Privacy policy
Status: October 2026. The German version is legally binding.
Draft – to be legally reviewed before publication; remove this note afterwards.
1. Controller
Sportflugzeugbau Antwerpen GmbH
Flugplatz 1
47929 Grefrath, Germany
represented by the managing director Jan Schiffer
Phone: +49 2158 4014953
Email: info@cao.aero
Please use these contact details for any data protection questions.
2. Overview
We only process personal data as far as necessary to run this website, handle your enquiries and provide the services in the customer area. We do not use analytics or advertising services, do not embed content from other providers (such as maps, videos or fonts) and do not pass on your data for advertising. The website and our email mailbox are operated in Germany.
3. Hosting
The website runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. Hetzner processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.
4. Visiting the website
When you visit the website, your browser necessarily transmits data to our server, in particular your IP address, date and time, the requested address and the browser type. This is required to deliver the pages and to keep the service secure (Art. 6(1)(f) GDPR).
We do not keep access logs. Technical error messages of the application are stored without IP addresses and overwritten automatically.
5. Cookies
We only use technically necessary cookies. They are required for the website to work and do not require consent (Section 25(2) no. 2 TDDDG). The legal basis for the related processing is Art. 6(1)(f) GDPR.
- csrftoken: protects forms against misuse by other websites; deleted when you close the browser.
- sessionid: keeps you signed in to the customer area; deleted when you sign out, at the latest after 8 hours.
- messages: shows one-off notices such as “Saved”; deleted immediately afterwards.
We do not use analytics, advertising or third-party cookies.
6. Contact and booking forms, email and phone
When you contact us via a form, by email or by phone, we process your details (e.g. name, contact details, registration and type, your message) to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns an order or contract, otherwise Art. 6(1)(f) GDPR.
Form enquiries are forwarded to our mailbox by email and also stored in the website database, where they are deleted automatically after 180 days. We keep emails as long as needed to handle them or as required by statutory retention obligations (e.g. commercial and tax law).
Our email mailbox is operated on our behalf by united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany.
7. Customer area
We run a protected customer area for aircraft owners; accounts are set up by invitation. There we process: name, email address, user name and password (stored only as an encrypted hash), registration and data of your aircraft, reported operating times and take-offs, and electronic maintenance checklists including name, licence number and signature. For each checklist we record who edited, submitted and reviewed it and when.
The purpose is maintaining the airworthiness of your aircraft under our contract (Art. 6(1)(b) GDPR) and complying with our record-keeping obligations as an airworthiness organisation under Regulation (EU) No 1321/2014 (Art. 6(1)(c) GDPR). We keep maintenance records for as long as these rules require and delete other data once the contract has ended and no retention obligation applies.
Signing on your phone: the QR code opens a personal link that is valid for 15 minutes and can only be used once. The signature is stored as an image and becomes part of the checklist.
Invitations and notifications are sent via our email mailbox (see no. 6).
8. Links to other websites
Our pages contain links, e.g. to the German air navigation service (AIP), OpenStreetMap and Niershorst airfield. The other website is only accessed when you click a link; its own privacy policy applies there.
9. Recipients
Your data is only accessible to our staff as far as they need it for their tasks, and to the service providers named above as processors. Authorities such as the Luftfahrt-Bundesamt only receive data if we are legally obliged to provide it. No data is transferred to countries outside the EU.
10. Encryption
The connection to this website is encrypted with TLS (shown by “https://” in the address bar).
11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Please contact info@cao.aero.
You may also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
We do not use automated decision-making or profiling.