller

Unless stated otherwise for a particular service, the controller responsible for your personal data is:

Email: messages@helitrax.aero
Telephone: +376 381926

Questions about this Privacy Notice or the way in which we process personal data should be directed to the contact details above.

3. Personal data we collect

The information we collect depends upon how you interact with Helitrax.

3.1 Website visitors and enquiries

If you contact Helitrax through our website, by email or by other electronic means, we may process basic information such as:

• your name;
• email address;
• telephone number, where supplied;
• company or organisation, where relevant;
• the content of your enquiry or correspondence; and
• information concerning the service in which you are interested.

We use this information to respond to your enquiry, communicate with you and, where appropriate, provide information or services you have requested.

3.2 Flight crew and engineers

Helitrax does not operate an online personnel database. Its website provides a simple availability calendar through which flight crew and engineers can indicate when they may be available.

To administer the calendar and determine whether an individual’s availability may be relevant to a client requirement, Helitrax collects and retains only the minimum information reasonably necessary:

• name;
• email address;
• licence authority;
• ratings and experience;
• availability; and
• location

This limited information is used solely to administer the availability calendar, maintain professional contact and support the provision of Helitrax services. It is not used to create comprehensive personnel or employment profiles.

Helitrax does not use these online records to maintain full employment or personnel files.

3.3 Prospective and existing clients

Where an individual contacts Helitrax in a professional or business capacity, we may retain limited contact and correspondence information, such as:

• name;
• email address;
• telephone number;
• company or organisation, where relevant; and
• relevant correspondence or enquiry information.

This information is used to communicate with the individual, respond to enquiries and administer any subsequent business relationship.

3.4 Helisurface and regulatory applications

Where Helitrax is instructed to prepare, submit or administer a helisurface permit or similar regulatory application, considerably more information may be required because of the requirements imposed by the relevant authority.

Depending upon the application, this may include:

• full name;
• contact details;
• nationality;
• date of birth;
• passport or other identity documentation;
• pilot licence information and copies;
• aircraft ratings or licence privileges;
• aviation medical certificate;
• flying experience;
• relevant logbook extracts;
• previous permits or approvals;
• licence verification or supporting documentation;
• aircraft and operator information;
• application forms and signatures; and
• correspondence relating to the application.

We process this information only to the extent reasonably necessary to prepare, submit and administer the relevant application or associated regulatory process.

Application documentation is stored electronically using Google Drive.

3.5 Special-category data

Certain documents supplied as part of a helisurface or regulatory application may contain information subject to additional protection under data-protection law.

In particular, an aviation medical certificate may constitute health data and therefore special-category personal data.

Helitrax does not require or seek detailed information about an individual’s underlying medical history. Where an aviation medical certificate is required, we process the certificate only for the relevant application or regulatory purpose.

Where applicable data-protection law requires an additional legal condition for the processing of special-category data, Helitrax will rely upon an appropriate condition, which may include the individual’s explicit consent.

4. Website and technical information

When you visit the Helitrax website, limited technical information may be processed automatically.

This can include:

• IP address;
• browser type;
• device information;
• pages visited;
• date and time of access; and
• cookie or similar technology identifiers.

Some of this information is required for the website to operate correctly and securely.

Where cookies or similar technologies are not strictly necessary, they will be used in accordance with applicable consent requirements.

Further information is available in our Cookie Policy.

5. Where we obtain personal data

Most personal data is provided directly by the individual concerned.

In connection with a helisurface or regulatory application, information may also be supplied to Helitrax by another person or organisation acting on the individual’s behalf, such as:

• an aircraft operator;
• aircraft owner;
• employer or contracting organisation;
• pilot;
• representative;
• client; or
• other person involved in arranging the application.

We may also receive information or correspondence from the relevant aviation, governmental or regulatory authority while administering an application.

Where applicable law requires us to provide privacy information to an individual whose information we have received from another source, we will do so unless an applicable exemption applies or the individual already has the relevant information.

6. Why we process personal data

Helitrax only processes personal data where there is an appropriate lawful basis.

Website enquiries and prospective clients

We process basic contact information and correspondence in order to:

• respond to enquiries;
• provide information about our services;
• provide quotations or proposals;
• take steps towards providing a requested service; and
• maintain appropriate business correspondence.

The applicable lawful basis will normally be:

• taking steps at your request before entering into a contract;
• performance of a contract; or
• our legitimate interest in responding to enquiries and conducting our business.

Flight crew and engineer information

We retain the limited contact and professional information described in section 3.2 so that we can maintain our professional network, identify individuals who may be suitable and available for a particular requirement, and communicate about potentially relevant aviation work or services.

The lawful basis is normally our legitimate interest in maintaining a professional network of aviation personnel, identifying potentially suitable and available individuals, and contacting them about relevant professional opportunities or requirements.

Individuals can ask us to remove their information at any time, subject to any separate legal or contractual reason requiring us to retain it.

Helisurface and regulatory applications

We process application information in order to:

• prepare an application;
• verify that the required documentation has been provided;
• submit documentation to the relevant authority;
• communicate with the applicant, client and authority;
• respond to requests for further information;
• administer amendments or corrections; and
• complete the service for which Helitrax has been instructed.

The lawful basis will normally be performance of a contract or taking steps at the request of the individual or client before entering into a contract.

Where special-category personal data is involved, we will also rely upon an appropriate additional condition required by applicable law.

Legal and administrative obligations

We may process personal data where necessary to:

• comply with a legal or regulatory requirement;
• maintain required business or accounting records;
• establish, exercise or defend legal rights;
• prevent fraud or misuse; or
• protect our systems, business and users.

The applicable basis may be compliance with a legal obligation or our legitimate interests, depending upon the circumstances.

Website cookies and analytics

Where consent is required for non-essential cookies, analytics or similar technologies, processing will take place on the basis of your consent.

You can change or withdraw your cookie preferences through our website’s cookie-management facility.

7. Our legitimate interests

Where we rely upon legitimate interests, those interests may include:

• responding to enquiries;
• operating and administering Helitrax;
• maintaining professional business relationships;
• maintaining contact with pilots, engineers and other aviation professionals;
• identifying individuals whose qualifications, experience, recency, availability and location may be relevant to a particular requirement;
• communicating relevant professional opportunities or requirements;
• providing and improving our services;
• maintaining the security of our website and systems; and
• establishing, exercising or defending legal rights.

We only rely upon legitimate interests where we consider that the processing is necessary and proportionate and does not override the rights and interests of the individual concerned.

8. Who we share personal data with

Helitrax does not sell personal data.

We disclose personal information only where reasonably necessary for the purposes described in this Privacy Notice or where required by law.

Helisurface and regulatory applications

Information supplied for an application may be disclosed to the relevant:

• aviation authority;
• prefecture;
• police or governmental authority;
• licensing authority;
• maritime or port authority, where relevant; or
• other competent regulatory body.

Only information reasonably required for the application or regulatory process will be disclosed.

Clients and professional contacts

Basic business contact information may be disclosed where reasonably necessary to administer a service, assignment or professional relationship.

Limited professional information concerning flight crew or engineers may be shared with a relevant client where reasonably necessary in connection with a potential or confirmed requirement. Personal contact details are not routinely published or disclosed generally.

Service providers

Personal information may be processed using third-party services necessary for the operation of our business, including services providing:

• website hosting;
• email;
• cloud storage;
• IT and communications services;
• website security;
• website analytics, where enabled; and
• professional or administrative support.

Where third parties process information on our behalf, we take reasonable steps to use providers offering appropriate data-protection and security safeguards.

Professional advisers and legal requirements

Information may also be disclosed to accountants, lawyers, insurers or other professional advisers where reasonably necessary.

We may disclose information where required by law, court order or a competent public or regulatory authority, or where reasonably necessary to establish, exercise or defend legal rights.

9. Google Drive and cloud storage

Helitrax uses Google Drive to store and administer documentation associated with helisurface and regulatory applications.

This may include personal documentation supplied for an application, including identity documents, licensing information, logbook information and aviation medical certificates where required.

Access to these files is limited to persons who require access for legitimate Helitrax business purposes.

As with other cloud services, information stored using Google services may be processed by Google and its authorised service providers or subprocessors in different jurisdictions.

Where international transfers of personal data require additional legal safeguards, those transfers will be handled in accordance with the applicable data-protection requirements.

10. International transfers

Helitrax is established in Andorra and provides services internationally.

Personal information may therefore be transferred between:

• Andorra;
• countries within the European Economic Area;
• the United Kingdom; and
• other countries where an applicant, client, authority or service provider is located.

For example, information supplied for a French helisurface application will necessarily be disclosed to the relevant authority in France.

Andorra has been recognised by the European Union as providing an adequate level of data protection.

Where personal data is transferred to a country which is not covered by an applicable adequacy decision or equivalent arrangement, we will use an appropriate legal safeguard where required.

Depending upon the circumstances, this may include:

• approved contractual clauses;
• contractual or statutory safeguards recognised under applicable data-protection law;
• another recognised transfer mechanism; or
• an applicable legal exception permitting the transfer.

You may contact us for further information about the safeguards applicable to a particular transfer.

11. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, taking into account legal, regulatory, contractual and business requirements.

Website enquiries and prospective clients

Routine enquiries which do not result in an ongoing business relationship will normally be deleted when they are no longer reasonably required.

Relevant correspondence may be retained for longer where it forms part of a business relationship, quotation, service request, contractual record or potential legal matter.

Flight crew and engineer information

The limited contact and professional information described in section 3.2 may be retained while there remains a reasonable professional purpose for Helitrax to keep the individual within its network or remain in contact with them.

An individual may ask us to delete this information at any time unless there is another legitimate legal or contractual reason for retaining it.

Helisurface and regulatory applications

The completed application, relevant correspondence and resulting permit or approval may be retained where reasonably necessary as a record of the service provided or to assist with subsequent applications.

Supporting documents containing more sensitive personal information, including copies of passports, aviation medical certificates and logbook extracts, will normally be deleted within 12 months of completion of the relevant application, unless:

• they remain necessary for an ongoing application;
• a legal or regulatory requirement requires us to retain them;
• they are relevant to a dispute, complaint or legal claim; or
• the individual has specifically requested that they be retained for a subsequent application.

We periodically review retained application information and delete information which is no longer reasonably required.

Legal and business records

Information which forms part of records that Helitrax is legally required to retain may be kept for the applicable statutory retention period.

Where information is relevant to an actual or potential legal claim, it may be retained until the matter and applicable limitation periods have expired.

12. Data security

Helitrax takes reasonable and proportionate technical and organisational measures to protect personal data against:

• unauthorised access;
• unlawful disclosure;
• alteration;
• accidental loss;
• destruction; and
• other unlawful processing.

Access to personal data is restricted according to business need.

We take particular care with identity, licensing and medical documentation supplied in connection with helisurface applications.

No electronic storage or communications system can be guaranteed to be completely secure. If a personal-data breach occurs, we will investigate it and make any notifications required by applicable law.

13. Your rights

Depending upon the law applicable to the processing and the circumstances concerned, you may have rights in relation to your personal data including the following.

Access

You may ask us to confirm whether we process personal data about you and request access to that information.

Rectification

You may ask us to correct inaccurate or incomplete personal data.

Erasure

You may ask us to delete personal data in circumstances where applicable law provides a right to erasure.

This right is not absolute. For example, we may need to retain information where required by law or for the establishment, exercise or defence of legal claims.

Restriction

In certain circumstances, you may ask us to restrict the processing of your personal data.

Data portability

Where applicable, you may have the right to receive certain personal information you have provided to us in a structured, commonly used and machine-readable format.

Objection

Where processing is based upon our legitimate interests, you may have the right to object on grounds relating to your particular circumstances.

We will then consider whether there are compelling legitimate grounds for continuing the processing.

You may object to the use of your personal data for direct marketing at any time.

Withdrawal of consent

Where processing is based upon your consent, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Automated decision-making

You may have rights relating to certain decisions made solely by automated means which produce legal or similarly significant effects.

Helitrax does not currently undertake solely automated decision-making or profiling of this nature.

14. Exercising your rights

To exercise your data-protection rights or ask a question concerning information we hold about you, please contact:

Email: messages@helitrax.aero

Please provide sufficient information for us to identify the information or processing concerned.

Where necessary, we may ask for reasonable evidence of identity before disclosing or altering personal information.

We will respond within the time limits required by the applicable data-protection law.

There is normally no charge for exercising your rights, although applicable law may allow us to charge a reasonable fee or decline to act in relation to requests which are manifestly unfounded, excessive or repetitive.

15. Complaints

If you have concerns about the way Helitrax has processed your personal information, we would welcome the opportunity to address them directly.

Please contact: messages@helitrax.aero

You also have the right to complain to an appropriate data-protection supervisory authority.

Andorra

Helitrax’s principal supervisory authority is:

European Union / EEA

Where the EU GDPR applies, you may also have the right to complain to the competent data-protection authority in the EU or EEA country in which you normally live, work or where the alleged infringement occurred.

United Kingdom

Where UK data-protection legislation applies, you may have the right to complain to:

16. Cookies

Our website uses cookies and similar technologies.

Some cookies are strictly necessary for the website to function.

Where applicable law requires consent for analytics or other non-essential cookies, those technologies will not be used until the appropriate consent has been obtained.

You can review or change your choices using the cookie-management facility on our website.

Please see our Cookie Policy for further information.

17. Third-party websites

Our website may contain links to websites operated by third parties.

Helitrax is not responsible for the content or privacy practices of third-party websites. We recommend reviewing the privacy information provided by the relevant website operator before providing personal information to them.

18. Children

Helitrax provides professional aviation and business services and does not intentionally provide online services directed at children.

We do not knowingly collect personal data from children through our website except where there is a specific lawful and legitimate reason for doing so.

19. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in:

• our services;
• our use of personal data;
• technology or service providers; or
• applicable legal requirements.

The current version will be published on this website together with the date it was last updated.

Where a change materially affects the way in which we use personal information already held, we will take reasonable steps to notify affected individuals where required by law.

20. Contact

For questions concerning this Privacy Notice or the processing of your personal data, please contact:

Email: messages@helitrax.aero
Telephone: +376 381926