Privacy

What this site records about you, where it goes, and how long it is kept. It covers both kinds of requester: people with an account, and people who submit a single flight request without one.

Who is responsible

[TO BE COMPLETED BY THE AERODROME — the controller's name, postal address and a contact address for data protection questions. The controller is the airport manager; the identification itself has not been written.]

[TO BE COMPLETED BY THE AERODROME — the legal basis for processing.]

What is recorded

If you hold an account

• Your email address, which is also your username, and a hash of your password. The password itself is never stored.
• The default pilot you keep in your profile: name, phone number, certificate number and, optionally, company.
• The default observer, if you keep one: the same four.
• Any further pilots, observers, drones and companies you save in your profile, so you can pick them when filing.
• Whether your address has been confirmed, whether the manager has approved the account, and whether an account previously existed for the same address.

On each flight request you file

• The date, the planned takeoff and landing times, and the maximum altitude.
• The drone: type, and the serial number and Remote ID where you give them.
• Where the drone will fly, and separately where you will be standing.
• The purpose, who the flight is for, and any notes you write.
• The confirmations you ticked — insurance, the priority of manned aircraft, a monitored phone, and the authorisation to fly above 120 m where the flight goes above it — stored as you submitted them.
• The pilot and observer details as they stood when you filed — copied onto the request, not referenced, so later profile edits do not change a request already filed.
• The decision, and the manager's note, if one is given.
• If you use the departure checklist: which items you ticked and the wording each one had at that moment, when you departed, when you landed, whether you pressed Landed or the site closed the flight at midnight, and any notes you write before departure or after landing.

If you submit a single request without an account

• Your name, and a full postal address — street, house number, postcode, town and country.
• Your phone number and email address, and your certificate number if you give one.
• The drone's make and model, and its serial number and Remote ID if you give them. Those last two are optional.
• The date, the planned times, and the circle you drew: a centre point and a radius.
• The four confirmations you ticked, stored as you submitted them.
• Any notes you add for the airport manager. They go to the manager and are not included in any email.
• The decision, and the manager's note, if one is given.

The postal address is asked only of requesters without an account, and it is the one piece of information no account holder is ever asked for. It is asked because it is the only way of reaching someone that does not depend on a mailbox or a handset they may have stopped using.

Technical records

• Rate-limiting counters. Registration, login, password reset, address confirmation and the single-request form each count attempts against the IP address they came from, and against the email address submitted. Both are stored as given, and deleted a day after the period they count over has ended.
• Confirmation and password-reset links. Only a hash of each link's token is stored, so reading the site's database does not yield working links. Expired links are deleted a day after they expire.
• Decisions received from the aerodrome's system are recorded for 30 days, so that a decision sent twice is applied once.
• Queued email. Messages the site sends are written to a table first and delivered by a timer. After sending, the message text is deleted; the recipient, the subject, the time it was queued, the time it was sent, the number of delivery attempts, the time a further attempt would have been due, a note of which message it was with the internal number of the account or request it concerned, and a running number are kept as the record of email sent (see How long it is kept).

The web server keeps an access log for 7 days: for each request, the time, your IP address, the address asked for, the headers your browser sent with it — including its description of itself — and the response. Cookie values are blanked. Confirmation and password-reset links carry their token in the address, so the token is removed from those addresses before they are written, and the page you came from is not logged at all.

The map, and your IP address

The single-request form shows a map so you can draw your flight area. The map images come from swisstopo, the Swiss Federal Office of Topography, at wmts.geo.admin.ch — they are not served by this site.

Your IP address therefore reaches swisstopo as soon as the map loads, before you have submitted anything and whether or not you go on to submit. That is unavoidable for any map drawn from tiles somebody else holds. Two things limit it: swisstopo is a Swiss federal service, so the request stays in the same country as the aerodrome, and it is the only third party this site contacts on any page. Nothing you type is sent with it — only the area of the map being displayed.

If you would rather not load the map, the form works without it. The three boxes below the map — latitude, longitude and radius — are the actual entry fields and can be typed into directly; the map only fills them in. With JavaScript turned off the map never loads, no request reaches swisstopo, and the form submits exactly as it otherwise would.

Where the data is held, and who else sees it

• This server is rented from Hetzner and stands in Nuremberg, Germany. The aerodrome, which decides what happens to your data, is in Switzerland. Your data is therefore processed in the EU under a Swiss controller.
• The aerodrome's own system collects requests from this site over an authenticated connection, so the manager can decide them. It is on a private network and is not reachable from the internet.
• Email is delivered through the aerodrome's mail provider in order to reach you.
• Backups are taken to the aerodrome's own system nightly, encrypted, and the hosting provider takes its own snapshots of the server.

Your data is not sold, is not used for advertising, and is not passed to anyone beyond the four above. This site sets no analytics and no tracking cookies; the only cookie it sets is the one that keeps you logged in.

How long it is kept

[TO BE COMPLETED BY THE AERODROME — the retention period for requests and for accounts whose address has been confirmed. Flight requests move to a history view after the flight and are kept as an operational record of the aerodrome; how long both are kept has not been decided yet. Until it is, the honest answer is the one in the next paragraph.]

As the site stands, flight requests and accounts whose email address has been confirmed are not deleted automatically, and neither is the record of email sent about them or about single requests.

An account whose email address is never confirmed is deleted 7 days after it was registered, once no confirmation link sent to it still works — together with its links, anything saved in its profile and the email sent to it about the account. Such an address was often typed in by somebody other than its owner. Until it is confirmed, the only email it receives is the confirmation message itself.

The technical records above are deleted on the schedule given beside each, and the access log after 7 days.

Your rights, and what this site can do today

[TO BE COMPLETED BY THE AERODROME — the rights available to you and how to exercise them.]

What the site itself provides today, stated plainly so that the gap above is not mistaken for a mechanism:

• If you hold an account, you can see and correct your own profile and see your own requests at any time. You can see nobody else's, and nobody without an account can see yours.
• Closing an account disables the login. The flight requests already filed are kept, because they are the aerodrome's operational record of what flew and when.
• If you submitted a single request without an account, this site gives you no way to see, change or remove it afterwards. There is no login, no status page and no link back in — the emailed decision is the whole of what you receive. A request about your data has to be made to the aerodrome directly, at the contact below, and is handled by hand.

Contacting the aerodrome

Phone +41 79 240 16 92 · Email rocco.bustelli@riviera-airport.swiss

Changes to this statement

This page describes the site as it currently works. If what the site records changes, this page changes with it.