September 5, 2026

This Privacy Policy explains how GD Pilots (“we”, “us”, “our”) collects, uses and protects your personal data when you use gdpilots.com, and what rights you have. We handle personal data in accordance with the EU General Data Protection Regulation (GDPR / AVG) and Dutch data‑protection law.

1. Who we are (the data controller)

The controller responsible for your personal data is:

Our website address is: https://gdpilots.com.

We are not required to appoint a Data Protection Officer, but you can raise any privacy question with us at the email above.

2. What data we collect, why, and on what legal basis

We collect only what we need to run the site and provide our services. The main categories are set out below, with the purpose and the GDPR legal basis for each.

2.1 Employer account data

When you register an employer account, we collect and store:

  • your first name and last name;
  • your company and your function / position;
  • your email address;
  • your password, stored only in encrypted (hashed) form — we never see or store it in plain text;
  • the IP address you registered from, your browser user‑agent, and the date and time of registration; and
  • a record of your agreement to our legal terms (that you consented, when, and which version of the terms applied).

Why: to create and manage your account, to confirm your email address, to let you publish vacancies, to keep the platform secure and prevent spam and abuse, and to keep a record that you accepted our terms.

Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR) for creating and running your account; our legitimate interest (Art. 6(1)(f)) in security, fraud and spam prevention — which is why we log the registration IP, user‑agent and timestamp; and, for the consent record, our legitimate interest in demonstrating that our terms were accepted.

2.2 Job‑listing content

When you publish a vacancy, we process the information you put into the Listing, which may include company and contact details. This is processed to display your Listing on the site (Art. 6(1)(b) and 6(1)(f) GDPR). Please do not include personal data in a Listing that is not necessary to advertise the role.

2.3 Payments

If you pay for a service, payment is handled by our payment provider. We do not receive or store your full card details. We do keep a record of the transaction (such as amount, date, and invoice details) to fulfil the contract and to meet our legal accounting obligations. Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).

2.4 Comments

When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user‑agent string to help spam detection.

An anonymised string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment. Legal basis: your consent and/or our legitimate interest in running comment functionality and preventing spam.

2.5 Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

2.6 Correspondence

If you contact us by email, we process the information you send us in order to respond and to keep a record of the correspondence. Legal basis: legitimate interest (Art. 6(1)(f)) and/or performance of a contract.

2.7 Server logs and technical data

Like most websites and through our hosting and security providers, we automatically record technical data such as IP address, browser type, referring pages, and the date and time of access. Why: to keep the site secure and available, to diagnose problems and to prevent abuse. Legal basis: legitimate interest (Art. 6(1)(f)).

2.8 Cookies and similar technologies

See section 3.

3. Cookies

If you leave a comment on our site you may opt‑in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Cookies we rely on to run the site (such as the login and security cookies above, and cookies set by our content‑delivery and security provider) are strictly necessary and are used on the basis of our legitimate interest and the cookie exemption in the Dutch Telecommunications Act. Any non‑essential cookies (for example, analytics or preference cookies, where used) are only placed with your consent, which you can give or refuse, and later change, via our cookie banner or your browser settings. Under Dutch law we ask for that consent before placing non‑essential cookies.

4. Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third‑party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

5. Who we share your data with

We do not sell your personal data. We share it only where necessary to run the service, and with providers who process data on our behalf under a data‑processing agreement:

  • Hosting provider — Hostinger: stores and serves the website and its data.
  • Content‑delivery and security provider — Hostinger: delivers the site and protects it against attacks and abuse.
  • Email delivery — Hostinger: sends account‑confirmation and notification emails from crew@gdpilots.com.
  • Spam and comment services: where comments are enabled, the Gravatar service (Automattic) as described above, and any automated spam‑detection service used to check submissions.

If you request a password reset, your IP address will be included in the reset email.

We may also disclose personal data where we are legally required to do so, or to establish, exercise or defend legal claims, or to protect the rights, safety or property of our users or others.

6. International transfers

We aim to keep personal data within the European Economic Area (EEA). Where a provider processes data outside the EEA (for example, a global content‑delivery or email service), we ensure an appropriate safeguard is in place — such as an EU adequacy decision or the European Commission’s Standard Contractual Clauses — so that your data remains protected.

7. How long we retain your data

We keep personal data only as long as necessary for the purposes above or as required by law.

  • Employer accounts: we keep your account data for as long as your account is active. If you close your account, or ask us to delete it, we remove your personal data, except anything we must keep for legal reasons (see below). We may also remove accounts that have been inactive for a prolonged period of 24 months.
  • Job listings: kept while live and for a reasonable period afterward in backups and archives, then deleted.
  • Invoices and transaction records: kept for 7 years to meet the Dutch tax retention obligation.
  • Server logs and security data: kept for 6 months, then deleted or anonymised.
  • Comments: if you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow‑up comments automatically instead of holding them in a moderation queue.

For users that register on our website, we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

8. Your rights

Under the GDPR you have the following rights in relation to your personal data:

  • Access — to obtain a copy of the personal data we hold about you.
  • Rectification — to have inaccurate or incomplete data corrected.
  • Erasure — to have your data deleted (“right to be forgotten”).
  • Restriction — to limit how we use your data in certain circumstances.
  • Portability — to receive certain data in a portable format, or have it sent to another controller.
  • Objection — to object to processing based on our legitimate interests.
  • Withdraw consent — where we rely on consent, to withdraw it at any time, without affecting processing already carried out.

Put more simply: if you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

To exercise any of these rights, email crew@gdpilots.com. We will respond within the statutory period (normally one month). We do not carry out automated decision‑making or profiling that produces legal or similarly significant effects.

Right to complain. If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens Postbus 93374, 2509 AJ Den Haag, The Netherlands www.autoriteitpersoonsgegevens.nl

You can also complain to the supervisory authority in your own EU country of residence.

9. How we protect your data

We take appropriate technical and organisational measures to protect personal data, including serving the site over HTTPS, storing passwords only in hashed form, using account confirmation and anti‑spam measures (such as honeypots and rate limiting) to reduce abuse, restricting who can access personal data, and relying on reputable hosting and security providers. No online service can be guaranteed to be completely secure, but we work to protect your data and to address any incident promptly. Where a data breach is likely to present a risk to your rights, we will notify the supervisory authority, and you where required, within the timeframes set by law.

10. Children

gdpilots.com is a professional platform intended for aviation employers and pilot professionals. It is not directed at children. In the Netherlands, the age at which a person can consent to the processing of their own data in relation to online services is 16; we do not knowingly collect data from anyone below that age.

11. Where your data is sent

Visitor comments may be checked through an automated spam detection service.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology or the law. We will post the updated policy here with a new “last updated” date. Where changes are significant, we will take reasonable steps to bring them to your attention.

13. Contact

For any question about this Privacy Policy or your personal data:

GD Pilots — Email: crew@gdpilots.com