GDPR compliance policy
Privacy policy for recruitment of students and employees
1. About this policy
It is important to us that you, whether you contact us, register your interest, apply for our training programmes, apply for a job with us or subscribe to our mailings, feel confident about how we handle your personal data. In this policy we describe what data we collect, why, how long we keep it, who we share it with and what rights you have.
We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and supplementary Swedish legislation.
Data controller
Green Flight Academy AB, Company Reg. No. 556985-7211 Bockholmsvägen 18, 931 77 Skellefteå, Sweden Approved Training Organisation (ATO): SE.ATO.0036 Email for data protection enquiries: cecilia.holmund@greenflightacademy.com Phone: +46 910 79 02 70
2. Collection of personal data
We only collect data that is needed for each purpose. Depending on how you are in contact with us, this may include:
Contact details – name, email address, phone number, city/country.
Data in expressions of interest and applications – e.g. age/date of birth, educational background, grades, flying experience, which programme you are interested in, information about your medical certificate (only whether you have one/which class, not medical details) and anything else you choose to send us.
Data in job applications – CV, cover letter, references, licences and ratings.
Communication – the content of emails and messages you send to us.
Data about our mailings – if you subscribe: when you signed up, your consent and how it was given, and whether you open mailings and click on links.
Technical information – IP address, browser, device and how you use the website, via cookies and similar technologies (see section 10).
How we collect the data
We receive the data directly from you when you:
- fill in the expression of interest form or the contact form on the website,
- download a syllabus or other material,
- apply for a programme, either directly or by signing in through a third party such as Facebook, Instagram or LinkedIn,
- sign up for our mailings,
- send a job application, e.g. by email,
- contact us by email, phone or social media.
Purposes and legal basis
Purpose | Examples of data | Legal basis |
Answering questions and handling expressions of interest | Contact details, messages | Legitimate interest – to be able to reply to you and provide information about the programme you asked about |
Handling applications and admission to training | Contact and application details | Steps taken at your request prior to entering into a contract |
Delivering training and keeping training records | Student data, training results | Contract and legal obligation under aviation regulations (EASA) |
Recruiting staff | CV, cover letter, references | Legitimate interest – to be able to recruit; consent if we keep your application for future recruitment |
Email marketing: sending the guide, the syllabus and newsletters via MailerLite | Name, email, area of interest, consent | Consent (see section 5) |
Following up and improving our mailings | Opens and clicks | Consent, given when signing up for the mailings |
Web analytics and social media marketing | Cookies, IP address | Consent via our cookie banner |
Complying with legal requirements, e.g. bookkeeping | Invoicing details | Legal obligation |
Email addresses that you provide when you download our guide or syllabus, or when you sign up for our newsletter, are used for marketing. The legal basis for this is your consent (Article 6(1)(a) GDPR).
Marketing mailings and consent
We send newsletters and information by email using the service MailerLite. The mailings may contain information about our programmes, upcoming intakes and application deadlines, open days and other events, news from the school and tips about the pilot profession.
How you give consent
- We only send marketing mailings if you have actively consented to them, e.g. by ticking the newsletter box in our expression of interest form or by signing up via a subscription form.
- Consent to marketing mailings is voluntary and separate from acknowledging this privacy policy. Accepting the privacy policy does not in itself mean that you consent to marketing mailings.
- If you choose not to receive mailings, this does not affect your expression of interest, your application or how we treat you.
- We keep a record of when and how you gave your consent, so that we can demonstrate that it exists.
The guide and the syllabus
To receive our guide or syllabus via the form, you need to provide your email address and consent to receiving our mailings. The email address is needed so that we can send the material to you, and the consent allows us to then send you information about our programmes.
If you do not want to provide an email address or consent, we cannot send the material via the form. Instead, you can read about the programmes on our website or contact us, and we will send you the syllabus without adding you to our mailings. You can also unsubscribe immediately after receiving the material.
Who we share data with
We never sell your personal data. We only share it when necessary for the purposes above, with:
- Data processors who help us run our business and who may only process the data in accordance with our instructions:
- MailerLite – email mailings. MailerLite receives name, email address, area of interest, consent details and statistics on opens and clicks
- WordPress
- Microsoft 365
- Providers of analytics and marketing tools – Google (Google Analytics) and Meta (Facebook/Instagram), only if you have accepted cookies for this.
- Public authorities – e.g. the Swedish Transport Agency (Transportstyrelsen) when required for training and licences, and other authorities where we are required to do so by law.
- Partners – e.g. airlines or universities within a training programme, but only if you have been informed of this and it is stated in the programme’s terms, or you have given your consent.
- Legal advisers and authorities in the event of suspected crime or to establish, exercise or defend legal claims.
Transfers outside the EU/EEA
We aim to process personal data within the EU/EEA. Some providers, or their sub-processors, may operate outside the EU/EEA, e.g. in the USA. In such cases we ensure that the transfer is supported by the GDPR, for example through a European Commission adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses.
MailerLite stores the data in data centres within the EU (the Netherlands). MailerLite may engage sub-processors outside the EU/EEA. Such transfers are protected by the European Commission’s standard contractual clauses under MailerLite’s data processing agreement.
How long we keep the data
We only keep your personal data for as long as it is needed for the purpose it was collected for.
If you have registered your interest or contacted us, we keep your details for 24 months after our most recent contact. If you have applied for one of our programmes but were not admitted, we keep your application for 24 months after the end of the admission round.
Student and training data is kept during your training and thereafter for as long as aviation regulations require, which is at least three years after you complete your training.
If you subscribe to our mailings, we keep your details until you unsubscribe or withdraw your consent. Subscribers who have not opened any of our mailings in 24 months are removed. After that, we keep a record of your consent (when and how it was given, and the consent wording used) for a further 24 months, so that we can demonstrate that our mailings were sent with your consent. When you unsubscribe, we keep only your email address on a suppression list for as long as we send mailings, to make sure you do not receive them again by mistake.
If you apply for a job with us, we keep your application until the recruitment process is completed. With your consent, we may keep it for up to 24 months for future recruitment.
Accounting records are kept for seven years, as required by the Swedish Bookkeeping Act.
Your rights
You have the right to:
- access the personal data we process about you (a copy of your data),
- have inaccurate data rectified,
- have data erased, e.g. if it is no longer needed or if you withdraw your consent,
- request restriction of processing,
- object to processing based on legitimate interest – and always to direct marketing,
- receive the data you have provided yourself in a machine-readable format (data portability),
- withdraw consent at any time.
Contact us as set out in section 13 to exercise your rights. We normally respond within one month.
If you believe that we are processing your data incorrectly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se.
Cookies and similar technologies
Cookies are small text files stored in your browser or device when you visit the website. We use:
- Necessary cookies – to make the website work, e.g. language selection. These do not require consent.
- Analytics cookies – e.g. Google Analytics, to understand how the website is used and which pages are most popular.
- Marketing cookies – e.g. the Meta pixel, to measure and target advertising on social media.
Analytics and marketing cookies are only used if you have accepted them in our cookie banner. You can change your choice at any time, and you can also block or delete cookies in your browser settings. More information about cookies is available from the Swedish Post and Telecom Authority (PTS), www.pts.se.
Security
We take technical and organisational measures to protect your data against unauthorised access, loss and alteration. Only staff who need the data for their work have access to it, and our providers are bound by confidentiality and data protection agreements.
Changes to this policy
We may update this policy. The latest version is always available on our website. In the event of material changes, e.g. new purposes, we will inform you before the change takes effect.
Contact
Do you have questions about how we process personal data, or do you want to exercise your rights or unsubscribe from mailings? Contact us:
Green Flight Academy AB Bockholmsvägen 18, 931 77 Skellefteå, Sweden cecilia.holmlund@greenflightacademy.com +46 910 79 02 70