Privacy Policy

Privacy Policy

Last updated: October 2026

1. Controller and General Information

This Privacy Policy explains how AviaSpark e.U. processes personal data when you visit the AviaSpark e.U. website, contact AviaSpark e.U., subscribe to AviaSpark e.U. email communications, participate in interactive resources such as quizzes, or otherwise interact with AviaSpark e.U.'s online services.

Data Controller:

Personal data is processed in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Website Hosting and Technical Delivery

Cloudflare Pages

The AviaSpark e.U. website is hosted and delivered using Cloudflare Pages, provided by Cloudflare, Inc. and its affiliated entities.

When you access the website, technical information may be processed as necessary to deliver, secure and maintain the website and its infrastructure. This may include technical request information such as IP address, browser information, device information, requested resources and timestamps, depending on the applicable Cloudflare services and configuration.

Purpose: Technical delivery, security, abuse prevention and reliable operation of the website.

Legal basis: Legitimate interests in operating and securing the website (Art. 6(1)(f) GDPR).

Cloudflare may process data internationally as part of its global infrastructure. Further information is available in the Cloudflare Privacy Policy.

Cloudflare Web Analytics

AviaSpark e.U. uses Cloudflare Web Analytics to understand general website performance and usage.

Cloudflare describes Web Analytics as a privacy-focused analytics service that does not use cookies or local storage for analytics and does not track individual visitors across websites. The service provides aggregated information such as page views and performance metrics.

Purpose: Understanding website performance and improving the website.

Legal basis: Legitimate interests in maintaining and improving the website (Art. 6(1)(f) GDPR).

Further information is available in the Cloudflare Web Analytics documentation.

3. Contact Form

Web3Forms

AviaSpark e.U. uses Web3Forms to provide its online contact form.

When you submit the contact form, AviaSpark may process the information you provide, such as your name, email address, the subject or category of your enquiry, and the contents of your message.

Purpose: Receiving, managing and responding to enquiries and communications.

Legal basis: Processing is based on the steps necessary to respond to your enquiry and, where applicable, to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR), or on AviaSpark's legitimate interests in responding to communications (Art. 6(1)(f) GDPR).

Web3Forms provides the technical infrastructure for the contact form and processes submitted form data in order to transmit the information to AviaSpark. According to Web3Forms, form submissions are not stored as form submissions by the service, although server logs containing personal information may be retained for a limited period. Web3Forms states that its servers are located in the United States.

Where personal data is transferred to or processed in a country outside the European Economic Area, AviaSpark relies on the applicable safeguards required under data protection law.

Further information is available in the Web3Forms documentation and the Web3Forms website.

4. Quizzes and Interactive Resources

Tally

AviaSpark e.U. uses Tally to provide quizzes, surveys and other interactive resources.

Depending on the specific resource, the information collected may include your profession, years of experience, preferences, feedback and other answers that you voluntarily provide.

Where a quiz or other resource is distributed to existing email subscribers, an email address may also be associated with the response, for example through a hidden form field. This allows AviaSpark to associate the response with the relevant subscriber and, where applicable, provide a requested result or follow-up by email.

Purpose: Providing interactive resources, delivering requested results, understanding the needs and characteristics of the audience, and improving AviaSpark's resources, products and content.

Legal basis: Depending on the circumstances and purpose of the specific resource, processing may be based on consent (Art. 6(1)(a) GDPR), performance of a requested service or pre-contractual measures (Art. 6(1)(b) GDPR), or AviaSpark's legitimate interests in developing and improving its resources and products (Art. 6(1)(f) GDPR).

Quiz and survey responses are not used to make decisions that produce legal or similarly significant effects concerning individuals.

Tally states that form data is encrypted in transit and at rest and stored in Europe, and provides a Data Processing Agreement for customers using Tally as a form provider.

Further information about Tally's processing is available in the Tally GDPR documentation and the Tally Privacy Policy.

5. Email Courses and Email Communications

MailerLite

AviaSpark e.U. uses MailerLite to manage email subscriptions, deliver email courses, send newsletters and other email communications, and, where applicable, provide forms, surveys or other interactive features.

Depending on the specific subscription, communication or resource, the following information may be processed:

  • Email address
  • Name, where provided
  • Subscription and consent information
  • Subscription date and related technical information
  • Responses and other information voluntarily provided through MailerLite forms, surveys or similar features
  • Email engagement information, such as whether an email was opened or a link was clicked, where provided by the service

Purpose: Delivering requested email courses, newsletters, updates and other communications for which you have subscribed, administering subscriptions, providing requested resources or surveys, and improving AviaSpark's communications and resources.

Legal basis: Consent (Art. 6(1)(a) GDPR) where consent is required and has been given. Other processing necessary for the administration and delivery of requested services may be based on the applicable legal basis under Art. 6 GDPR.

You can withdraw your consent and unsubscribe from marketing communications at any time using the unsubscribe mechanism provided in the relevant email or by contacting [email protected].

MailerLite states that it processes customer and subscriber data as a processor on behalf of its customers and provides a Data Processing Addendum. MailerLite also states that its data center is located in the European Union.

Further information is available in the MailerLite Privacy Policy and the MailerLite Data Processing Addendum.

6. Systems for One Newsletter

Substack

Systems for One is published using Substack.

When you subscribe to Systems for One, Substack processes the information required to provide the publication, including your email address and subscription information. Depending on your interactions with the publication, additional information such as engagement data or information voluntarily provided through comments or other interactions may also be available to the publisher.

Purpose: Delivering the Systems for One newsletter and managing subscriptions and related interactions.

Legal basis: Consent to receive the newsletter (Art. 6(1)(a) GDPR).

Subscription and delivery are provided through Substack's platform. Further information is available in the Substack Privacy Policy.

You can unsubscribe from Systems for One at any time using the unsubscribe mechanism provided by Substack.

7. Business Email

Google Workspace

Email correspondence with AviaSpark e.U., including messages sent to [email protected], is processed using Google Workspace.

Depending on the communication, this may include your email address, name, message content, attachments and other information voluntarily included in the correspondence.

Purpose: Receiving and responding to business communications, enquiries and correspondence.

Legal basis: Depending on the circumstances, processing necessary to respond to a request or take steps prior to entering into a contract (Art. 6(1)(b) GDPR), or legitimate interests in managing business correspondence (Art. 6(1)(f) GDPR).

Further information is available in Google's Privacy Policy.

8. Data Retention

Personal data is retained only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required by law.

The specific retention period depends on the type of data and the reason for processing. Contact enquiries may be retained for as long as reasonably necessary to handle the enquiry and any resulting business relationship. Subscription data is retained while the relevant subscription remains active and thereafter only where necessary for legal, accounting or other legitimate purposes.

9. Your Rights Under the GDPR

Subject to the applicable legal requirements, you have the following rights concerning your personal data:

  • Right of access (Art. 15 GDPR): You may request information about the personal data processed about you.
  • Right to rectification (Art. 16 GDPR): You may request correction of inaccurate personal data.
  • Right to erasure (Art. 17 GDPR): You may request deletion of your personal data where the legal requirements are met.
  • Right to restriction of processing (Art. 18 GDPR): You may request restriction of processing in certain circumstances.
  • Right to data portability (Art. 20 GDPR): You may request certain personal data in a structured, commonly used and machine-readable format.
  • Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests where the legal requirements are met.
  • Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact [email protected].

10. Complaints to the Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

For AviaSpark e.U., the relevant supervisory authority is:

Österreichische Datenschutzbehörde (DSB)
Barichgasse 40-42
1030 Vienna
Austria
https://www.dsb.gv.at

11. Third-Party Privacy Policies

The services described above are provided by independent third-party providers. Their own privacy policies explain their respective processing activities in greater detail. Where relevant, links to those policies have been provided above.

This Privacy Policy concerns the processing activities for which AviaSpark is responsible. Separate privacy information applies to the SoloCompass SaaS product and its associated services.