Cookie policy

1. What cookies and similar technologies are

Cookies are small text files that a website stores in your browser and reads again later. Similar technologies do the same thing in a different way, such as your browser’s local storage (localStorage) and session storage (sessionStorage).

They can serve very different purposes: remembering a choice, counting visits, measuring whether an ad works or recognising you as a user. The specific uses we make of them are described below.

They are classified in three ways:

• Who manages them: first-party (managed by the website publisher) or third-party (managed by another organisation, which processes the data obtained).
• What they are for: technical, preferences, analytics or measurement, and advertising.
• How long they last: session (deleted when you close the browser or tab) or persistent (kept for a defined period).

The law treats cookies and these similar technologies in the same way. Article 5(3) of Directive 2002/58/EC requires us to inform you and ask for your consent before using them, unless they are strictly necessary for the service you request. In Spain this rule is laid down in Article 22(2) of Law 34/2002 on information society services (LSSI); as GAT is based in Germany, Section 25 of the German TDDDG, which implements the same directive, also applies. We also follow the cookie guidance of the Spanish data protection authority AEPD (in Spanish) .

2. Who is responsible

GAT – German Aviation Training · Owner: Tim Hittinger
Max-Planck-Straße 22, 72810 Gomaringen (Germany)
Email: info@german-aviation-training.de

We use two first-party technologies that we manage ourselves. Only with your consent are cookies from one third party added: Google. The booking calendar is provided by eTermin, which uses its own technical cookies. More about us in the legal notice.

3. Table of cookies and similar technologies

Apart from “gat-consent”, which stores your choice, only those matching what you have accepted are used. Google’s cookies only exist in your browser if you have given your consent.

Duration: the maximum time the data remains in your browser unless you delete it earlier. Google’s cookies are set on our domain but processed by Google, which is why we list them as third-party.

4. First-party: your choice and booking count

gat-consent. Stores in your browser which categories you have accepted or rejected and the date of your decision. It contains no data that identifies you and is not sent to any server. Without it, we would have to ask you on every page and could not demonstrate your choice.

It does not require your consent because it is necessary to respect your decision (Article 22(2) LSSI). Storing it also lets us meet the obligation to be able to demonstrate consent (Article 6(1)(c) in conjunction with Article 7(1) GDPR). We ask you again 13 months after your choice; the AEPD considers it good practice not to exceed 24 months.

gat-booking:…. Only exists on the confirmation page you see after booking, and only if you have accepted analytics or ad measurement: it is part of that measurement. It stores the details eTermin adds to the address of that page (for example the service, the price and the technical booking number) so that the booking is counted only once. It is not sent to any server and is deleted when you close the tab.

This website sets no first-party cookies: you need no account and no login. Fonts, images, audio files and animations are loaded from our own server. We do not embed videos, maps or social media buttons from other providers.

5. Analytics: Google Analytics 4

Only if enabled and accepted. If we enable Google Analytics on this website, the cookie notice offers it to you as a separate option. As long as it is not enabled, it does not appear in the notice and is not used.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• Purpose: to see how many people visit the website, which pages they view, which booking and contact buttons they click and whether a booking is completed. For bookings we measure the service and the price, never your name or email address.
• Data: the random identifier in the cookie, pages viewed, clicks, date and time, device, browser and approximate location. Google Analytics 4 does not store IP addresses.
• What we do not do: Google signals and personalised advertising are disabled.
• Retention: data is deleted from Google Analytics after 14 months.
• Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

6. Ad measurement: Google Ads

We advertise our test on Google. If you accept and reach this website through one of our ads, Google stores a click identifier in the cookies _gcl_aw and _gcl_au (up to 90 days). If you then book, we can see that the ad led to a booking – without any data that tells us who you are.

• No behavioural advertising: we do not use remarketing and do not show you ads based on your browsing. Ad personalisation is switched off in our configuration.
• Provider: Google Ireland Limited (address in section 5).
• Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

When Google’s tag loads, Google may also use cookies on its own domains (for example google.com or doubleclick.net). Google decides on those: how Google uses cookies · Google privacy policy · privacy in Google’s business products .

7. eTermin booking calendar and other services

For bookings we use the calendar of eTermin GmbH, Mättivor 3, 6430 Schwyz, Switzerland. It only loads on the Book page: it appears when you choose a test or arrive via a “See dates” button. On small screens, eTermin’s own booking page opens directly.

When it loads, your browser connects to eTermin, which may use its own technical cookies, for example for the language. eTermin is responsible for those cookies: eTermin privacy policy . How we handle your booking data is explained in our privacy policy.

• Payment: if you pay with PayPal or by card (Stripe), you pass through their platforms, which apply their own privacy and cookie policies.
• Preparation + test bundle: bought in the GAT shop, a separate website with its own cookie information.
• External links: links to other websites (AESA, BOE, Austro Control, ProvenExpert, Google, WhatsApp or Zoom) only open if you click them. From then on, those websites’ policies apply.

8. How to accept, reject or withdraw your consent

• On your first visit, the cookie notice offers “Accept all”, “Reject all” and “Settings” at the same level. Until you choose, nothing from Google loads. Continuing to browse does not count as consent.
• By purpose: under “Settings” you choose analytics and advertising separately. No box is ticked in advance.
• Cookie settings: opens the panel now so you can change or withdraw your consent. The same button is at the bottom of every page.
• When you withdraw consent, we delete this website’s Google cookies from your browser and, if Google’s services had already loaded, reload the page. Any cookies Google has stored on its own domains must be deleted in your browser (section 9).
• Rejecting does not restrict you: you can use the whole website, the sample test, the tech check and the booking in exactly the same way.
• Renewal: we ask you again after 13 months – or sooner if we change the purposes or the third parties.

If you clear site data in your browser or block local storage, we cannot remember your choice and will ask you again.

9. Cookies in your browser settings

Besides the panel on this website, you can view, block and delete cookies and site data in your browser. Please note: if you accept third-party cookies, those that third parties store on their own domains can only be removed via your browser settings or the third party’s own tools.

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge
• Google Analytics opt-out browser add-on

10. International transfers

Google. Google Ireland Limited may transfer data to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Article 45 GDPR): Implementing Decision (EU) 2023/1795 of 10 July 2023 . More information on these transfers is available in Google’s privacy policy (link in section 6).

eTermin. eTermin GmbH is based in Switzerland, for which the European Commission has recognised an adequate level of protection (Decision 2000/518/EC, Article 45 GDPR). According to the provider, its servers are located in Frankfurt am Main, Germany.

11. Profiling and automated decisions

We do not build advertising profiles or make automated decisions about you based on these technologies.

12. Your rights

You have the right of access, rectification, erasure, objection, restriction of processing and data portability, and you can lodge a complaint with a data protection authority such as the Spanish AEPD. All of this, together with the rest of the information on how we process your data, is explained in our privacy policy.

13. Changes to this policy

We review this policy whenever the cookies or providers we use change. If we add purposes or third parties, we update this page and ask for your consent again.

Last updated: October 2026