Legal

Privacy Policy

Last updated: April 18, 2026

This Privacy Policy explains how Aviation OJT Trace collects, uses, stores and protects your personal data when you interact with this website, including the demo booking form. We are committed to complying with the GDPR and other applicable privacy laws.

1. Who We Are — Data Controller

This website (aviationojttrace.com) is operated by:

Barbiera Daniele (Sole Trader / Ditta Individuale)
VAT Number (P. IVA): IT05805580874
Tax Code (Codice Fiscale): BRBDNL74A02L331V
REA Number: CT-434945
Registered with the Chamber of Commerce of Catania (CCIAA di Catania)
Email: privacy@aviationojttrace.com

For data collected via this website, Barbiera Daniele acts as the Data Controller. For data processed within the SaaS platform (ojt-trace.com) on behalf of subscribing organisations, Barbiera Daniele acts as Data Processor — see the platform Privacy Policy.

2. Data We Collect

When you submit a demo booking request, we collect:

  • Full name
  • Business email address
  • Company name (AMO)
  • Company website URL
  • Phone number
  • Preferred demo time slot
  • Optional notes (fleet types, candidate volume, etc.)

We also collect automatically:

  • IP address, browser user-agent, and device information (Recital 30 GDPR)
  • Access timestamps and page interaction logs (security and fraud prevention)

3. How We Use Your Data

  • Processing and confirming demo booking requests
  • Sending a booking confirmation email
  • Verifying the legitimacy of the requesting organisation (domain/website check)
  • Responding to enquiries and support requests
  • Fraud prevention and security (including reCAPTCHA — see Section 8)
  • Compliance with applicable legal obligations

We do not use your data for automated profiling, behavioural advertising, or any other purpose.

4. Legal Basis

  • Art. 6(1)(b) GDPR — Processing necessary for the performance of a pre-contractual measure (demo booking)
  • Art. 6(1)(f) GDPR — Legitimate interest (fraud prevention, domain verification, platform security)
  • Art. 6(1)(c) GDPR — Compliance with a legal obligation

5. Data Sharing

We do not sell personal data. Sharing is limited to:

  • Email delivery provider — to send booking confirmations (under a Data Processing Agreement)
  • Hosting/infrastructure providers — under appropriate contractual safeguards
  • Google LLC — via reCAPTCHA v3 (see Section 8)
  • Competent authorities — where required by law

6. Data Retention

  • Demo booking requests: retained for a maximum of 24 months from submission, then securely deleted.
  • Security and access logs: retained for a maximum of 12 months.
  • Legal obligations: where applicable law requires longer retention (e.g. tax records), data is retained for the period mandated by law.

7. Security

  • TLS encryption in transit
  • CSRF token protection on all forms
  • reCAPTCHA v3 bot and abuse prevention
  • Business email verification (personal email providers blocked)
  • Server-side input validation and rate limiting

8. Google reCAPTCHA v3

This website uses Google reCAPTCHA v3 (invisible) to protect the demo booking form from automated abuse. reCAPTCHA collects hardware and software information — including device and application data — and sends it to Google for analysis. This occurs on every form submission.

Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Subject to Google's Privacy Policy and Terms of Service. Data may be transferred to the United States under the EU-US Data Privacy Framework.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing fraudulent submissions).

9. International Transfers

Data is primarily processed within the EEA. Certain third-party processors (including Google reCAPTCHA) may involve transfers to the United States or other third countries, carried out under SCCs and/or the EU-US Data Privacy Framework in accordance with Chapter V GDPR.

10. Cookies

This website uses strictly necessary cookies (session management, CSRF protection) and functional cookies (language preference, consent record). Google reCAPTCHA may set its own cookies as part of its fraud-prevention mechanism. No advertising or behavioural tracking cookies are used. See our Cookie Policy for full details.

11. Automated Decision-Making

No automated decision-making or profiling under Article 22 GDPR. The domain/email verification is a security measure; all booking decisions are reviewed by a human.

12. Your Rights

  • Right of access (Art. 15)
  • Right to rectification (Art. 16)
  • Right to erasure (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object (Art. 21)

To exercise your rights: privacy@aviationojttrace.com

Right to lodge a complaint (Art. 77 GDPR): Italy — Garante per la Protezione dei Dati Personali — www.garanteprivacy.it. Or contact the supervisory authority of your EEA country of residence.

13. Data Protection Officer

Aviation OJT Trace has not appointed a DPO, as processing activities do not meet the thresholds under Art. 37 GDPR. Privacy enquiries: privacy@aviationojttrace.com.

14. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via a notice on this website.

15. Contact

privacy@aviationojttrace.com

This document is provided for general informational purposes and does not constitute legal advice.