Data Processing Agreement

Last updated: 04/06/2026

This Data Processing Agreement forms part of the Agreement between the Customer and eAvio, d.o.o.

It applies where eAvio processes Personal Data on behalf of the Customer in connection with the eAvio Platform.

1. Vocabulary

Terms used in this Data Processing Agreement have the same meaning as in the eAvio Platform Service Terms.

In addition:

“Controller” means the party that determines the purposes and means of processing Personal Data.
“Processor” means the party that processes Personal Data on behalf of the Controller.
“Sub-processor” means another processor engaged by eAvio to process Personal Data for the purpose of providing the Platform.
“Processing” means any operation performed on Personal Data, including collection, storage, use, access, transmission, deletion or return.
“Platform Communications” means occasional communication sent by eAvio to Customers or Users about the Platform, product updates, new features, aviation-related news, educational content, partner offers or other information connected with aviation or the Platform.
“Partner Services” means third-party services, products or solutions that may be presented, promoted, integrated, referred or made available through the Platform, by email or through other communication channels.
“Promotional Content” means product news, feature announcements, commercial offers, partner offers, referral offers, sponsored messages, educational aviation content with a commercial element, or similar communication sent or displayed by eAvio through the Platform, by email or through other communication channels.

2. Roles of the Parties

For Personal Data entered into the eAvio Platform by the Customer or its Users and processed by eAvio for the purpose of providing, maintaining, securing and supporting the Platform:

the Customer acts as the Controller;
eAvio acts as the Processor.

The Customer determines the purposes and means of processing Customer Data.

eAvio processes such Personal Data only:

to provide the eAvio Platform;
to maintain the eAvio Platform;
to secure the eAvio Platform;
to support the Customer and Users;
to comply with documented instructions from the Customer;
where required by applicable law.

Where eAvio processes Personal Data for its own purposes, such as account administration, billing, security, legal compliance, service analytics, Platform Communications, product news or Partner Service communication, eAvio may act as an independent Controller for that processing.

Such independent Controller processing is governed by the Privacy Policy and applicable data protection law, and is not processing on behalf of the Customer under this Data Processing Agreement.

3. Subject Matter and Duration

The subject matter of processing is the provision of the eAvio Platform and related services.

This includes processing necessary for:

User account management;
access management;
platform functionality;
scheduling;
aircraft and user management;
training records;
communication features;
technical records;
operational workflows;
support;
maintenance;
security;
backups;
service administration.

The processing continues for the duration of the Customer’s Subscription and for any additional period necessary for:

data export;
legal retention;
backup retention;
dispute resolution;
service suspension handling;
accounting or tax obligations;
security investigation;
other lawful retention purposes.

4. Categories of Personal Data

Depending on the Customer’s use of the Platform, the processed Personal Data may include:

User names and contact details;
email addresses;
telephone numbers;
User account details;
User role and permission data;
pilot records;
student pilot records;
instructor records;
staff records;
member records;
licence, training or qualification records;
aircraft-related operational records;
booking and scheduling records;
communication records;
notification records;
billing and administrative contact data;
User account and login data;
support communication;
technical logs;
security logs;
Platform usage data;
communication preferences, where technically available;
basic segmentation data, such as User role, organisation type, selected Plan or activated Modules, where used in accordance with the Privacy Policy and applicable law.

The exact Personal Data depends on how the Customer configures and uses the Platform.

5. Categories of Data Subjects

The data subjects may include:

Customer administrators;
Customer employees;
management staff;
pilots;
student pilots;
instructors;
aircraft owners;
club members;
renters;
guests;
passengers, where entered by the Customer;
maintenance or technical personnel;
billing contacts;
support contacts;
other persons whose data is entered by the Customer or its Users.

6. Processing Instructions

eAvio will process Personal Data on behalf of the Customer only:

according to the Customer’s documented instructions;
as necessary to provide the eAvio Platform;
as necessary to maintain the eAvio Platform;
as necessary to secure the eAvio Platform;
as necessary to support the Customer and Users;
as required by applicable law;
as necessary to protect the Platform, infrastructure and Users from security threats.

The Customer’s use of the Platform, configuration choices, User permissions, activated Modules and support requests are considered documented instructions.

Where eAvio processes Personal Data for Platform Communications, product news, Partner Services, referral offers or other communication sent for eAvio’s own purposes, such processing is not carried out on behalf of the Customer under this Data Processing Agreement.

In such cases, eAvio acts as an independent Controller and must process the Personal Data in accordance with:

the Privacy Policy;
applicable data protection law;
applicable electronic communication rules;
applicable consent, unsubscribe or objection requirements.

7. Confidentiality

eAvio ensures that persons authorised to process Personal Data are bound by confidentiality obligations.

Access to Customer Data is limited to persons who need such access for:

Platform operation;
maintenance;
support;
security;
legal compliance;
billing administration;
incident handling;
technical troubleshooting.

This confidentiality obligation continues after the end of the Subscription where required by law or contractual obligation.

8. Security Measures

eAvio will apply reasonable technical and organisational measures to protect Personal Data.

These may include:

access controls;
password-protected administrative access;
secure cloud infrastructure;
encrypted communication where technically available;
backups;
monitoring;
logging;
internal access limitation;
incident response procedures;
separation of Customer environments where technically applicable;
security updates;
infrastructure safeguards;
administrative access controls.

The Customer remains responsible for managing its own:

Users;
permissions;
passwords;
access rights;
internal access rules;
administrator accounts;
device security;
internal security procedures.

9. Sub-processors

The Customer authorises eAvio to use Sub-processors where necessary to provide the service.

Sub-processors may include:

cloud infrastructure providers;
database providers;
hosting or infrastructure providers;
email providers;
SMS providers;
payment providers;
analytics providers;
support tools;
monitoring tools;
backup providers;
security service providers;
technical service providers.

eAvio will ensure that Sub-processors are bound by data protection obligations appropriate to the services they provide.

Upon request, eAvio will provide information about relevant Sub-processors.

Where eAvio uses third-party providers for Partner Services, referral links, embedded tools or optional paid User features, the role of such third parties may vary depending on the specific service.

Such third parties may act as:

Sub-processors, where they process Personal Data on behalf of eAvio for the purpose of providing the Platform;
independent Controllers, where they determine their own purposes and means of processing;
joint or separate commercial partners, where a separate arrangement applies.

Where Partner Services are provided directly by a third party, the third party’s own terms, privacy policy and data protection role may apply.

10. International Transfers

Where Personal Data is transferred outside the European Economic Area, eAvio will ensure that appropriate safeguards are in place.

Such safeguards may include:

an adequacy decision;
Standard Contractual Clauses;
another lawful transfer mechanism;
additional safeguards where required by applicable law.

11. Assistance to the Customer

Taking into account the nature of processing and the information available to eAvio, eAvio will reasonably assist the Customer with:

data subject requests;
security questions;
data protection impact assessments, where relevant;
Personal Data breach handling;
information needed for GDPR compliance;
information about Sub-processors;
information about technical and organisational measures.

Such assistance is included where it is reasonable and standard.

Extensive, complex or custom compliance assistance may be charged separately at the standard hourly rate.

12. Personal Data Breaches

If eAvio becomes aware of a Personal Data breach affecting Customer Data processed on behalf of the Customer, eAvio will notify the Customer without undue delay.

The notification will include available information about:

the nature of the incident;
affected data;
likely consequences;
measures taken;
measures proposed;
relevant technical or organisational context, where available.

The Customer remains responsible for notifying supervisory authorities or affected individuals where required by law, unless eAvio is legally required to notify them directly for processing where eAvio acts as an independent Controller.

13. Deletion and Return of Data

After termination of the Subscription, the Customer may request an export of its Customer Data within the period stated in the Service Terms.

After the export period, eAvio may delete or anonymise Customer Data, unless retention is required by:

law;
backup policy;
dispute resolution;
accounting obligations;
tax obligations;
security investigation;
service suspension rules;
other legitimate legal or operational reasons.

Backups may remain stored for a limited period according to eAvio’s normal backup rotation and will be deleted or overwritten in due course.

This section applies to Customer Data processed by eAvio as Processor.

Personal Data processed by eAvio as an independent Controller may be retained or deleted in accordance with the Privacy Policy and applicable law.

14. Audit and Information

eAvio will provide reasonable information necessary to demonstrate compliance with this Data Processing Agreement.

Formal audits may be performed only:

with reasonable prior notice;
during normal business hours;
in a way that does not compromise Platform security;
in a way that does not disclose confidential information;
in a way that does not affect other Customers’ data;
in a way that does not unreasonably disrupt eAvio’s business operations.

If an audit requires substantial time, technical work or external assistance, eAvio may charge reasonable costs.

15. eAvio as Independent Controller for Platform Communications and Partner Offers

eAvio may from time to time send or display Platform Communications to Customers and Users.

Such communications may include:

important service information;
Platform updates;
new feature announcements;
information about new Modules;
onboarding information;
tips for using the Platform;
aviation-related news;
educational aviation content;
product newsletters;
information about Optional Services;
information about paid User features;
information about Partner Services;
invitations to webinars, demos or product presentations;
other relevant information connected with aviation, the Platform or eAvio services.

Such communication will not be sent excessively.

eAvio expects that general product or aviation-related newsletters will normally be sent only occasionally, for example:

once per month;
once every two months;
at another reasonable interval depending on the relevance of the communication.

eAvio may also display relevant product information, feature announcements, paid feature suggestions, partner offers or aviation-related content inside the Platform.

Such content may be shown, for example:

in the administrative interface;
in the user-facing interface;
on dashboards;
in notification areas;
in onboarding flows;
in feature-related screens;
by email;
through other communication channels.

Some Platform Communications or Promotional Content may be based on basic User context.

This may include:

User role;
organisation type;
selected Plan;
activated Modules;
Platform usage context;
country or region, where relevant;
communication preferences, where technically available.

For example:

instructors may receive information about instructor-related tools;
student pilots may receive information about student pilot tools;
pilots may receive information about flight planning tools;
administrators may receive information about management, reporting or communication features;
Customers using aircraft tracking may receive information about related analytics or hardware services.

eAvio may in the future make optional paid features available to individual Users.

Such features may include, for example:

flight planning tools;
pilot tools;
instructor tools;
student pilot tools;
flight analysis services;
aviation software;
other aviation-related digital services.

Such features may be offered:

directly by eAvio;
directly by a third-party partner;
through an integration within the Platform;
through a referral link;
as an optional paid feature purchased by individual Users;
as an optional service purchased by the Customer;
through another commercial model defined separately.

Where a paid User feature or Partner Service is offered, the commercial arrangement may vary.

This may include:

payment directly from the User to eAvio;
payment directly from the User to the partner;
payment through the Customer;
commission or referral fees paid to eAvio;
commission, revenue share or other benefit paid to the Customer;
invoicing from eAvio to the Customer;
invoicing from the Customer to Users;
another agreed billing or revenue-sharing model.

Unless expressly agreed otherwise, the availability, pricing, billing model, commission structure or revenue-sharing arrangement for paid User features or Partner Services may be changed, introduced or discontinued by eAvio from time to time.

Partner Services may include third-party aviation-related solutions, such as:

flight planning services;
flight analysis services;
training tools;
safety tools;
operational tools;
aviation marketplaces;
aviation software;
other relevant aviation products or services.

Where eAvio presents, promotes or refers Partner Services, eAvio may receive:

a referral fee;
commission;
revenue share;
marketing fee;
another commercial benefit.

Where applicable and required, eAvio will make reasonable efforts to disclose the commercial nature of such partner recommendations, referral links or promotional arrangements.

When eAvio processes Personal Data for Platform Communications, product news, paid User features, Partner Services, referral offers or targeted Promotional Content, eAvio acts as an independent Controller for that processing.

eAvio will process such Personal Data in accordance with:

the Privacy Policy;
applicable data protection law;
applicable electronic communication rules;
applicable consent requirements;
applicable legitimate interest requirements;
applicable unsubscribe or objection requirements.

eAvio will not use sensitive Personal Data for targeted Promotional Content unless a valid legal basis exists and such use is permitted by applicable law.

Where required by law, eAvio will provide Users with appropriate information and choices regarding marketing communication, partner offers and targeted Promotional Content.

This may include:

the ability to unsubscribe from marketing emails;
the ability to object to direct marketing;
preference settings where technically available;
separate consent where required by law;
information in the Privacy Policy about how communication and targeting are handled.

Service-related and transactional messages may still be sent where necessary for:

account administration;
security;
billing;
service operation;
support;
legal notices;
important Platform changes;
other non-marketing purposes.

16. Customer Responsibilities

The Customer is responsible for:

having a lawful basis for processing Personal Data;
informing data subjects where required;
obtaining consent where required;
managing Users and permissions;
ensuring that only necessary Personal Data is entered into the Platform;
ensuring that its use of the Platform complies with GDPR and aviation-related obligations;
responding to data subject requests where the Customer is the Controller;
keeping User records accurate and up to date;
removing Users who should no longer have access to the Platform;
informing Users that eAvio may process certain Personal Data as an independent Controller in accordance with the Privacy Policy;
informing Users that eAvio may send occasional Platform Communications, product updates, aviation-related news and partner offers where permitted by applicable law;
ensuring that its own internal notices, membership terms, employment notices or onboarding materials are consistent with the Service Terms, this Data Processing Agreement and the Privacy Policy where required.

The Customer remains responsible for the Customer Data it enters into the Platform and for the instructions it gives to eAvio as Processor.