Home›Privacy

Legal

Privacy

This privacy notice explains which personal data is processed when you visit the EuroFly website or use the associated services. It describes only the services and functions that are currently in use.

I. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Bastjan Alan James Schmidt
Weygandtstraße 138
D-22419 Hamburg
Germany

Email: info@eurofly-virtual.com

II. Data-subject rights

Subject to the applicable legal requirements, you have in particular the right of access under Art. 15 GDPR, rectification under Art. 16 GDPR, erasure under Art. 17 GDPR, restriction of processing under Art. 18 GDPR, data portability under Art. 20 GDPR and the right to object under Art. 21 GDPR.

You may withdraw consent at any time with effect for the future under Art. 7(3) GDPR. The lawfulness of processing carried out before the withdrawal remains unaffected.

You also have the right to lodge a complaint with a data-protection supervisory authority. The competent authority is in particular:

The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany
datenschutz-hamburg.de

III. Processing when using the website

Hosting and server log files

The website is hosted on server infrastructure located in Berlin, Germany. When a page is requested, technically necessary connection data is processed. This may include the IP address, date and time of access, requested file or URL, amount of data transferred, referrer URL, browser type and version, operating system and HTTP status code.

This processing is necessary to deliver the website, maintain its stability and security and investigate technical faults or abusive access. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.

Server log files are generally deleted after no more than seven days unless longer retention is required to investigate a security incident or to establish, exercise or defend legal claims.

Locally hosted fonts, images and technical files

Fonts, images, stylesheets and JavaScript files are delivered directly from our own website. Google Fonts and comparable external font services are not loaded.

The website does not automatically embed Google Maps, YouTube videos or comparable external media.

Consent management and local browser storage

The EuroFly website itself does not set analytics, marketing or advertising cookies. To remember your choice in the consent banner, the entry eurofly_cookie_consent_v1 is stored in your browser's local storage. It contains only the selected setting and a timestamp and is not automatically transmitted to us.

This storage is technically necessary so that your expressly selected privacy setting can be respected on subsequent page views. It is based on Section 25(2)(2) TDDDG. You can change your choice at any time through “Cookie settings” in the footer or delete your browser's local storage.

External live map and OperationCenter

The home page can display a live map from the shared NordFly Group OperationCenter. The live map is blocked by default and is loaded only after you consent to the “External content” category.

When it is loaded, a connection to operationcenter.nordfly-vag.com is established. In particular, your IP address, browser information, referrer, date and time and the page requested may be transmitted to that server. The external service may also use its own storage technologies.

Activation is based on your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future through the cookie settings. The live map is not loaded without consent.

Links to the login, registration or other OperationCenter functions lead to another website. A connection to that website is established only when you click the link.

Contact by email

If you contact us by email, we process the information you provide in order to handle and respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns the initiation or performance of a membership or user relationship. In other cases, processing is based on Art. 6(1)(f) GDPR; our legitimate interest is the proper handling of your enquiry.

The data is deleted once the enquiry has been fully dealt with and there are no statutory retention obligations or legitimate reasons for continued storage.

The website contains ordinary links to external services, in particular Discord, Instagram, Facebook, VATSIM, IVAO, SayIntentions.AI and partner or supporter websites. No social-media plugins, like buttons or automatically loading content from these providers are used.

Simply visiting our website therefore does not establish a connection to those platforms. Only when you click an external link do you leave our website. From that point onwards, the respective provider is responsible for the processing carried out there. Please consult that provider's privacy notice.

Services and functions not used

The following services and functions are currently not used on this website:

Google Fonts and Google Maps
Google Analytics, Matomo, Meta Pixel or other analytics and marketing services
Facebook, Instagram, X/Twitter or other social-media plugins
Google+ or other discontinued social networks
newsletter subscription or newsletter delivery
user posts, comments or ratings
Flash cookies or Flash Player technologies

If an additional service is introduced in the future, this privacy notice will be updated before it is used. Consent will be obtained in advance where required by law.

IV. User account, registration and deletion

User account and registration function

If you create a user account through our online service, we process and store the data you provide during registration.

The following personal data is collected in particular:

Name
Date of birth
Email address
Discord ID
Discord username
IVAO ID
VATSIM ID

We also store your IP address and the date and time of registration.

This data is processed to create and manage your user account, administer your membership within NordFly Group Airlines and ensure the secure and orderly operation of our platform.

Where processing is necessary to provide the user account and perform the user relationship, the legal basis is Art. 6(1)(b) GDPR.

Where you expressly consent to additional processing, the legal basis is Art. 6(1)(a) GDPR.

Storage and data security

Your data is stored on a server located in Berlin, Germany.

Your personal data is not sold or generally disclosed. Data is transferred to third parties only where a legal obligation or another lawful basis applies.

All persons who are given access to personal data are instructed accordingly and are bound to confidentiality.

Database access is personal, password-protected and limited to the permissions assigned to the relevant person.

Deletion of the active user account

Deletion of your active user account can be initiated centrally through the NordFly Group Installer.

After successful confirmation of your password, your active user account is deleted. At the same time, content provided through the NordFly Group Installer and installed on your system is uninstalled.

Deleting the active user account does not automatically result in the complete deletion of all data stored in connection with your former membership.

Certain data continues to be stored in a separate access-restricted archive after deletion of the active user account.

Data retained after account deletion

After deletion of your active user account, the following data is initially retained:

Name
Date of birth
Email address
Former pilot ID
Former airline ID or airline affiliation
Country
Time zone
Number of completed flights
Discord ID
IVAO ID
VATSIM ID
Date and reason for account deletion
Existence of a registration or airline ban
Reason for and date of a registration or airline ban

Continued storage is based on different legal bases depending on the relevant category of data.

Continued storage of the following data after deletion of the active user account is based on your consent under Art. 6(1)(a) GDPR:

Name
Date of birth
Email address

Your consent to continued storage is obtained during the registration or deletion process and reference is made to this privacy notice.

You may withdraw your consent at any time with effect for the future under Art. 7(3) GDPR. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

After receipt of your withdrawal, your name, date of birth and email address will be deleted from the archive. The withdrawal may be sent by email to the contact address stated in this privacy notice.

Storage based on legitimate interests

Irrespective of a withdrawal, the following data remains stored:

Former pilot ID
Former airline ID or airline affiliation
Country
Time zone
Number of completed flights
Discord ID
IVAO ID
VATSIM ID
Date and reason for account deletion
Existence of a registration or airline ban
Reason for and date of a registration or airline ban

The processing and continued storage of this data is based on our legitimate interests under Art. 6(1)(f) GDPR.

Our legitimate interests include in particular:

preventing abusive multiple registrations,
identifying former or blocked users,
enforcing registration and airline bans,
preventing existing restrictions from being circumvented,
protecting our platform, our members and NordFly Group Airlines against misuse,
documenting former memberships and administrative decisions,
handling complaints and legal disputes,
establishing, exercising or defending legal claims, and
maintaining internal and historical flight statistics.

This data is used solely for the purposes described and not for advertising or general contact.

Right to object

Under Art. 21(1) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.

After receiving an objection, we assess the continued necessity of storage and balance your interests, rights and freedoms against our legitimate interests. The relevant data is deleted where there are no compelling legitimate grounds for continued processing or where processing is no longer required to establish, exercise or defend legal claims.

Following an effective withdrawal of consent, your name, date of birth and email address are deleted. The remaining archive data may continue to be stored on the basis of Art. 6(1)(f) GDPR for as long as the legitimate interests described above continue to apply.

Retention period

Archived personal data is stored only for as long as necessary for the respective processing purposes. Data used to enforce a registration or airline ban is generally stored for the duration of that ban.

Where a ban is indefinite, the data is stored for as long as the ban remains in force and the data is necessary to prevent circumvention. The necessity and proportionality of continued storage are reviewed regularly.

If the purpose no longer applies and there is no other legal basis, personal data is deleted or permanently anonymised. Statistical information may be stored permanently where it can no longer be attributed to an identified or identifiable person.

V. Current version of this privacy notice

This privacy notice will be updated if the website, the services used or the applicable legal requirements change.

Last updated: August 2026