Privacy policy

1. Controller

GAT – German Aviation Training, owner Tim Hittinger
Max-Planck-Straße 22, 72810 Gomaringen, Germany
Email: info@german-aviation-training.de · Phone: +49 7072 1352530

We have not appointed a data protection officer, as there is no legal obligation to do so. If you have any questions about data protection, please email us at the address above. We reply in English, Spanish or German; by phone we speak English and German.

2. Summary and legal bases

We process personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and, where applicable, Spain’s Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

The legal bases are in particular Art. 6(1)(b) GDPR (contract and pre-contractual steps), Art. 6(1)(c) (legal obligations), Art. 6(1)(f) (legitimate interests) and – where we explicitly ask for it – Art. 6(1)(a) (consent).

We only share data with third parties where necessary: with providers working on our behalf (web hosting and eTermin), payment providers, Zoom, the language testing body LTB 112 and, where applicable, Austro Control. With Google only if you consent. Some providers may process data outside the European Union (Switzerland or the USA); each section explains this.

We do not sell your data or use it for personalised advertising. Nor do we make decisions based solely on automated processing: your level is assessed by people – two assessors for every test.

3. Hosting and server log files

This website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. When you visit the website, the server automatically processes data sent by your browser: IP address, date and time, page viewed, referrer URL, amount of data transferred, browser and operating system.

This is technically necessary to deliver the website and keep it secure (Art. 6(1)(f) GDPR). The log data is deleted or anonymised after a short time. We have a data processing agreement with the host (Art. 28 GDPR).

4. Cookies, consent and measurement

Without your consent, this website sets no cookies and loads no analytics, advertising or social media services. We do not load fonts or graphics from third-party servers.

On your first visit we ask whether you allow Google Analytics (statistics) and Google Ads (ad measurement). We only ask about the services we currently use. You can accept, reject or choose each one, and rejecting is just as easy as accepting. Until you agree, your browser loads nothing from Google: we use Google Consent Mode in its basic variant.

Content from other providers is only loaded if you open the booking calendar yourself (section 6). The full list of cookies is in our cookie policy.

4.1 How we store your choice

We store your choice in your browser’s local storage (entry “gat-consent” with your selection and the date). It is not a cookie and is not sent to us. It means we do not have to ask you again on every page, and it keeps a record of your decision.

This storage is technically necessary and does not require consent (Art. 22(2) LSSI-CE; Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG; Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). After about 13 months we ask you again. You can delete the entry in your browser at any time.

4.2 Google Analytics 4

With your consent, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics shows us how the website is used – for example which pages are viewed, which booking and contact buttons are clicked, whether the sample test or the explainer video is used and whether a booking is made.

For this, cookies (“_ga” and “_ga_…”, lifetime up to 13 months) with a random identifier are set. Usage data is also sent to Google – for example pages viewed, clicks, date and time, device, browser and approximate location. Google Analytics 4 does not store IP addresses. Google signals and personalised advertising are disabled. The data is deleted in Google Analytics after 14 months.

4.3 Google Ads conversion tracking

We advertise with Google Ads. With your consent, when you click one of our ads, Google stores a click identifier in cookies (“_gcl_au” and “_gcl_aw”, lifetime up to 90 days). If you then book, we can see that the ad led to a booking – without information that allows us to identify you. We do not use remarketing, i.e. personalised advertising based on your visit.

4.4 Legal basis, transfer to the USA and withdrawing consent

The legal basis for Google Analytics and Google Ads is your consent (Art. 6(1)(a) GDPR, Art. 22(2) LSSI-CE and Section 25(1) TDDDG). Google may also transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision.

You can withdraw or change your consent at any time with effect for the future, via “Cookie settings” at the bottom of every page. When you withdraw it, we delete this website’s Google cookies from your browser. More information: Google privacy policy and privacy in Google’s business products .

Cookie settings

5. Contact by email, phone or WhatsApp

If you write to us or call us, we process the details you give us (for example name, email address, phone number and the content of your enquiry) to deal with your request. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a booking or a test, and Art. 6(1)(f) GDPR otherwise. We delete the data once it is no longer needed, unless we are legally required to keep it.

If you use WhatsApp, WhatsApp Ireland Limited (Merrion Road, Dublin 4, Ireland) also processes your data, and it may be transferred to Meta Platforms in the USA. Please only use WhatsApp if you are happy with this. Alternatively, you can email or call us.

6. Booking via eTermin

For bookings we use eTermin, a service of eTermin GmbH, Mättivor 3, 6430 Schwyz, Switzerland. According to the provider, its servers are located in Frankfurt am Main, Germany.

The eTermin calendar is not loaded on any other page of this website. It only appears embedded on our Book page: on larger screens, when you choose a test, click the button to show available dates or arrive there from another page of this website. On small screens, and via direct links to the calendar, eTermin’s booking page opens instead. At that point your IP address and technical information about your browser are transmitted to eTermin.

When you book, eTermin processes the data you enter on our behalf (for example name, email address, phone number, chosen slot and payment status). It uses this data to manage the appointment and send you confirmations (Art. 6(1)(b) GDPR). We have a data processing agreement with eTermin. The European Commission has adopted an adequacy decision for Switzerland. eTermin may set technically necessary cookies, for example for the language. More information: eTermin privacy policy .

After booking, eTermin may take you to our confirmation page. If you have consented to statistics or ad measurement (section 4), the booking is recorded there as an event – with the booked service, its price and the technical booking number, but without your name, email address or other contact details. To avoid counting the same booking twice, your browser stores a marker in session storage, which is deleted when you close the tab.

The Preparation + test bundle is bought in the GAT online shop at german-aviation-training.de . The privacy information of that website applies to that purchase.

7. Payment

You can pay by PayPal, credit card or bank transfer. For PayPal payments, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, is responsible. Card payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. For a bank transfer, your bank and ours process the payment data.

The data needed for payment is passed to the payment service you choose, either from our system or from our booking provider’s (Art. 6(1)(b) GDPR). The respective provider’s privacy information also applies.

8. Conducting the test

The test takes place by video call via Zoom (Zoom Communications, Inc., USA; certified under the EU-US Data Privacy Framework). After booking you receive three emails: the confirmation with the Zoom link, a request for a copy of your ID and the privacy form, and a link to enter your details in the test system.

For the test, the identity check and the certificate, we process your identity and licence data. For example: name, date and place of birth, address, and a copy of your ID (Spanish DNI, NIE or passport) and of your licence. We also process your test performance and result. Without this data we cannot run the test or issue the certificate.

We pass this data on to the language testing body LTB 112, based in Leonding (Austria), which carries out the second assessment and issues the certificate. Within the scope of official supervision, it may be made available to Austro Control GmbH, the Austrian aviation authority, which also carries out a third assessment where needed.

We do not send your result to AESA or to your flight school. You apply to AESA for the endorsement in your licence yourself, and from then on AESA processes your data as a separate controller.

The legal bases are Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (obligations under aviation rules for language proficiency assessments). You will find further details, for example on retention periods, in the privacy form we send you after booking.

9. Online withdrawal function

If you withdraw from a contract using our online “Withdraw from contract here” function, we process the data you enter: name, email address and booking details (number, dates and service) and, if you provide them, your postal address and a comment. We use this data to process your withdrawal and the refund. When you submit the form, you automatically receive an acknowledgement of receipt by email, showing the content of your declaration and the date and time it was received.

The legal basis is Art. 6(1)(c) GDPR: the law requires us to offer this function and to confirm receipt (Article 11a of Directive 2011/83/EU, inserted by Directive (EU) 2023/2673, and the national rules implementing it).

The server sends your declaration to us by email and does not store it in a database. We keep that email and the acknowledgement for as long as needed to process the withdrawal and then for the statutory retention and limitation periods.

To protect the form against misuse, the server temporarily stores a pseudonymised code derived from your IP address and the date (for IPv6, only the network part), together with the time of submissions. It uses this only to limit submissions per hour and deletes it automatically after one hour (legitimate interests, Art. 6(1)(f) GDPR). Daily submission counts contain no personal data and are deleted after three days. Withdrawal periods and conditions: terms and conditions.

10. Tech check and sample test

The tech check and the recording feature of the sample test run only in your browser. Camera image, microphone signal, recordings and anything you type are not sent to us or to third parties, and are not stored. You grant access to camera and microphone yourself in your browser. Access ends when you stop the test or leave the page.

11. External links

Links to other websites (for example AESA, the BOE, Austro Control, ProvenExpert, Google, WhatsApp or the Zoom test) are only opened when you click them. From then on, the respective provider’s privacy policy applies.

12. Retention periods

We only keep personal data for as long as we need it for the respective purpose. Statutory retention obligations remain unaffected, for example under German commercial and tax law: usually between six and ten years for booking and invoice documents. The lifetime of each cookie is given in section 4 and in the cookie policy.

13. Your rights and complaints

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can also object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future. To exercise your rights, email us at info@german-aviation-training.de.

You can also lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work. In Spain this is the Agencia Española de Protección de Datos (AEPD): www.aepd.es . The authority responsible for us is the data protection authority of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

14. Encryption

For security reasons, this website uses TLS encryption. You can recognise it by the padlock symbol and “https://” in your browser’s address bar.

15. Changes to this policy

We update this policy when our services or the law change. The current version is always the one published on this page. More about the website owner: legal notice.