What is this Data Protection Notice about?
Pilatus Aircraft Ltd (also we, us) collects and processes personal data that concern you but also other individuals (third parties). We use the word data here interchangeably with personal data.
In this Data Protection Notice, we describe what we do with your data when you visit https://my.pilatus-aircraft.com/ our other websites or apps (collectively, the website), obtain services or products from us, interact with us in relation to a contract, communicate with us or otherwise deal with us. When appropriate we will provide a just-in-time notice to cover any additional processing activities not mentioned in this Data Protection Notice. In addition, we may inform you about the processing of your data separately, for example in consent forms, terms of use, terms and conditions, additional Data Protection or Privacy notices, forms and other notices.
If you disclose data to us or share data with us about other individuals, such as family members, co-workers (also from other companies), pilots and crew, we assume that you are authorized to do so and that the relevant data is accurate. When you share data about others with us, you confirm that. Please make sure that these individuals have been informed about this Data Protection Notice.
This Data Protection Notice is aligned with the EU General Data Protection Regulation (the GDPR), the Swiss Data Protection Act (the DPA) and the revised Swiss Data Protection (the revDPA. However, the application of these laws depends on each individual case.
Who is the controller for processing your data?
Pilatus Aircraft Ltd, Pilatusstrasse 1, 6370 Stans, Switzerland (Pilatus) is the controller for the Pilatus’ processing under this Data Protection Notice, unless we tell you otherwise in an individual case, for example in additional Data Protection notices, on a form or in a contract.
You may contact us for data protection concerns and to exercise your rights under Section 11 as follows:
Pilatus Aircraft Ltd Pilatusstrasse 1
6370 Stans, Switzerland
Email: [email protected]
We have appointed the following additional positions:
Data Protection Representative in the EU according to article 27 GDPR:
SIDD Datenschutz Deutschland UG
Schellingstrasse 109a
D-80798 Munich
Germany
Email: [email protected]
You can also contact these parties for Data Protection concerns.
Who is the controller for processing your data?
We process various categories of data about you. The main categories of data are the following:
Technical data
When you use our website or other online offerings (for example free Wi-Fi), we collect the IP address of your terminal device and other technical data in order to ensure the functionality and security of these offerings. This data includes logs with records of the use of our systems. We generally keep technical data for 6 months. In order to ensure the functionality of these offerings, we may also assign an individual code to you or your terminal device (for example as a cookie, see Section 12). Technical data as such does not permit us to draw conclusions about your identity. However, technical data may be linked with other categories of data (and potentially with your person) in relation to user accounts, registrations, access controls or the performance of a contract.
Registration data
Certain offerings, and services (such as login areas of our website, newsletters, free WLAN access) can only be used with a user account or registration, which can happen directly with us or through our third-party login service providers. In this regard you must provide us with certain data, and we collect data about the use of the offering or service. Registration data may be required in relation to access control to certain facilities, potentially including biometric data, depending on the control system. We generally keep registration data for 12 months from the date the use of the service ceases or the user account is closed.
Communication data
When you are in contact with us via the contact form, by e-mail, telephone, or by letter or other means of communication, we collect the data exchanged between you and us, including your contact details and the metadata of the communication. If we record or listen in on telephone conversations or video conferences, for example for training and quality assurance purposes, we will tell you specifically. Such recordings may only be made and used in accordance with our internal policies. You will be informed if and when such recordings take place, for example by an indication during the video conference in question. If you do not want to be recorded, please notify us or leave the (video) conference. If you simply do not want your image to be recorded, please turn off your camera. If we have to determine your identity, for example in relation to a request for information, a request for press access, etc., we collect data to identify you (for example a copy of an ID document). We generally keep this data for 12 months from the last exchange between us. This period may be longer where required for evidentiary purposes, to comply with legal or contractual requirements, or for technical reasons. E-mails in personal mailboxes and written correspondence are generally kept for at least 12 years. Recordings of (video) conferences we will usually keep for 12 months.
Master data
With master data we mean the basic data that we need, in addition to contract data (see below), for the performance of our contractual and other business relationships or for marketing and promotional purposes, such as name and contact details, and information about, for example, your role and function, your bank details, your date of birth, customer history, powers of attorney, signature authorizations and declarations of consent. We process your master data if you are a customer or other business contact or work for one (for example as a contact person of the business partner), or because we wish to address you for our own purposes or for the purposes of a contractual partner (for example as part of marketing and advertising, with invitations to events, and with newsletters). We receive master data from you (for example when you make a purchase or as part of a registration), from parties you work for, or from third parties such as contractual partners, associations and from public sources such as public registers or the internet (e.g., websites). We may also collect master data from our shareholders and investors. We generally keep master data for 10 years from the last exchange between us or from the end of the contract. This period may be longer if required for evidentiary purposes, to comply with legal or contractual requirements, or for technical reasons. For contacts used only for marketing and advertising, the retention period is usually much shorter, usually no more than 2 years from the last contact.
Contract data
This means data that is collected in relation to the conclusion or performance of a contract, for example information about the contracts and the services provided or to be provided, as well as data from the period leading up to the conclusion of a contract, information required or used for performing a contract, and information about feedback (e.g., complaints, feedback about satisfaction). We generally collect this data from you, from contractual partners and from third parties involved in the performance of the contract, but also from third-party sources (for example credit information providers) and from public sources. We generally keep this data for 10 years from the last contract activity or from the end of the contract. This period may be longer where necessary for evidentiary purposes, to comply with legal or contractual requirements, or for technical reasons.
Behavioral and preference data
Depending on our relationship with you, we try to get to know you better and to tailor our products, services and offers to you. For this purpose, we collect and process data about your behavior and preferences. We do so by evaluating information about your behavior in our domain, and we may also supplement this information with third-party information, including from public sources. Based on this data, we can for example determine the likelihood that you will use certain services or behave in a certain way. The data processed for this purpose is already known to us (for example where and when you use our products and services), or we collect it by recording your behavior (for example how you navigate our website or how you use your aircraft). We anonymize or delete this data when it is no longer relevant for the purposes pursued, which may be – depending on the nature of the data – between 2 weeks and 24 months (for product and service preferences). This period may be longer where necessary for evidentiary purposes, to comply with legal or contractual requirements, or for technical reasons. We describe how tracking works on our website in Section 12.
Other data
We also collect data from you in other situations. For example, data that may relate to you (e.g., files, evidence) is processed in relation to administrative or judicial proceedings. We may also collect data for health protection (for example as part of health protection concepts). We may obtain or create photos, videos and sound recordings in which you may be identifiable (for example at events, with security cameras, etc.). We may also collect data about who enters certain buildings, and when or who has access rights (including in relation to access controls, based on registration data or lists of visitors), who participates in events or campaigns (e.g., competitions) and who uses our infrastructure and systems and when. Moreover, we collect and process data about our shareholders and other investors, in addition to master data, including information for registers, in relation to the exercise of their rights and events (e.g., general meetings). The retention period for this data depends on the processing purpose and is limited to what is necessary. This ranges from a few days for many security cameras, to a few weeks for contact tracing and visitor data, which is usually kept for 3 months, to several years or more for reports about events with images. Data relating to you as a shareholder or investor is kept in accordance with corporate law, but in any case for as long as you are invested.