Privacy Policy

1. Who we are

FlyFair Training Ltd is the data controller for personal data processed through our website and the FlyFair Student Portal. Registered in England: 15389154. This policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website or use our pilot training services.

For any privacy-related query, contact us at info@flyfair.co.uk.

2. Information we collect

We may collect the following types of information:

• Personal information — name, email address, phone number, date of birth, mailing address, and other identifiable information you provide when you contact us or register for training
• Payment information — if you enrol in a course, we collect necessary billing details
• Usage data — information about your browser, device, IP address, and how you interact with our website and portal
• Training records — details of your training progress, certifications, attendance, flight hours, and session records
• Documents — copies of licences, medical certificates, and other aviation documents you upload
• Support data — support ticket content and correspondence
• Emergency contact — name, phone, and relationship

3. How we use your information

We use your information to:

• Process applications and registrations
• Provide pilot training and support services
• Manage your training records and progress
• Communicate with you about updates, schedules, sessions and offers
• Issue invoices and manage fees
• Verify aviation documents and licences
• Comply with aviation regulatory requirements (CAA, EASA)
• Maintain audit trails and security logs
• Improve our website and services

Legal bases: contract performance, legal obligation, and legitimate interests (as applicable to each purpose above).

4. Sharing your information

We do not sell your personal data. We may share it only with:

• Your assigned mentor — name, training phase, and session records
• Training locations — relevant scheduling and operational information
• Regulatory bodies or government agencies (CAA, EASA) — when required by law
• Instructors or training staff — for scheduling and progress tracking
• Trusted third-party partners who help us deliver our services (e.g. Supabase for database hosting, Vercel for application hosting, Resend for transactional emails, payment processors)

All third-party processors are GDPR-compliant and operate under data processing agreements.

5. Data retention

• Active student records — for the duration of your training programme
• Completed or withdrawn students — 7 years after training ends (CAA regulatory requirement for flight training records)
• Support tickets — 3 years
• Audit logs — 2 years
• Inactive accounts — 2 years, then anonymised

6. Data security

We implement appropriate technical and organisational measures to protect your data. All data is encrypted in transit (TLS) and at rest. Access is protected by role-based access controls. We maintain access logs and review them regularly. Database backups are encrypted and stored securely. However, no system is 100% secure — we encourage you to protect your login credentials and report any suspicious activity.

7. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct or update inaccurate data
• Erasure — ask us to delete your information (subject to regulatory retention obligations)
• Restriction — ask us to limit processing while a dispute is resolved
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any right, email info@flyfair.co.uk. We will respond within 30 days. You also have the right to complain to the Information Commissioner's Office (ICO).

8. Cookies and tracking

Our website uses cookies to enhance your experience and analyse usage. You can adjust your browser settings to disable cookies, though this may affect functionality. The student portal uses strictly necessary session cookies only — no tracking or advertising cookies.

9. Third-party links

Our site may contain links to third-party websites. We are not responsible for their privacy practices or content.

10. Changes to this policy

We may update this Privacy Policy periodically. Changes will be posted on this page with a revised effective date. Material changes will also be notified via the portal.