Privacy Policy

Last updated: [[STAND]]

1. Controller

The controller responsible for processing personal data on this website (Media Kit) is:

AVIAIR GmbH
Hannoversche Straße 17, 49084 Osnabrück, Germany
Phone: +49 (0) 541 915 3040
Email: office@aviair.zone

[[DSB]] You can reach our data protection officer at: …

2. Overview

The Media Kit is a private area for advertisers and partners. Only people we have invited can access it. We process only the data needed for access, inquiries, and secure operation. We use no analytics or tracking tools, embed no third-party content, and load no fonts or scripts from external servers.

3. Hosting and Server Logs

The website and its database are hosted by Railway Corporation, San Francisco, USA. The servers are located in the [[RAILWAY_REGION]] region.

Each time you visit, the host automatically records technical data in log files: IP address, date and time, requested URL, status code, and browser identifier. We need this data to keep the site secure and stable and to fix errors.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation)
• Retention: [[LOG_TAGE]] days, then deleted automatically

We have a data processing agreement with Railway. For transfers to the US, see section 9.

4. Invitation and Access

When we grant you access to the Media Kit, we store:

• your email address
• an internal note (usually your name or company)
• your preferred language
• the dates of approval, invitation, last login, and last activity

We send you an invitation by email.

• Purpose: providing the Media Kit to you, initiating a business relationship
• Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures), alternatively Art. 6(1)(f) GDPR (legitimate interest in presenting our offerings to partners)
• Retention: until we remove your access, at the latest [[INAKTIV_FRIST]] after your last activity. We will delete your access at any time on request.

5. Sign-in With a Code

You sign in without a password. You enter your email address and receive a one-time code by email.

• The code is never stored in plain text, only as a hash and is valid for 10 minutes.
• To prevent abuse, we store your email address and your IP address in pseudonymized form (as a hash) for 10 minutes when you request a code. Failed sign-in attempts are stored for 1 day.
• After you sign in, your session lasts 30 days.

• Legal basis: Art. 6(1)(b) GDPR (access), Art. 6(1)(f) GDPR (abuse prevention)

6. Inquiries

You can use the inquiry form to tell us which formats interest you. We process the information you enter (e.g., first and last name, company, email address, selection, timing, message, phone number, if provided).

Inquiries are not stored in the Media Kit database. They are sent to us by email, and you receive a confirmation at your registered address. Both emails then remain in our mailbox.

• Purpose: handling your inquiry, preparing an offer
• Legal basis: Art. 6(1)(b) GDPR
• Retention: as long as needed to handle your inquiry. If a contract is concluded, statutory retention periods apply (generally 6 years for business correspondence under Section 257 of the German Commercial Code, 10 years for accounting records under Section 147 of the German Fiscal Code).

7. Email Delivery via Microsoft 365

We send all emails (invitation, code, inquiry, confirmation) via Microsoft 365, provided by Microsoft Ireland Operations Limited, Dublin, Ireland. This involves processing your email address and the content of the message. We have a data processing agreement with Microsoft.

Emails containing sign-in codes are not stored in our mailbox.

Our emails contain no tracking pixels and no tracked links. Images are embedded directly in the email. The email font is loaded from our server when you open the email, which means your IP address appears in our host's log files (see section 3).

8. Cookies and Local Storage

We only use cookies that are technically necessary:

Your browser also stores your selection in the Media Kit (local storage). It contains no personal data and is not sent to us.

• Legal basis: Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) (technically necessary, no consent required), Art. 6(1)(b) and (f) GDPR

9. Transfers to Third Countries

Railway is based in the US. Microsoft may also transfer data to the US for maintenance and support. Transfers are based on [[RAILWAY_TRANSFER]] (e.g., the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which the providers are certified, or EU Standard Contractual Clauses).

10. Your Rights

You have the right to:

• access your stored data (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)

To exercise these rights, email office@aviair.zone.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Our competent authority is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
(State Commissioner for Data Protection of Lower Saxony)
Prinzenstraße 5, 30159 Hannover, Germany

11. Requirement to Provide Data, Automated Decisions

We cannot grant you access without an email address. We do not use automated decision-making or profiling.