Privacy Policy

This Privacy Policy explains how CAN Connect Fz-LLC T/A Aviation Connect (“Aviation Connect”, “we”, “our”, “us”) collects, uses, stores and shares personal information when you use our website at aviationconnect.org and any related services.

We respect your privacy and are committed to handling your personal data responsibly under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, “UAE PDPL”) as our primary framework, and under additional standards (including the EU General Data Protection Regulation, “GDPR” and applicable Southeast Asia data protection laws) when they apply to you.

1. Who we are

CAN Connect Fz-LLC T/A Aviation Connect is the data controller for personal information collected through this website. Our contact details:

CAN Connect Fz-LLC T/A Aviation Connect
Al Shohada Rd, Al Hamra Industrial Zone-FZ
Ras Al Khaimah, United Arab Emirates
Email: info@aviationconnect.org

For data protection inquiries, please use the email above with the subject line “Privacy request”.

2. What information we collect

We only collect information that’s necessary to provide our services. The categories are:

Information you give us directly:

Name, email, phone number, country, and any message content when you fill out our contact form, request a consultation, apply for a school, or subscribe to our newsletter
Career goals, training preferences, budget range, and similar context you provide so we can advise you well
When you prepare an application: the details partner schools ask for, including your address, an emergency contact, your education, your height and weight, your gender, whether you have a disability, and whether you have ever been refused a visa or overstayed one. Only our team sees these answers; we use them to prepare an application you ask us to send. Whether you have a disability is health information, and “Prefer not to say” is always an accepted answer.
Test results from our public Aptitude Test if you complete it (stored anonymously by default; linked to your email only if you opt in to receive results via email)

Information collected automatically:

IP address, browser type, device type, operating system, time of visit, pages visited, referring URL, all collected to run the website and detect abuse
Information stored in cookies and similar technologies (see our Cookie Policy)
Where you first found us, when that is knowable: if you arrive from an advertisement, a referral link or one of our printed QR codes, the campaign name and the website you came from are kept in your own browser and sent to us only when you submit a form, so that we can tell which of our efforts actually help people. Arriving directly records nothing. Details, and how to remove it, are in the Cookie Policy.
An anonymous count of visits: when you arrive from outside the site, we record the time, your country, the website you came from (only its address) and the page you landed on. Your IP address is used to tell the country and is not stored with the count, and no cookie is set. Nothing in it identifies you; we use it, on the basis of our legitimate interest, only to see how people find us.
When you book a consultation: the time you chose, the time zone you chose it in, and anything you wrote in the message field. Your name, email address and the appointment go into the advisor’s calendar and into the video meeting that is created for the call.

Information from third parties:

We do not buy or rent personal data from third parties.

3. How we use your information

We use your information to:

Respond to your inquiries, provide consultations, and connect you with relevant partner schools
Send you the newsletter you signed up for, including event invitations and content we think you’ll find useful
Send transactional emails about your requests (consultation confirmations, event registration confirmations, etc.)
Improve our website, services, and content based on aggregated, anonymized usage data
Detect and prevent abuse, fraud and security incidents
Comply with legal obligations applicable to us

We will not use your information for automated decisions that significantly affect you. All consultation recommendations are made by human advisors.

4. Legal basis for processing (for EU and EEA visitors)

If you are in the European Union, European Economic Area, or United Kingdom, we process your personal data under one of the following legal bases under the GDPR:

Consent (Art. 6(1)(a) GDPR): for newsletter sign-up, optional analytics cookies, and similar opt-in actions. You can withdraw consent at any time.
Performance of a contract (Art. 6(1)(b) GDPR): when you request a consultation or apply for a school, processing your data is necessary to provide that service.
Explicit consent (Art. 9(2)(a) GDPR): for your answer on whether you have a disability, which you give by answering it and may decline with “Prefer not to say”.
Legitimate interests (Art. 6(1)(f) GDPR): for fraud prevention, basic website analytics, and improving our services. Our interest is balanced against your rights.
Legal obligation (Art. 6(1)(c) GDPR): when we must retain records for tax, accounting or regulatory purposes.

You can object to processing based on legitimate interests by contacting us (see Section 9).

We share information only when necessary, and only with parties who provide adequate protections. The main categories:

Partner schools (only with your explicit instruction)

When you request that we connect you with a specific partner school, we share relevant context: your name, contact, training goals, and the questions you want answered. We never share your data with schools without your active request.

Service providers (data processors)

We use the following service providers to operate our website and services. They process data on our behalf under contracts requiring them to protect your information:

Hetzner Online GmbH (Germany / Finland data center): hosting of our content management system (Directus)
Cloudflare, Inc. (United States, Germany, others): content delivery, DDoS protection, DNS
Resend (United States): transactional email delivery
Telegram FZ-LLC (UAE): internal lead notification routing to our team
Google (United States), calendar availability and appointments. When you book a consultation, the appointment is written into the advisor’s calendar with your name, your email address and anything you told us you wanted to discuss.
Zoom (United States), video meetings. Booking a consultation creates a meeting and a joining link. Zoom processes your participation in the call under its own terms.

Each of these providers operates under their own data protection practices and, where relevant, has signed data processing agreements with us in accordance with GDPR Art. 28.

Legal requirements

We will disclose information when required by law, court order, or to protect legal rights and safety. This is rare in our line of work but we list it for transparency.

We do NOT sell your personal data. We do not share data with advertisers, data brokers, or for targeted advertising.

6. International data transfers

Aviation Connect operates from the United Arab Emirates. Our service providers operate from multiple countries including Germany, Finland, United States, and others.

For visitors in the EU/EEA: data transfers outside the EU/EEA are protected by mechanisms permitted under the GDPR, including Standard Contractual Clauses (SCCs) with our service providers or, where applicable, adequacy decisions of the European Commission.

For visitors in the UAE: international transfers comply with UAE PDPL requirements.

If you have questions about specific transfers, contact us using the email in Section 1.

7. How long we keep your information

We keep personal data only as long as needed for the purposes described in this policy:

Contact form messages: 2 years after last interaction, or longer if you become an active client
Consultation requests: 3 years after the consultation, for follow-up and quality purposes
Newsletter subscribers: until you unsubscribe; we send a re-confirmation email after extended periods of inactivity
Aptitude test results (anonymous): indefinitely in aggregated form for service improvement
Aptitude test results (with email): 2 years from completion
Server logs: 14 days for security purposes

When the retention period expires, we delete or anonymize the data.

8. How we protect your information

We take reasonable technical and organizational measures to protect your data, including:

HTTPS encryption for all data in transit
Access controls limiting who on our team can view personal data
Encrypted database storage on EU-hosted servers (Hetzner Finland)
Regular security updates to our software and infrastructure
Honeypot fields and rate limiting to prevent automated abuse

No internet transmission or storage is 100% secure. We commit to informing affected users and relevant authorities promptly in the unlikely event of a data breach affecting personal data.

9. Your rights

Depending on your location, you have the following rights:

For all visitors:

Access: request a copy of the personal data we hold about you
Correction: ask us to correct inaccurate or incomplete data
Deletion: ask us to delete your data (subject to legal retention requirements)
Objection: object to processing of your data
Withdraw consent: for processing based on consent

Additionally for EU/EEA/UK visitors (GDPR):

Restriction: limit how we process your data
Portability: receive your data in a machine-readable format
Lodge a complaint with your national data protection authority. In Austria for example: Österreichische Datenschutzbehörde (dsb.gv.at). In Germany: your state’s data protection authority. In Ireland: Data Protection Commission (dataprotection.ie). For other EU/EEA countries: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Additionally for UAE residents (UAE PDPL):

Lodge a complaint with the UAE Data Office once it is fully operational, or with the relevant Free Zone authority.

To exercise any of these rights, email us with the subject “Privacy request” at the address in Section 1. We respond within 30 days (GDPR) or as required by local law.

10. Children

Our services are intended for adults (typically 17+) considering pilot training. We do not knowingly collect personal information from children under 16. If you believe we have collected information about a child, please contact us so we can delete it.

11. Third-party links

This website contains links to third-party websites (partner schools, civil aviation authorities, news sources, etc.). When you click those links, you leave our website and the third party’s privacy policy applies. We are not responsible for the privacy practices of these third parties.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by a notice on this website and, where you have provided an email, by email. The “Last reviewed” date at the bottom of this page tells you when the current version took effect.

13. Contact us

For any privacy-related questions, concerns, or requests, contact us at: