Privacy Policy

The controller for the processing of personal data in connection with this website and the SkyDesk platform is:

BaleAir UG
Diefenbacherstr. 30
75433 Maulbronn
Germany

Email: john@skydesk.aero

We process personal data in accordance with the General Data Protection Regulation ("GDPR") and applicable German data protection law.

This Privacy Policy explains how we process personal data when you visit our website, register for or use SkyDesk, contact us, receive emails from us, make payments, or connect third-party email accounts to the platform.

SkyDesk is a software platform for brokers in the private aviation sector and is intended for business users only.

Depending on how you interact with us, we may process the following categories of personal data:

• - account and identification data, such as name, email address, company details, and account identifiers;
• - authentication data, such as login provider information and OAuth-related account metadata;
• - contact and communication data, such as email address and message content;
• - billing and transaction data, such as subscription plan, invoice details, payment status, and transaction-related information;
• - technical and usage data, such as IP address, browser type, device information, timestamps, log entries, and usage events;
• - customer-submitted data stored and processed in the SkyDesk platform, including personal data relating to business contacts, requests, passengers, documents, and other customer content;
• - connected account data, such as email address, provider account identifier, authorization metadata, and tokens required to enable email sending through a connected Google or Microsoft/Outlook account.

We may disclose personal data to the following categories of recipients where necessary:

• - hosting and infrastructure providers, including Google/Firebase;
• - authentication providers;
• - payment service providers, including Stripe;
• - email delivery providers, including Mailgun;
• - third-party email service providers connected by the user, where the user chooses to send emails through their own Google or Microsoft/Outlook account;
• - analytics providers;
• - IT, security, and technical support providers;
• - professional advisers such as lawyers, accountants, or tax advisers;
• - courts, supervisory authorities, or other public bodies where legally required.

Where service providers process personal data on our behalf, we conclude data processing agreements where required by law.

Some of our service providers may process personal data outside the European Economic Area ("EEA"), in particular in the United States.

Where personal data is transferred to third countries, we ensure that an adequate level of protection is in place as required by law, for example through an adequacy decision, certification under the EU-U.S. Data Privacy Framework, or the use of appropriate safeguards such as the European Commission Standard Contractual Clauses.

We store personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• - account data is generally stored for as long as the account exists and thereafter for a reasonable period for follow-up issues, security, and legal claims;
• - billing and invoice-related data is retained for the period required under applicable tax and commercial law;
• - communication data is retained for as long as necessary to handle the relevant request and for a reasonable follow-up period;
• - technical logs are retained as long as necessary for security, troubleshooting, and operational purposes;
• - connected-account integration data and tokens are retained for as long as the integration remains active or until revoked or deleted;
• - customer data stored in the platform is retained for the duration of the customer relationship and thereafter in accordance with contractual arrangements, legal obligations, and deletion schedules.

The provision of certain personal data is necessary to enter into and perform a contract with us and to use SkyDesk.

If you do not provide data required for registration, authentication, subscription administration, payment processing, or requested integrations, we may not be able to provide access to the platform or certain functionalities.

You have the following rights under the GDPR, subject to the applicable legal requirements:

• - the right of access pursuant to Art. 15 GDPR;
• - the right to rectification pursuant to Art. 16 GDPR;
• - the right to erasure pursuant to Art. 17 GDPR;
• - the right to restriction of processing pursuant to Art. 18 GDPR;
• - the right to data portability pursuant to Art. 20 GDPR;
• - the right to object pursuant to Art. 21 GDPR.

Where processing is based on consent, you also have the right to withdraw your consent at any time with effect for the future.

To exercise your rights, please contact us at: john@skydesk.aero

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

If BaleAir UG is established in Baden-Württemberg, a relevant supervisory authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.