Privacy Policy

Version 1.1 — version of 23 October 2026.

1. Controller

The controller for the processing of personal data in connection with this website and BSFOM GmbH's own business activities is:

BSFOM GmbH
Trappelgasse 4
1040 Vienna
Austria
Telephone: +43 720 347878
E-mail: office@aviatos.at

2. Data protection contact

For questions or requests concerning the processing of personal data, please contact:

Mag. Thomas Sachernegg
Managing Director / Data Protection Contact
BSFOM GmbH
E-mail: office@aviatos.at

Mag. Thomas Sachernegg is responsible for coordinating data protection matters within BSFOM GmbH. No formal Data Protection Officer has been appointed.

3. Processing roles

BSFOM GmbH processes personal data in different roles depending on the relevant processing activity.

3.1 Website and business activities

BSFOM GmbH acts as controller for personal data processed for its own purposes, including website operation, communication with interested parties, contractual administration and customer relations.

3.2 AVIATOS platform

Where BSFOM GmbH processes personal data on behalf of an AVIATOS customer (the aircraft operator), BSFOM GmbH acts as processor and the respective customer acts as controller. The customer determines the purposes and essential means of the processing for which it is responsible. Such processing is governed by the contractual arrangements with the customer, including a Data Processing Agreement pursuant to Article 28 GDPR. The customer is responsible for providing the necessary privacy information to its employees, crew members, passengers and other affected individuals.

4. Website data processing

4.1 Server log data

When accessing the website, the web server records the following technical access information:

IP address
Date and time of access
Requested resource (request line) and hostname
HTTP status code
Amount of data transferred
Referrer information, where transmitted
Browser and user-agent information
Processing time of the request

Purpose. Operation, maintenance, security and technical monitoring of the website, error analysis and prevention of misuse.

Legal basis. Article 6(1)(f) GDPR — legitimate interest in maintaining a secure and functional website.

Retention. Server log data is rotated daily and deleted after seven days. In addition, the log volume is capped at 10 MB per file with at most three files retained per service, so that a high-traffic period cannot extend the retention. No additional security logs of website visits are kept. Server backups do not contain the web server logs.

4.2 E-mail and telephone enquiries

Visitors may contact BSFOM GmbH by e-mail or telephone; this website contains no contact form and no other input field. In this context, we process personal data provided by the person contacting us, which may include name and contact details, company and business contact information, the content of the enquiry, and related correspondence and communication records.

Purpose. Responding to enquiries, handling business correspondence and preparing potential contractual relationships.

Legal bases. Article 6(1)(b) GDPR, where necessary for pre-contractual steps requested by the data subject or the performance of a contract with that person; Article 6(1)(f) GDPR, where necessary for legitimate business communication and customer relations; Article 6(1)(c) GDPR, where processing or retention is required by law.

Retention. Personal data is retained for as long as necessary to handle the enquiry and any resulting contractual relationship, subject to applicable statutory retention obligations and the establishment, exercise or defence of legal claims. Enquiries that do not lead to a business relationship are deleted twelve months after the last contact.

5. Cookies and similar technologies

This website sets no cookies, uses no local storage, loads no external fonts, scripts or embedded third-party content and uses no analytics or tracking tools. No data is transmitted to external services when you visit this website. Because no technology requiring consent is used, no consent is requested and no cookie banner is shown. The cookies set by the AVIATOS application itself are described on the Cookies page.

6. Website hosting and service providers

The website is served by BSFOM GmbH's own web server on the same dedicated server as the AVIATOS application; there is no separate website hosting provider. The infrastructure and e-mail service providers are:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — server and data centre infrastructure in Germany.
Hetzner Finland Oy, Huurrekuja 10, 04360 Tuusula, Finland — encrypted off-site backup storage in Finland.
1&1 IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany — business e-mail hosting and the e-mail transmission (SMTP) of messages sent by the AVIATOS application.

The involvement of the individual providers depends on the relevant processing activity. Personal data is disclosed to service providers where necessary for their services and subject to data processing agreements pursuant to Article 28 GDPR.

7. AVIATOS platform

AVIATOS is an aviation software platform for supporting flight operations management, aircraft administration, crew management, documentation and related operational processes. It is used through the web application at one.aviatos.at and the AVIATOS mobile app.

Depending on the customer's use of AVIATOS, personal data may include:

User account information, including sign-in and two-factor authentication data
Employee and crew information, including emergency contacts named by users
Licences, ratings, checks and training records
Validity and limitations of aero-medical certificates (special category of personal data, Article 9 GDPR, processed by the customer under aviation regulation)
Flight operations, assignments, flight duty, rest periods and cosmic radiation dose records
Travel documents of crew
Passenger and customer information, including advance passenger information (APIS), where applicable
Operational documentation, administrative records, uploaded documents and attachments
Other information entered by the customer

Where BSFOM GmbH acts as processor, personal data is processed for the provision, operation, maintenance, security and support of AVIATOS in accordance with the applicable contractual arrangements and documented customer instructions. The customer remains responsible for establishing the applicable legal basis for processing carried out under its responsibility.

8. AVIATOS hosting, backups and sub-processors

The core infrastructure consists of:

Hetzner Online GmbH, Germany — dedicated server and data centre hosting
Hetzner Finland Oy, Finland — encrypted off-site backups
1&1 IONOS SE, Germany — e-mail transmission
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — delivery of push notifications (Firebase Cloud Messaging), see Section 9
Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland — delivery of push notifications to Apple devices (Apple Push Notification service), see Section 9

Backups of the database and of uploaded documents are created daily, encrypted before they leave the server, stored in Finland and retained for seven days (daily), four weeks (weekly) and six months (monthly). Personal data deleted from the platform is therefore removed from all backups within six months. No external monitoring, error-analysis or support service of a third party is used; the knowledge-base search of the application runs on BSFOM's own servers. Technical and organisational security measures are maintained in accordance with the applicable legal and contractual requirements and are described in the Data Processing Agreement.

9. Push notifications

The AVIATOS mobile app can receive push notifications about operational events. If a user enables them, the app registers a device token with AVIATOS, which stores the token together with the platform, a device label and the time of last use.

Notifications are sent by AVIATOS through Firebase Cloud Messaging (Google Ireland Limited) and, for Apple devices, relayed by Google to the Apple Push Notification service (Apple Distribution International Ltd.). Both providers may process the device token and the notification content outside the EEA (Google LLC and Apple Inc., USA) under the safeguards each provider names for this purpose (Chapter V GDPR).

A notification carries a notification type, an internal event identifier, and either a route (airport codes) and a time, a count, or the names of the schedule fields that changed. It carries no names of persons, no crew records and no document content.

The device token is deleted when the user signs out of the app, when the user removes the device in AVIATOS, or when the provider reports the token as no longer valid. Tokens are not deleted merely because a device has been inactive, because crew may be off duty for weeks.

10. International data transfers

AVIATOS platform data is stored and processed exclusively within the European Economic Area. Push notification delivery (Section 9) is the one exception and is disclosed as such. Where a customer activates an integration with a third-party service (Section 11), data is transmitted to that provider on the customer's instruction under the customer's own contract with the provider; the location of that provider's processing is governed by that contract.

11. Integrations activated by the customer, and public data sources

A customer can connect AVIATOS to third-party services with its own accounts. Data is sent to these services only on the customer's instruction, and only the following personal data:

ForeFlight Dispatch — flight data, crew positions with the crew member's e-mail address, and passenger manifest and general declaration documents of the flight
PPS / AirSupport (electronic flight bag and scheduled flight service) — flight data and crew names with positions
PnrGo (advance passenger information filing) — passenger and crew advance passenger information: name, date of birth, nationality and travel document data, as required by the destination authority
Avinode (charter marketplace) — aircraft schedule and availability; requests contain the requesting company and account names and passenger counts
Aviapages (quote enrichment) — route and aircraft data; no crew or passenger data
The customer's own cloud storage for manuals (WebDAV) — the credentials the customer configures and the documents it stores there

In addition, AVIATOS displays data from public sources for information only. These sources receive no personal data from AVIATOS: NOAA Aviation Weather Center (airport codes), the FAA NOTAM system (bulk download of the NOTAM data set; no query data), OpenWeather (coordinates), FlightAware and the OpenSky Network (aircraft registration or transponder address), and the European Central Bank (exchange rates). Map tiles of the maps in the AVIATOS web application are requested by your browser directly from Mapbox or OpenStreetMap; these providers therefore see your IP address and the requested map area, but no account data. Where radar imagery is shown, AVIATOS retrieves it on BSFOM's servers from Rainbow.ai and delivers it itself; Rainbow.ai sees the address of BSFOM's server and the requested map area, never your IP address or account data. The route overview is an image generated on BSFOM's servers with a base map from Natural Earth (public domain); no third party is contacted for it.

12. AVIATOS mobile app

The AVIATOS app stores the roster, flight and document data the user needs offline on the device. The app's data is protected with the operating system's data protection; passenger data is removed from the device seven days after the flight is completed; passenger data, confidential downloads and the user's own documents are wiped when the user signs out, and the push device token is deregistered at the same time. The app sets no cookies and contains no analytics or advertising tools. This Privacy Policy is the privacy policy referenced in the App Store listing of the AVIATOS app.

13. Support access by BSFOM

BSFOM support staff have no standing access to a customer's data in AVIATOS. A customer's administrators can grant a time-limited, read-only support view of their account for a support case; each view lasts at most 60 minutes, write operations are technically refused, protected data such as passenger and travel-document data, radiation records and occurrence reports is withheld unless the customer includes it, and every view and page opened is recorded in the customer's audit log. Account help (password and two-factor resets) shows BSFOM support only the users' names, roles and status.

14. Data security

BSFOM GmbH implements technical and organisational measures appropriate to the nature, scope, context and purposes of processing and the associated risks. These measures are intended to protect personal data against unauthorised access, unlawful processing, accidental loss, alteration and destruction. Further information about security measures applying to the AVIATOS platform is provided on the Security page, in the Data Processing Agreement and in BSFOM's security assessment reports, which are available to customers on request.

15. Data subject rights

Where BSFOM GmbH acts as controller, individuals may exercise the rights provided by the GDPR, subject to the applicable conditions:

Right of access — Article 15 GDPR
Right to rectification — Article 16 GDPR
Right to erasure — Article 17 GDPR
Right to restriction of processing — Article 18 GDPR
Right to data portability, where applicable — Article 20 GDPR
Right to object, where applicable — Article 21 GDPR
Right to withdraw consent at any time, where processing is based on consent

Requests may be submitted to office@aviatos.at.

Where BSFOM GmbH acts solely as processor for an AVIATOS customer, requests concerning customer-controlled processing should be addressed to the respective customer as controller. BSFOM GmbH will provide assistance as required by applicable data protection law and contractual arrangements.

16. Right to lodge a complaint

Individuals have the right to lodge a complaint with a competent supervisory authority. The Austrian supervisory authority is:

Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria
Website: https://www.dsb.gv.at/

17. Changes to this Privacy Policy

BSFOM GmbH may update this Privacy Policy where necessary to reflect changes in its processing activities, technical infrastructure or applicable legal requirements. The current version will be made available on this website together with its latest update date.