This Privacy Policy explains how EUCCDB.EU ("we", "our", "us") collects, uses, and protects personal data when you use our platform. We are committed to compliance with the EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.
1. Who We Are
The data controller is the operator of the EUCCDB.EU platform (European Cabin Crew Database). For data-related enquiries, contact us at [email protected].
2. Data We Collect
2.1 Cabin Crew Candidates
- Full name, email address, password (hashed)
- Nationality, country of residence, date of birth
- Professional documents: Cabin Crew Attestation (CCA), medical certificate, passport/ID copy, DGR certifications, First Aid certificate
- Employment history, aircraft types, flight hours, language proficiencies
- Availability status and relocation preferences
- Profile photo (optional)
2.2 Aviation Academies
- Authorised representative name and corporate email
- School name, registration number, regulatory approvals
- Training programme details
2.3 Airlines
- Authorised representative name and corporate email
- Airline name, IATA/ICAO codes, country of registration
- Recruitment search criteria and browsing activity on candidate profiles
2.4 Technical Data
- IP address, browser type and version, operating system (captured by our infrastructure)
- Log data (access times, pages viewed, error logs)
- Authentication session tokens (stored in browser localStorage, not cookies)
3. How We Use Your Data
- Platform operation, creating and managing your account, verifying identity, enabling document storage and sharing
- Matching, presenting candidate profiles to airlines that meet their search criteria, with candidate consent
- Verification, confirming document authenticity and professional qualifications
- Communications, transactional emails (account confirmation, password reset, notifications)
- Legal compliance, responding to regulatory requests, enforcing our Terms & Conditions
- Security, fraud detection, abuse prevention, audit logging
4. Legal Basis for Processing
- Contract performance (Art. 6(1)(b) GDPR), processing necessary to provide the service you signed up for
- Consent (Art. 6(1)(a) GDPR), making your profile visible to airlines; you may withdraw consent at any time from Privacy & GDPR settings
- Legitimate interests (Art. 6(1)(f) GDPR), security, fraud prevention, platform improvement
- Legal obligation (Art. 6(1)(c) GDPR), compliance with applicable law
Where we process special categories of data (e.g. health information in medical certificates), we rely on explicit consent (Art. 9(2)(a) GDPR) or, where applicable, the employment/social security exception (Art. 9(2)(b)).
5. Data Sharing
We do not sell personal data. We share data only as follows:
- Airlines, candidate profile data is shared only when the candidate's visibility is set to "active"
- Aviation academies, candidate document data is shared only upon candidate request
- Infrastructure providers, Supabase Inc. (authentication and database, EU-region servers), Cloudflare Inc. (file storage via R2, edge network)
- Authorities, if required by court order or applicable law
6. International Transfers
Our primary database is hosted on Supabase infrastructure in the European Union. File storage uses Cloudflare R2, which may use EU-based data centres. Where transfers outside the EEA occur, we rely on the EU Standard Contractual Clauses (SCCs) or an adequacy decision.
7. Retention
- Active accounts, data is retained as long as your account is active
- Deleted accounts, all personal data is deleted within 30 days of account deletion, except data required for legal or regulatory compliance (retained up to 6 years)
- Application logs, retained for 90 days for security purposes
8. Your Rights
Under GDPR, you have the following rights:
- Access (Art. 15), request a copy of your personal data
- Rectification (Art. 16), correct inaccurate data
- Erasure (Art. 17), "right to be forgotten", delete your account and all data via Settings → Privacy & GDPR, or by emailing us
- Restriction (Art. 18), restrict processing in certain circumstances
- Portability (Art. 20), export your data in a machine-readable format
- Objection (Art. 21), object to processing based on legitimate interests
- Withdraw consent, at any time, without affecting prior lawful processing
To exercise your rights, email [email protected]. We respond within 30 days. You also have the right to lodge a complaint with a supervisory authority. If you are based in Poland, the competent authority is the Urząd Ochrony Danych Osobowych (UODO), uodo.gov.pl.
9. Cookies & Tracking
EUCCDB.EU uses no analytics, advertising, or tracking cookies. We do not use Google Analytics, Meta (Facebook) Pixel, or any third-party advertising or behavioural trackers, and we never sell your data.
The only information stored on your device is strictly necessary or functional: your login session, held in your browser's localStorage so you stay signed in, and small functional cookies that may be set only when you use specific features, such as signing in or completing a security check. Under the ePrivacy Directive these are exempt from consent, so no cookie consent banner is required. If we ever add analytics or advertising, we will ask for your consent first.
Fonts: Our typefaces are self-hosted on euccdb.eu. No font files are loaded from Google or any other third party, so viewing our pages sends no data to external font servers.
10. Security
We implement appropriate technical and organisational measures including:
- TLS/HTTPS encryption in transit
- Row-level security (RLS) on our database, users can only access their own data
- Presigned, time-limited URLs for document access
- JWT-based authentication with server-side session validation
- Access controls limiting staff access to personal data
In the event of a personal data breach, we will notify affected users and the relevant supervisory authority within 72 hours as required by Art. 33 GDPR.
11. Children
EUCCDB.EU is a professional platform. We do not knowingly collect data from persons under the age of 16. If you believe we have received data from a minor, please contact us immediately at [email protected].
12. Changes to This Policy
We may update this policy. Material changes will be notified by email or a prominent notice on the platform at least 14 days before they take effect.
13. Contact
For all data protection enquiries:
Email: [email protected]
Website: euccdb.eu