Privacy Policy

This Privacy Policy explains how CAN Connect FZ-LLC T/A Aviation Connect (“Aviation Connect”, “we”, “our”, “us”) collects, uses, stores and shares personal information when you use our website at aviationconnect.org and any related services.

We respect your privacy and are committed to handling your personal data responsibly under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, “UAE PDPL”) as our primary framework, and under additional standards (including the EU General Data Protection Regulation, “GDPR” and applicable Southeast Asia data protection laws) when they apply to you.

1. Who we are

CAN Connect FZ-LLC T/A Aviation Connect is the data controller for personal information collected through this website. Our contact details:

CAN Connect FZ-LLC T/A Aviation Connect
Al Shohada Rd, Al Hamra Industrial Zone-FZ
Ras Al Khaimah, United Arab Emirates
Email: info@aviationconnect.org

For data protection inquiries, please use the email above with the subject line “Privacy request”.

2. What information we collect

We only collect information that’s necessary to provide our services. The categories are:

Information you give us directly:

Name, email, phone number, country, and any message content when you fill out our contact form, request a consultation, apply for a school, or subscribe to our newsletter
When an advisor of ours gives you their sign-up link or shows you its QR code, your name, email, phone number, country and month and year of birth go to that advisor, who becomes your advisor and may contact you about your training.
When you write to us on WhatsApp, or we write to you there: your WhatsApp phone number or WhatsApp user ID, the name and username you set in WhatsApp, the messages and files you send us (for example pictures, documents and voice messages), and whether our messages were delivered and read. We use them to answer you, to advise you on schools and to follow up on your application, in the same conversation as our portal messages, so the person advising you sees what you wrote. Once we have confirmed that the number is yours, a picture or PDF that belongs to your application, such as a passport copy, can be added to your documents in the portal. We only start a conversation with you on WhatsApp if you agreed to be contacted there, and you can stop this at any time: reply STOP, use WhatsApp’s own option to stop messages from us, or write to info@aviationconnect.org.
Career goals, training preferences, budget range, and similar context you provide so we can advise you well
When you prepare an application: the details partner schools ask for, including your address, an emergency contact, your education, your height and weight, your gender, whether you have a disability, and whether you have ever been refused a visa or overstayed one. Only our team sees these answers; we use them to prepare an application you ask us to send. Whether you have a disability is health information, and “Prefer not to say” is always an accepted answer.
Test results from our public Aptitude Test if you complete it (stored anonymously by default; linked to your email only if you opt in to receive results via email)
If you create your account from the aptitude test’s result, the partner schools it showed you are saved in your account, as if you had saved them yourself. You can remove them at any time.

Information collected automatically:

IP address, browser type, device type, operating system, time of visit, pages visited, referring URL, all collected to run the website and detect abuse
Information stored in cookies and similar technologies (see our Cookie Policy)
Where you first found us: when you first arrive from outside our site, the page you landed on and where you came from (the website’s address only, or that you came directly, and a campaign name if the link carried one) are kept in your own browser and sent to us only when you create an account or submit a form, so that we can tell which of our efforts actually help people. When you create an account, this is stored with it. If you visit from the European Union, the European Economic Area or the United Kingdom, it is kept only after you choose OK in our cookie notice. Details, and how to remove it, are in the Cookie Policy.
An anonymous count of visits: when you arrive from outside the site, we record the time, your country, the network you connect through (its number and the operator’s name, for example your internet provider or a data centre), the website you came from (only its address), the page you landed on and the kind of device (phone, tablet or computer). We use the network only to tell real visitors apart from automated traffic. Your IP address is used to tell the country and is not stored with the count, and no cookie is set. Once a day we also count that a visitor came, so we know how many people visit each day; a date kept in your browser stops a second count that day (see the Cookie Policy; in the European Union, the European Economic Area and the United Kingdom it is kept only after you choose OK in our cookie notice). Nothing in it identifies you; we use it, on the basis of our legitimate interest, only to see how people find us and how many come. In the same way we count which steps are reached on the aptitude test’s result, the sign-up form and the consultation form (for example that a form was opened or sent, or which field it was left at, never what was typed), which buttons and links are pressed and where on the page, and how far a page is scrolled, with the page, the kind of device and your country only, to see what helps people and where they stop. On the aptitude test’s result we also count the answers given to the two school questions (what you want to fly and where you would like to train) and, when an account is created from the result, which sign-up form was used. These counts never show who you are.
Cookieless, aggregated visit and page-load statistics (Cloudflare Web Analytics): once a page has loaded, a small script from Cloudflare, the company that delivers our website, measures how quickly it loaded and reports that together with the page, the website you came from, your country, and the type of device, browser and operating system you use. It sets no cookie and stores nothing in your browser; according to Cloudflare it does not identify or follow individual visitors, and we see only totals. We use it, on the basis of our legitimate interest, to keep the website fast.
When you play Avi’s First Solo, our free flying game: your progress stays in your browser. We count anonymously how the game is played: that its page was opened, which pilot flew which city and how each flight ended, how long it lasted, whether Mr. Shortcut’s gates were passed or flown into, how long the page was in view, the kind of device, the page you came from, your country, and whether you were signed in, never who you are. If you play while signed in to your student account, we keep your game’s progress (scores, stars, missions, rank, miles and flight log figures) and your last flight (the city, whether you landed, the stars and the date) with your account, so that it is not lost when you change devices or sign up after playing. With it we keep a random number for each browser you play in, with the miles that browser last reported and when, so that every mile counts once. Our statistics show it under your callsign only, and only if you chose one. Your crew logbook reads the same progress for the Avi and Kiki badges: which cities you landed with each pilot and how many stars you earned. It is part of your account and goes with it.
When you use your account: the days on which you opened it, the last four months at most, so that we know how many students use the portal each day. Only the day’s first moment is kept, never what you looked at. It is part of your account and goes with it.
When you book a consultation, or we set a call with you: the time, your time zone, and anything you wrote in the message field. Your name and the appointment go into the advisor’s calendar, and for a call you booked yourself also your email address, your phone number and what you wrote; your name, and for a call you booked yourself what you wrote, go into the video meeting, never your email address. Zoom tells us when you and the advisor join; we note in your record that the call took place and how long it was. Calls are never recorded.
When you register for one of our online sessions: your first and last name go to Zoom with an address we make for your registration, never your own email address. Zoom tells us when you join and leave the session. A session may be recorded; the recording is only for the people registered for it.

Practice and your crew logbook:

When you practise in your account, we keep each round with your account: the exercise, when you started and finished, how long it took, the kind of device and your result (for example how many answers were right). For some exercises your answers are sent to our server so that it can mark them; for these we keep the result, never the answers themselves. For the aptitude tests we keep your result and your answer to each question, so you and our team can see where you did well and what to practise. The medical self-check is never kept with your account, and no health result ever earns Avi Points. We also count rounds anonymously, as we do for the steps of our forms: that a round of an exercise started or finished, with the kind of device and your country. These counts never say who you are.

Your crew logbook is made from what you do with us: your rounds and tests, the parts of your profile you completed, the schools you compared, expos you checked in at and online sessions you joined, your first call with us, friends who joined and the steps of your application. From this we count your Avi Points, your crew rank and your badges. We match an expo check-in or an online session to your account only by the email address you confirmed. If the name on an expo registration does not match your account, we ask you first.

Your callsign is the name on your crew card. You choose it in place of your real name, and you can change it at any time. We keep your earlier callsigns in your record, so that our team can keep the platform safe. Your logbook is not public: only you and our team see it, and only our team can add a milestone or a correction. The one exception is the Top Crew, a list for other students in their accounts, which you can leave at any time.

The Top Crew: When you choose your first callsign, it appears in the Top Crew, our list for students in their accounts. Other students signed in to their accounts can see your callsign, the flag of your country of residence, your crew rank, your Avi Points from practice and tests, your place and how it changed since yesterday. We never show your name, your age, your school or anything about an application. You can switch it off at any time with “Show my callsign in the Top Crew”: your callsign then leaves the list within a few minutes. A callsign chosen before 6 November 2026 stays off until its student switches it on. We keep when it was switched on or off. A student who sees a callsign in the Top Crew can report it. We keep a report with the account it is about, never the name, email address or IP address of whoever sent it; a coded mark only stops the same person reporting one callsign twice. Our team may take a callsign out of the Top Crew or ask you to choose a new one.

Photos and videos at our events

We take photos and videos at our events and show some of them on our website and social media. If you appear in one and would like it removed, write to us at the address on this page and we will remove it.

Information from third parties:

We do not buy or rent personal data from third parties.

3. How we use your information

We use your information to:

Respond to your inquiries, provide consultations, and connect you with relevant partner schools
Send you our newsletter, news and invitations to our events, including content we think you’ll find useful, when you subscribed on our newsletter form or have an account with us; every one of these emails lets you unsubscribe, and in your account you can also switch our emails off in Settings
Send transactional emails about your requests (consultation confirmations, event registration confirmations, etc.)
Show you your progress in Practice and your crew logbook: your rounds, your Avi Points, your crew rank and your badges
Invite you to later events after you registered for one of ours or were in touch with us about pilot training, also if you never confirmed your email address; every invitation lets you say no with one click
See whether our emails reach you and are read: each email carries a tiny invisible image that tells us when it was opened, and its links pass through our email provider so we see when one was clicked. We use this to see how our invitations are received, including whether you opened or clicked one, and to stop writing to addresses that no longer work. If your email program does not load images, we see no opening
Improve our website, services, and content based on aggregated, anonymized usage data
Detect and prevent abuse, fraud and security incidents
Comply with legal obligations applicable to us

We will not use your information for automated decisions that significantly affect you. All consultation recommendations are made by human advisors.

4. Legal basis for processing (for EU and EEA visitors)

If you are in the European Union, European Economic Area, or United Kingdom, we process your personal data under one of the following legal bases under the GDPR:

Consent (Art. 6(1)(a) GDPR): for newsletter sign-up, for the notes on where you first found us and on your visits that your browser keeps after you choose OK in our cookie notice, and similar opt-in actions. You can withdraw consent at any time; for those notes, with “Cookie choice” at the bottom of every page.
Performance of a contract (Art. 6(1)(b) GDPR): when you request a consultation, register for an event or an online session, or apply for a school, processing your data is necessary to provide that service. The same applies to Practice and your crew logbook: keeping your rounds and counting your Avi Points is part of the service you use in your account.
Explicit consent (Art. 9(2)(a) GDPR): for your answer on whether you have a disability, which you give by answering it and may decline with “Prefer not to say”.
Legitimate interests (Art. 6(1)(f) GDPR): for fraud prevention, basic website analytics, improving our services, showing your callsign in the Top Crew to other students in their accounts (you can switch it off at any time), sending our newsletter, news and event invitations to people who have an account with us, inviting people who registered for one of our events, or were in touch with us about pilot training, to later ones, and seeing whether our emails are delivered, opened and clicked. Our interest is balanced against your rights.
Legal obligation (Art. 6(1)(c) GDPR): when we must retain records for tax, accounting or regulatory purposes.

You can object to processing based on legitimate interests by contacting us (see Section 9).

We share information only when necessary, and only with parties who provide adequate protections. The main categories:

Partner schools (only with your explicit instruction)

When you request that we connect you with a specific partner school, we share relevant context: your name, contact, training goals, and the questions you want answered. We never share your data with schools without your active request.

When you apply to a school through us, in the portal or with your advisor, our team sends that school your application by email: the details you gave for it, the documents we checked for it, your signature where the school's own form needs it, and our referral confirmation. It goes only to that school's admissions address, from info@aviationconnect.org.

Service providers (data processors)

We use the following service providers to operate our website and services. They process data on our behalf under contracts requiring them to protect your information:

Hetzner Online GmbH (Germany / Finland data center): hosting of our content management system (Directus)
Cloudflare, Inc. (United States, Germany, others): content delivery, DDoS protection, DNS, and cookieless, aggregated visit and page-load statistics (Cloudflare Web Analytics)
Cloudflare Stream (Cloudflare, Inc., United States, others): hosting and playback of the videos on our website. A video loads only when you press play.
Resend (United States): transactional email delivery, and telling us whether an email was delivered, opened or clicked
Telegram FZ-LLC (UAE): internal lead notification routing to our team
WhatsApp LLC (United States), WhatsApp Business Platform: carries the WhatsApp messages between you and us. It processes them on our behalf and may pass them to other Meta companies for this, including Meta Platforms, Inc. in the United States. Meta keeps their content on its servers for up to 30 days to deliver them. Your own use of WhatsApp is subject to WhatsApp’s terms and privacy policy.
Google (United States), calendar availability and appointments. When you book a consultation, the appointment is written into the advisor’s calendar with your name, your email address and anything you told us you wanted to discuss.
Zoom (United States), video meetings. A consultation call gets a meeting and a joining link, which reaches you through your own page with us; Zoom reports to us when you and the advisor join. For an online session Zoom receives your name and an address we make for your registration (not your own email address), reports to us when you join and leave, and keeps a recording, when the session is recorded, for 30 days. Zoom processes your participation under its own terms.

Each of these providers operates under their own data protection practices and, where relevant, has signed data processing agreements with us in accordance with GDPR Art. 28.

Legal requirements

We will disclose information when required by law, court order, or to protect legal rights and safety. This is rare in our line of work but we list it for transparency.

We do NOT sell your personal data. We do not share data with advertisers, data brokers, or for targeted advertising.

6. International data transfers

Aviation Connect operates from the United Arab Emirates. Our service providers operate from multiple countries including Germany, Finland, United States, and others.

For visitors in the EU/EEA: data transfers outside the EU/EEA are protected by mechanisms permitted under the GDPR, including Standard Contractual Clauses (SCCs) with our service providers or, where applicable, adequacy decisions of the European Commission.

For visitors in the UAE: international transfers comply with UAE PDPL requirements.

If you have questions about specific transfers, contact us using the email in Section 1.

7. How long we keep your information

We keep personal data only as long as needed for the purposes described in this policy:

Contact form messages: 2 years after last interaction, or longer if you become an active client
Consultation requests: 3 years after the consultation, for follow-up and quality purposes
Newsletter subscribers: until you unsubscribe
Aptitude test results (anonymous): indefinitely in aggregated form for service improvement
Aptitude test results (with email): 2 years from completion
Event registrations: 2 years after the event, also when the email address was never confirmed; for an online session with them the times you joined and left
Recordings of online sessions: 30 days at Zoom, then deleted
WhatsApp conversations and files: while we advise you and for 24 months after our last contact, then deleted; sooner when your account is deleted or you ask us to
Server logs: 14 days for security purposes
Practice results and your crew logbook: as long as your account exists. They are deleted together with your account, and your earlier callsigns are removed from our records then too. The same applies to reports about your callsign and to when it was switched on or off for the Top Crew.

When the retention period expires, we delete or anonymize the data.

8. How we protect your information

We take reasonable technical and organizational measures to protect your data, including:

HTTPS encryption for all data in transit
Access controls limiting who on our team can view personal data
Encrypted database storage on EU-hosted servers (Hetzner Finland)
Regular security updates to our software and infrastructure
Honeypot fields and rate limiting to prevent automated abuse

No internet transmission or storage is 100% secure. We commit to informing affected users and relevant authorities promptly in the unlikely event of a data breach affecting personal data.

9. Your rights

Depending on your location, you have the following rights:

For all visitors:

Access: request a copy of the personal data we hold about you
Correction: ask us to correct inaccurate or incomplete data
Deletion: ask us to delete your data (subject to legal retention requirements)
Objection: object to processing of your data
Withdraw consent: for processing based on consent

Additionally for EU/EEA/UK visitors (GDPR):

Restriction: limit how we process your data
Portability: receive your data in a machine-readable format
Lodge a complaint with your national data protection authority. In Austria for example: Österreichische Datenschutzbehörde (dsb.gv.at). In Germany: your state’s data protection authority. In Ireland: Data Protection Commission (dataprotection.ie). For other EU/EEA countries: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Additionally for UAE residents (UAE PDPL):

Lodge a complaint with the UAE Data Office once it is fully operational, or with the relevant Free Zone authority.

To exercise any of these rights, email us with the subject “Privacy request” at the address in Section 1. We respond within 30 days (GDPR) or as required by local law.

10. Children

Our services are intended for adults (typically 17+) considering pilot training. We do not knowingly collect personal information from children under 16. If you believe we have collected information about a child, please contact us so we can delete it.

11. Third-party links

This website contains links to third-party websites (partner schools, civil aviation authorities, news sources, etc.). When you click those links, you leave our website and the third party’s privacy policy applies. We are not responsible for the privacy practices of these third parties.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by a notice on this website and, where you have provided an email, by email. The “Last reviewed” date at the bottom of this page tells you when the current version took effect.

13. Contact us

For any privacy-related questions, concerns, or requests, contact us at: