Privacy Policy

1. Data Protection at a Glance

General information

The following information provides a simple overview of what happens to your personal data when you visit our website or use our PilotLog application. Personal data is any data by which you can be personally identified. Detailed information can be found in the following sections of this privacy policy.

Data collection on this website and in PilotLog

Who is responsible for data collection?

Data processing on this website and in PilotLog is carried out by FINATUM AG. You will find the contact details under “Note on the responsible party” in this privacy policy and in the imprint.

How do we collect your data?

Your data is collected on the one hand by you providing it to us. This may be data that you send us by email, enter when registering, or record in your PilotLog logbook.

Other data is collected automatically by our IT systems when you visit the website or use PilotLog. This is primarily technical data (e.g. internet browser, operating system, IP address or time of access).

What do we use your data for?

Some of the data is collected to ensure error-free provision of the website and the application. We process the data you enter in PilotLog solely to provide you with your logbook. Other data is used – only with your consent – to measure the success of our advertising on the website (see section 5). PilotLog itself contains no analytics, tracking or advertising services.

What rights do you have regarding your data?

You have the right to receive information about the origin, recipients and purpose of your stored personal data free of charge at any time. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw it at any time with effect for the future. You also have the right to request the restriction of the processing of your personal data under certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time about this and any other questions on data protection.

2. Hosting

External hosting

This website and the server component of PilotLog (PilotLog Web including the database containing the logbooks) are hosted by an external service provider:

The servers are located in a data centre in Düsseldorf, Germany. They store the personal data collected on this website and in PilotLog, e.g. IP addresses, contact requests, account and logbook data as well as meta and communication data.

We use the hoster to fulfil our contracts with our users (Art. 6(1)(b) GDPR) and in the interest of secure, fast and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR). The hoster processes your data only to the extent necessary to fulfil its service obligations and follows our instructions in doing so.

Data processing agreement

We have concluded a data processing agreement (DPA) with the hoster pursuant to Art. 28 GDPR. It ensures that the hoster processes the personal data of our website visitors and users only in accordance with our instructions and in compliance with the GDPR.

3. General Information and Mandatory Information

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG), and this privacy policy.

When you use this website or PilotLog, various personal data is collected. This privacy policy explains what data we collect, what we use it for, how long we store it and to whom we may disclose it.

We would like to point out that data transmission over the Internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

Note on the responsible party

The controller within the meaning of the GDPR for data processing on this website and in PilotLog is:

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.). For all questions about data protection and to exercise your rights, you can reach us at the email address above.

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for which it was processed no longer applies. If you assert a justified request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once these reasons cease to apply.

Legal bases for processing

We process personal data on the following legal bases, which we indicate for each processing operation:

• Consent (Art. 6(1)(a) GDPR), for access to your device that is not strictly necessary, in conjunction with § 25(1) TDDDG;
• Contract and pre-contractual measures (Art. 6(1)(b) GDPR), e.g. for your user account and your logbook in PilotLog;
• Legal obligation (Art. 6(1)(c) GDPR), e.g. statutory retention obligations;
• Legitimate interests (Art. 6(1)(f) GDPR), e.g. for the security of our systems;
• Strictly necessary storage on your device (§ 25(2) no. 2 TDDDG) where it is required for a service you have expressly requested (e.g. signing in).

Recipients of personal data

We only disclose your personal data if this is necessary to perform a contract, if we are legally obliged to do so (e.g. to authorities), if we have a legitimate interest in the disclosure or if you have given your consent. We only use external service providers that process data on our behalf on the basis of a data processing agreement (Art. 28 GDPR). We do not sell your data and do not pass it on to third parties for advertising purposes.

Transfers to third countries

On this website we use some services of companies based in the USA (see section 4 and section 5). For companies certified under the EU-U.S. Data Privacy Framework (DPF), there is an adequacy decision of the EU Commission (Art. 45 GDPR). Where a recipient is not certified, the transfer is based on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). PilotLog account and logbook data is stored exclusively in Germany and is not transferred to third countries.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time – on the website via the “Cookie Settings” link in the footer, or informally by email to us. The lawfulness of the data processing carried out until the withdrawal remains unaffected.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation; this also applies to profiling based on these provisions. The legal basis on which a processing operation is based can be found in this privacy policy. If you object, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection under Art. 21(1) GDPR).

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes (objection under Art. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged violation (Art. 77 GDPR). This right is without prejudice to any other administrative or judicial remedy.

The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format (Art. 20 GDPR). If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible. In PilotLog you can export your logbook as an Excel file yourself at any time.

Access, rectification and erasure

Within the scope of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing (Art. 15 GDPR), and a right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR) of this data. You can contact us at any time about this and any other questions regarding personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data (Art. 18 GDPR). You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the review, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data was or is unlawful, you can request the restriction of data processing instead of erasure.
• If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request restriction of the processing of your personal data instead of erasure.
• If you have lodged an objection pursuant to Art. 21(1) GDPR, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may – apart from being stored – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line. All connections of the PilotLog applications to our server are TLS-encrypted as well.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Objection to advertising emails

We hereby object to the use of contact data published within the framework of the imprint obligation for sending advertising and information materials that have not been expressly requested. The operators of the pages expressly reserve the right to take legal action in the event of unsolicited advertising information, such as spam emails.

4. Data Collection on This Website

Cookies and similar technologies

Our web pages use so-called cookies and similar technologies such as your browser's local storage (localStorage). Cookies are small data packets that are stored on your device. They are stored either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are deleted automatically at the end of your visit. Persistent cookies remain stored until you delete them yourself or your browser deletes them automatically.

Cookies and storage entries that are strictly necessary to carry out the electronic communication process or to provide certain functions you have requested (e.g. signing in, language and display settings) are used on the basis of § 25(2) no. 2 TDDDG; the associated processing of personal data is based on Art. 6(1)(f) GDPR (legitimate interest in technically error-free and user-friendly provision) or Art. 6(1)(b) GDPR insofar as it is necessary to perform a contract. All other cookies and storage access (e.g. for advertising and conversion measurement, see section 5) are only used with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time via “Cookie Settings” in the footer.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be limited.

Local storage (localStorage)

This website stores the following entries locally in your browser without transmitting them to our servers:

• theme – your chosen colour scheme (light/dark)
• ui_lang – your chosen language (DE/EN)
• cookie_consent – your consent decision (granted/denied)
• cookie_consent_log – time and version of your consent decision

These entries serve solely for user-friendliness and as proof of your consent decision. They remain stored until you delete them via your browser settings. The legal basis is § 25(2) no. 2 TDDDG as well as Art. 6(1)(f) GDPR (legitimate interest in user-friendly presentation) and Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (proof of consent). If you are signed in to your customer account, a technically necessary session cookie is also set, which is deleted when you sign out or close the browser.

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser or the PilotLog application automatically transmits to us. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request and the address requested
• IP address

This data is not merged with other data sources. It is collected on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the technically error-free presentation, security and optimisation of our services – for this purpose, the server log files must be recorded. The log files are only stored for as long as is necessary for these purposes and are then deleted automatically.

Tailwind CSS (content delivery network)

For a consistent presentation, this website uses the Tailwind CSS design framework, which is loaded from the content delivery network “cdn.tailwindcss.com” when a page is opened. The provider is Tailwind Labs Inc., USA; delivery takes place technically via the networks of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Your browser connects to these servers and transmits your IP address and technical information (e.g. browser, requested file, time). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a consistent and fast presentation of our website. Vercel and Cloudflare are certified under the EU-U.S. Data Privacy Framework. Further information: Vercel privacy policy, Cloudflare privacy policy. The PilotLog applications do not load any content from this network.

Enquiries by email or telephone

If you contact us by email or telephone, your enquiry including all resulting personal data (name, enquiry) will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent.

Processing is based on Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary to carry out pre-contractual measures (e.g. support requests about PilotLog). In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR).

The data you send to us will remain with us until you ask us to delete it or the purpose for storing it no longer applies (e.g. after your request has been processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Registration and customer account on this website

You can create a customer account on our website to use additional functions, e.g. to purchase and manage paid plans for our tools. We use the data entered only to provide the respective service. The mandatory information requested during registration must be provided in full, otherwise registration is not possible. We will inform you of significant changes, for example to the scope of the service or technically necessary changes, at the email address provided during registration.

Processing takes place to perform the user relationship on the basis of Art. 6(1)(b) GDPR. The data is stored for as long as you are registered and then deleted. Statutory retention periods remain unaffected. The user account for the PilotLog application is a separate account; details can be found in section 6.

Customer and contract data

We collect, process and use personal data only insofar as it is necessary for the establishment, content or modification of the contractual relationship (inventory data). This is done on the basis of Art. 6(1)(b) GDPR. We process personal data about the use of our services (usage data) only to the extent necessary to enable you to use the service or to bill it.

The customer data collected will be deleted after completion of the order or termination of the business relationship. Statutory retention periods, in particular under German commercial and tax law (§ 257 HGB, § 147 AO), remain unaffected; the legal basis for this is Art. 6(1)(c) GDPR.

Payment processing and subscription management (Chargebee)

To conclude and manage paid plans (subscriptions) and for invoicing, we use the Chargebee service of Chargebee, Inc. (USA) or its affiliated companies. When you purchase a paid plan, a Chargebee checkout window opens. Your order, contact and billing data (e.g. name, email address, billing address, chosen plan, payment status) and the payment data required for payment are transmitted to Chargebee and to the payment service provider connected by Chargebee. We do not receive your full credit card or bank details. When the page with the plans is opened, the Chargebee script (js.chargebee.com) is also loaded; in the process, your IP address is transmitted to Chargebee.

Chargebee acts as our processor on the basis of a data processing agreement. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory retention obligations). The transfer to the USA is based on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Further information: Chargebee privacy notice.

5. Analytics and Advertising Services

Google Tag / Google Ads (conversion tracking)

On some pages of this website (in particular the pages about our tools and their prices) we use the Google Tag (gtag.js) and Google Ads conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google may also transfer data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Conversion tracking allows us to see whether users have performed a specific action on our website (e.g. purchasing a plan) after clicking on one of our ads. In the process, information about your use of the website (e.g. pages visited, time, device and browser information, IP address and, where applicable, order value and transaction ID) is transmitted to Google. We only receive statistical evaluations from Google, which do not allow us to identify you personally. However, Google may link this data to your Google account if you are signed in there.

Consent Mode v2 and your consent

We use Google Consent Mode v2. As long as you have not given your consent via the cookie banner, all storage and personalisation functions of Google (ad_storage, analytics_storage, ad_user_data, ad_personalization) are disabled: no cookies are set or read, and no data is used for personalised advertising. However, the Google Tag script is already loaded from Google servers when the pages concerned are opened; in the process, your IP address is transmitted to Google for technical reasons, and Google may receive status information without cookies (e.g. consent status, time, browser information). The full functions are only activated after you have given your consent; the Google cookies then set are usually deleted after 90 days.

The legal basis for conversion tracking is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. You can withdraw your consent at any time via the “Cookie Settings” link in the footer; the lawfulness of processing carried out before the withdrawal remains unaffected. Insofar as the script is already loaded and cookieless status information is transmitted before your consent, this is based on Art. 6(1)(f) GDPR; our legitimate interest lies in technically implementing your consent decision. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); in addition, Google has concluded Standard Contractual Clauses (Art. 46(2)(c) GDPR). Further information: https://policies.google.com/privacy.

The PilotLog applications (Excel add-in, PilotLog Web and apps) contain neither the Google Tag nor any other analytics or advertising services.

6. PilotLog (Excel Add-in, Web App and Apps)

6.1 About PilotLog and scope

PilotLog is an electronic pilot logbook by FINATUM AG. PilotLog is available in the following forms, all of which are based on the same functions and to which this section applies equally:

• PilotLog for Excel – an add-in for Microsoft Excel, e.g. obtained via Microsoft Marketplace (AppSource);
• PilotLog Web – the browser version at finatum.de/pilotlog;
• PilotLog Mobile – the mobile web app at finatum.de/pilotlog/m and the apps based on it for Windows, iOS and Android (Microsoft Store, Apple App Store, Google Play).

The controller for data processing in PilotLog is FINATUM AG (contact details in section 3).

6.2 Using the Excel add-in

The Excel add-in works with the Excel workbook you have opened and requires permission to read and modify this workbook (“ReadWriteDocument”). Your logbook data – flights, simulator sessions, aircraft, pilots and attached images and signatures – is stored in the workbook itself, i.e. wherever you keep the file (e.g. locally on your computer or in your OneDrive). As long as you do not use the “Pull Log” and “Push Log” functions, the add-in does not transmit any content of your workbook to us.

With “Pull Log” and “Push Log” you can synchronise your workbook with your PilotLog account. To do so, you sign in with your PilotLog account (6.3); during synchronisation the content of the workbook is transferred to or loaded from our server (6.4). The add-in does not use a Microsoft account and does not ask for Microsoft credentials.

The add-in's program files are loaded from our server (finatum.de) when it starts; this generates the server log data described in section 4. The Office library (Office.js) is loaded from servers of Microsoft Corporation. Microsoft itself is responsible for data processing by Microsoft in connection with Excel and Microsoft 365; the Microsoft Privacy Statement applies.

6.3 Your PilotLog user account

You need a PilotLog user account for PilotLog Web, the mobile applications and synchronising the Excel add-in. For this we process:

• name and email address (the email address serves as the user name);
• your password – exclusively as a cryptographic hash (bcrypt), never in plain text;
• role (user or administrator), account status and how the account was created (self-registration or by an administrator);
• time of account creation and of the last sign-in;
• display settings (e.g. sort order, last sheet opened) so that they are available to you on all your devices.

The purpose is to provide your account, to sign you in, to assign your logbook to you and, where applicable, to inform you of significant changes to the service. The legal basis is Art. 6(1)(b) GDPR. This information is required to use the account; without an account you can only use PilotLog locally as an Excel add-in.

6.4 Your logbook data

When you use PilotLog Web or the mobile applications, import an Excel file or run “Push Log” in the add-in, we store the contents of your logbook in our database:

• Flights: date, departure and arrival aerodrome, block and flight times (off-block, take-off, landing, on-block), aircraft type and registration, single/multi-engine, multi-pilot time, total flight time, name of the pilot in command (PIC), day and night landings, night and IFR time, function times (PIC, co-pilot, dual, instructor) and remarks;
• Simulator sessions (FSTD): date, type, duration and remarks;
• Aircraft: registration, type, variant, category and flight rules;
• Pilots (e.g. fellow pilots, instructors): alias, first and last name, licence number, issuing state and type of licence, and ratings (night, IFR, multi-engine);
• Attachments: photos (e.g. of a signed page) and signatures that you add to a flight or session.

The sole purpose is to keep, display, evaluate (e.g. totals, reports, proof of recent experience) and export your logbook and to synchronise it between your devices. The legal basis is Art. 6(1)(b) GDPR.

Your logbook is private. Every record is assigned to your account and can only be retrieved by you through the application – not even PilotLog administrators can access the content of other users' logbooks in the application. We do not analyse your logbook data for our own purposes, do not create profiles, do not use it for advertising and do not pass it on to third parties. We or our hoster only access the database insofar as this is necessary for operation, backup and troubleshooting or we are legally obliged to do so.

Please do not enter special categories of data such as health data in free-text fields (e.g. remarks); PilotLog is not intended for this.

6.5 Data of other persons in your logbook

A logbook naturally also contains data of other persons, such as the name of the pilot in command, details of fellow pilots and instructors in the pilot list, or their signatures. You enter this data yourself as a user. We process it solely to enable you to keep your logbook, which must contain such information under aviation regulations (in particular Regulation (EU) No 1178/2011, FCL.050). The legal basis is Art. 6(1)(f) GDPR; the legitimate interest of our users and of us lies in keeping a proper logbook in accordance with the regulations. Like your entire logbook, this data is accessible only to you.

Please only enter data of other persons that you need for your logbook. Data subjects can also assert their rights (section 3) against us.

6.6 Sign-in, sessions and protection against misuse

Session cookie (PilotLog Web and mobile web app)

After you sign in in the browser, we set the technically necessary session cookie plsid (only for the path /pilotlog/, with the attributes HttpOnly, Secure and SameSite=Lax). It contains only a random session identifier and is deleted when you sign out or close the browser. The legal basis is § 25(2) no. 2 TDDDG and Art. 6(1)(b) GDPR.

Sign-in tokens (apps and Excel add-in)

The apps and the Excel add-in sign in with your email address and password and receive a random sign-in token, which is stored on your device (in the Excel add-in permanently only if you choose “Stay signed in on this computer”). On the server we store only a cryptographic hash (SHA-256) of the token, the time it was created and last used, and a general device label (e.g. “PilotLog app (iPhone)” or “PilotLog Excel add-in”). A token becomes invalid and is deleted when you sign out, change your password (then for all other devices), delete your account or when it has not been used for 180 days. The legal basis is Art. 6(1)(b) GDPR.

Protection against misuse

To protect against password guessing, we store the email address entered, your IP address, the time and whether the attempt was successful for every sign-in and registration attempt. After repeated failed attempts, signing in is temporarily blocked. These entries are deleted automatically after two days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the security of user accounts.

Account log

We log important account events – sign-in (with device label), registration, password change, import and deletion of the logbook, and administrative actions by administrators – with name, time and a short description, but not the contents of your logbook. This serves security and traceability (Art. 6(1)(f) GDPR). The entries are deleted together with your account. If an administrator deletes an account, this action is logged with the email address of the deleted account and kept as proof of the deletion for as long as necessary for this purpose.

6.7 Storage on your device

For PilotLog to work, the applications store the following entries locally on your device:

These entries remain on your device; only the sign-in token is sent to our server with each request. The legal basis for this storage is § 25(2) no. 2 TDDDG, as it is strictly necessary for the use of PilotLog that you have requested, and Art. 6(1)(b) GDPR.

6.8 App permissions

• Camera and photo library: only when you actively take or choose a photo to attach to a flight; something is saved to the library only if you explicitly export a report there.
• Files and sharing: to export reports (PDF) and Excel files via your device's share menu and to import an Excel file you select.
• Internet access: to connect to our server.

PilotLog does not access your location, contacts, microphone or advertising identifiers. Night time is calculated on your device from the aerodromes and times you enter, not from your location.

6.9 No analytics, advertising or tracking services

PilotLog contains no analytics, tracking or advertising services and no third-party software components that send data to third parties. Apart from Microsoft's Office library in the Excel add-in, the applications do not load any content from third-party servers. No cross-device or cross-app tracking takes place.

6.10 Recipients, storage location and app stores

Your PilotLog account and logbook data is stored exclusively on the servers of our hoster wint.global GmbH in Düsseldorf, Germany (processing on our behalf, section 2). It is not transferred to third countries. There are no other recipients unless we are legally obliged to disclose data (e.g. to authorities).

If you obtain PilotLog via Microsoft Marketplace, the Microsoft Store, the Apple App Store or Google Play, the operators of these platforms (Microsoft, Apple, Google) process data – e.g. on downloads, purchases, updates and crash reports – under their own responsibility in accordance with their respective privacy policies. We have no influence on this. Statistics provided by the platforms (e.g. the number of installations) do not allow us to identify individual users.

6.11 Storage period and deletion

Deleting yourself: In PilotLog Web (account menu → “Delete my logbook” or “Close my account”) and in the mobile applications (More → “Delete my account”) you can delete your logbook or your account yourself at any time. When the account is deleted, all associated data (account data, logbook, images, sign-in tokens and log entries) is removed from the database immediately and permanently. You can also request deletion informally by email to info@finatum.de. You manage the data in your Excel workbooks yourself.

Deleted data may still be contained in our hoster's backups for a limited period. It is removed when these backups are routinely overwritten and is not used in any way until then.

6.12 Data security

• TLS encryption of all connections between the applications and our server;
• passwords stored only as bcrypt hashes (cost factor 12), minimum length of 12 characters;
• sign-in tokens stored on the server only as SHA-256 hashes;
• temporary lockout after repeated failed sign-in attempts;
• strict separation of logbooks by user account;
• protection against cross-site request forgery and cookies with the HttpOnly, Secure and SameSite attributes;
• storage exclusively on servers in Germany.

We continuously adapt these measures to the state of the art. However, no method can guarantee absolute protection.

6.13 Your controls

• View and correct: you can view and change all your data in the application at any time.
• Export: “Export Excel Log” gives you a complete copy of your logbook, including images, in a common machine-readable format; reports are also available as PDF.
• Delete: individual entries, the entire logbook or your account – at any time yourself (see 6.11).
• Sign out devices: signing out ends the session on that device; changing your password signs out all other devices.
• Further rights: access, restriction, objection and complaint, see section 3; requests by email to info@finatum.de.

6.14 Children and young people

PilotLog is not directed at children. Persons under the age of 16 may only create a PilotLog account with the consent of their parents or guardians. We do not knowingly collect personal data from children under the age of 13; if we become aware of this, we will delete such data.

6.15 New features

If we add features to PilotLog that process additional personal data, we will update this privacy policy before those features are released.

7. Own Services

Applications

We offer you the opportunity to apply to us (e.g. by email or by post). In the following, we inform you about the scope, purpose and use of the personal data collected as part of the application process. We assure you that your data is collected, processed and used in accordance with applicable data protection law and all other legal provisions and that your data is treated in strict confidence.

Scope and purpose of data collection

If you send us an application, we process the associated personal data (e.g. contact and communication data, application documents, notes taken during interviews) insofar as this is necessary to decide on the establishment of an employment relationship. The legal basis for this is Art. 6(1)(b) GDPR (initiation of an employment relationship) in conjunction with § 26 BDSG and – if you have given your consent – Art. 6(1)(a) GDPR. Consent can be withdrawn at any time. Within our company, your personal data will only be passed on to persons involved in processing your application.

If the application is successful, the data you have submitted will be stored in our data processing systems on the basis of Art. 6(1)(b) GDPR in conjunction with § 26 BDSG for the purpose of carrying out the employment relationship.

Data retention period

If we are unable to offer you a position, you decline a job offer or withdraw your application, we reserve the right to retain the data you submitted on the basis of our legitimate interests (Art. 6(1)(f) GDPR) for up to 6 months from the end of the application process (rejection or withdrawal of the application) in order to be able to trace the details of the application process in the event of disputes (e.g. with regard to the German General Equal Treatment Act).

You can object to this storage if you have legitimate interests that outweigh our interests.

After expiry of this period, the data will be deleted unless there is a statutory retention obligation or another legal reason for further storage. If it is apparent that your data will need to be retained after the period has expired (e.g. due to impending or pending legal proceedings), it will only be deleted once it is no longer relevant. Other statutory retention obligations remain unaffected.

8. Validity and Changes to This Privacy Policy

This privacy policy is dated 2 October 2026. It may become necessary to change it as our website and PilotLog evolve or due to changes in legal or regulatory requirements. The current version can be accessed at any time at https://finatum.de/privacy.html. We will also inform you in an appropriate manner of significant changes that affect your PilotLog account.

This privacy policy is available in German and English. In the event of any discrepancies, the German version shall prevail.