Privacy notice

1. Who is responsible

Mountain Flyers 80 Ltd. · ATO CH.ATO.0298
Flugplatzstrasse 9, 3123 Bern-Belp

If you have a question about your data, or want to exercise any of the rights in section 7, contact the school office.

2. What this system holds about you

StudentRec is the training record of the school. Depending on your role it holds:

If you are a student

• Your name, your login name and — where it applies — your licence number.
• The courses you are enrolled in, and your enrolment status.
• Every training session: date, instructor, helicopter type, dual / solo / cross-country / instrument / simulator times, the exercises flown, and a rating from 1 to 5 for each of them, with the instructor's comments.
• Mountain landings, stage checks, theory attendance, theory examination results and school-internal progress test results.
• The aerodromes flown on a navigation session, as a route (departure, landings en route, arrival). This is the list of aerodromes only — no positions, no track of where the helicopter was during the flight — and it is recorded because the skill test form requires the aerodromes and distances of your solo cross-country flight.
• Debriefing comments and a short note on what the next session should focus on.
• Hand-drawn signatures — yours and your instructor's — where a session, a theory record or a test is signed.
• Personal documents you or the school upload: your medical certificate, language proficiency, radiotelephony licence and a copy of your passport or ID, together with their expiry dates.
• Files attached to sessions, and any files uploaded against checklist items.
• Your previous training, if your training with this school began on paper before StudentRec, or if you come to us from another school: where it took place and until when, the hours per helicopter type, the exercises and stage checks credited from it, mountain landings, a cross-country route, and scans of that earlier record. They come from you or from your previous school. Medical certificates and ID copies are taken out of those scans before they are uploaded — they belong with your personal documents (see below). Your previous training counts towards your standing in the course — hours, progress, landings, stage checks — and is marked as such; it does not count in the school's own statistics.
• Confirmations that you have read a notice shown to you after a stage check — the notice, the course and the date you confirmed it.
• Your end-of-training assessment ("student qualification"): a rating from 1 to 4 — or "not applicable" — for each criterion of the school's assessment form, covering your knowledge, your flying skills and your conduct during training (for example communication, decision making, workload management, punctuality and preparation). It also records that you were shown the form, that you confirmed having received training in accordance with the syllabus, and your signature and your instructor's, each with a place and a date. Since 8 October 2026 it also carries the list of exercises you were trained in — for each one how often, the first and last date, the best and the last rating and the instructors who flew it with you — copied from your sessions when your instructor signs, so that it says later exactly what you confirmed. This assessment is gone through with you before you sign it — nothing in it is hidden from you, and nothing in it is decided by the system.

The school also calculates two things from the record above, for planning how much instructor capacity the coming months need. Both are shown to the school only, and only as totals:

• How far through your course you are — the share of syllabus exercises you have reached the required standard in at least once or that were credited from your previous training, or, for a mountain rating, your landings against the number required. Students are counted in three groups (roughly the first, middle and last third of a course); the report shows how many people are in each group, not who.
• An estimate of the flying hours still to come — your average pace over the last six months, projected forward until you would reach the end of your syllabus. This estimate is computed per person but is only ever displayed added up across everyone: no predicted completion date is shown, stored or exported for you individually.

Neither figure is a decision about you, and neither is used to make one. They do not affect your ratings, your progress or your training programme — those are set by your instructor, not by a calculation. The level at which an exercise counts as reached is a school setting and is visible on the pages that show these numbers. You can ask us what your own figures are at any time (see Your rights below).

If you are an instructor or administrator

• Your name, your login name and licence number, and your roles and group memberships.
• Which sessions you taught, evaluated and signed, and which theory records and tests you confirmed. Your name also appears in the exercise list of the final assessment of the students you flew with, next to the exercises you trained them in — and is kept with that assessment for as long as it is kept (see How long we keep it).
• Which checklist lines you recorded. When you tick a line on a student's checklist, mark it as not applicable, or upload a document for it, your name and the date are kept on that line — and they are shown on the student's own training page, next to the line. It says who confirmed that a required document is on file, which is the point of the list; it is not a measure of your work. This is part of the training record and is kept for as long as that record is (see How long we keep it), not for the 365 days of the security log.
• Totals from those sessions. The reports page adds them up per instructor: how many sessions and hours you flew, broken down by course, and how those hours are spread over the months. This is for planning — who is available, and how the work is shared out — and not an assessment of your performance. Nothing is calculated, rated or ranked from it, nothing is stored, and it is visible only to administrators and to accounts holding the reporting role. There is no way from those figures to individual sessions, and they carry no times of day.
• The same personal documents as above, where the school records them for you.
• If you also train here — for example for a type rating — everything listed for students applies to you as well.

If you set up a passkey

• A passkey is an alternative to typing your password: your device signs you in with Face ID, a fingerprint or its PIN. If you are a student or an administrator, setting one up is entirely optional — nothing changes for you if you do not. If you are a flight instructor, it is not optional in the same way: see the point below.
• For flight instructors, a passkey replaces the password. Once you have signed in with a passkey once, your password stops working for signing in. Setting one up does not by itself do this — it takes effect only after the passkey has actually got you in, so a passkey that turns out not to work on your device leaves you no worse off than before. There are two ways back: you can remove your own passkey under My account, and your password works again; or, if you have lost the device, an administrator issues you a one-time password, which lets you in once so that you can set a new password and register a new device. This does not apply to accounts that also hold the administrator role.
• If you do, this system stores only the public half of the key, a name you choose for the device ("iPhone", "Notebook"), and the dates it was added and last used. The private half never leaves your device. Nobody at the school can set it, read it, or sign in as you with it — which is precisely the point of offering it.
• Your device stores the private half where it keeps your other credentials — the iCloud Keychain, the Google Password Manager or Windows Hello. If you have that synchronisation switched on, it is also held in your own account with that provider, together with this site's address and the name shown to you in the sign-in dialog. That is your device and your account, not the school's, and it is the same as choosing to save a password in your browser. We mention it so that it is not a surprise.
• You can remove a passkey yourself at any time under My account. Nobody at the school can remove it for you — there is deliberately no such function, for the same reason that nobody can create one for you.
• What others can see. Adding, using or removing a passkey is recorded in the security log like any other change to an account, so an administrator reading that log can see that you did it. For flight instructors, administrators are additionally shown a reminder while a passkey has been set up but not yet used to sign in — the unfinished step described above, shown so that someone can help, not to check up on you. Nothing else about your passkeys is shown to anyone.

Two things you should know, because they are not visible to you

• Administrative notes. Instructors can record a note about a session (“Administrative notes”), and administrators a note on a user profile (“Notes”), that is not shown to the student. These notes exist, they are part of your personal data, and your right of access covers them — if you ask for your data, they are included.
• Security log. A separate log records who changed or accessed what, and when, together with the IP address of the request. Failed sign-in attempts are recorded with the login name used and the IP address. This is a security record, not a record of your work: ordinary page views are deliberately not logged.

3. Why we hold it

• To prove your training. As an approved training organisation the school is required to keep records of each student's ground, flight and simulator instruction and of progress reports (ORA.ATO.120).
• To run your training. Tracking progress, deciding what to repeat, and preparing the next session — this is what the training agreement between you and the school is for.
• To keep flying safe. Monitoring the expiry of medical certificates, language proficiency and radiotelephony licences, so that nobody flies without a valid prerequisite.
• To keep the system secure. Managing accounts and access rights, and keeping the security log described above.
• To apply for your licence and skill test. Putting together the documents the Federal Office of Civil Aviation requires for your practical examination — see section 4.
• To document your assessment. Before a skill test the school has to assess you and go through that assessment with you. The signed form is the record that this happened, and the authority may ask to see it when it audits the school.
• To be able to show, years later, what training you received. If a former student makes a claim against the school — for example after an accident, saying a manoeuvre was never trained — the signed assessment with its exercise list is the school's evidence. That is why it is kept longer than the rest of the record (section 6), and for nothing else.

Under Swiss law these purposes rest on the training agreement, on the school's legal obligations as a training organisation, and on its legitimate interest in operating a secure system and in being able to defend itself against legal claims. Where the GDPR applies, the corresponding bases are Art. 6(1)(b), (c) and (f), and for health data Art. 9(2)(b) and (g).

4. Who can see it

• You — your own training record.
• Your instructors — the students and courses they are assigned to. An instructor who is not assigned to your enrolment cannot open it.
• Administrators — everything. Once the rest of your training record has been deleted (section 6), they are the only ones who can still open your final assessment, and every time they do, it is written to the security log.
• Staff with a school-wide task. Training management enrols students, maintains the syllabi and keeps your paperwork in order; reporting evaluates the school's figures. The Head of Training and the Chief Flight Instructor confirm, before your training starts, that you meet its pre-entry requirements, and confirm before it is closed that the required documents are complete — they can therefore see the training record of every student, and not only of the ones they teach. What they cannot do is record or rate any training, and they cannot open your medical certificate or ID (see the next point). Training management, the Head of Training and the Chief Flight Instructor also record your previous training (section 2) — what is credited from it — and upload the scans of that earlier record. User administration manages accounts and roles and sees no training record at all. Which person holds which of these roles is recorded in the system and can be listed at any time.
• Your medical certificate and ID are handled more narrowly. Only you and the people who check those documents — administrators and training management — can open the file itself. An instructor sees the document's name, its expiry date and whether it is still valid — not the document. Every download of such a file is logged.
• The Federal Office of Civil Aviation (FOCA/BAZL), when the school applies for your skill test. The school then assembles the documents the application requires and uploads them to the FOCA portal. Where identity or medical documents are part of that application, a copy of them is included. Only an administrator can produce such a package, each document is selected individually for that one application, and the security log records which documents were included and who exported them. Sending them to FOCA is part of applying for your licence — it is not a transfer abroad and involves no other recipient. Your end-of-training assessment is not part of that package; it stays in this system and is shown to the authority only if it asks for it during an audit of the school.
• Nobody else. Your data is not shared with other students, and it is not passed to third parties, unless the school is legally required to do so.

5. Where it is stored

• On a server in Switzerland, operated for the school by Infomaniak Network SA, Geneva.
• The connection to this site is encrypted.
• Backups are made daily and encrypted. Every night an encrypted image of the whole server goes to Infomaniak's backup service in Switzerland (Swiss Backup) and is kept there for up to four weeks; the password that unlocks it is held by the school, not by Infomaniak. A further encrypted copy of the data is kept on a school computer.
• If you set up a passkey, its private half is stored by your own device, not here — see section 2. That is the only part of your sign-in that lives outside this server, and it lives there because it must, for the method to mean anything.
• Apart from that encrypted backup, this system does not send your data anywhere by itself. It sends no email, calls no other external service, and loads no third-party scripts, fonts or trackers. It uses no advertising or analytics cookies — the only cookies it sets are the ones needed to keep you signed in and to remember your own filter settings. The one way documents leave it is an administrator downloading them deliberately, as described in section 4.

6. How long we keep it

• Your training record — sessions, ratings, comments, checklists, theory results, the final assessment, your previous training with the scans of it, and any files attached to them: kept in full for three years after your training ends, whether it ended with a completed course or not. The school is required to keep it for at least that long. In a specific case it may be kept longer — for example while a dispute or an official procedure is running — and the reason for that is recorded. The checklist lines carry the name of the staff member who ticked, marked or uploaded them; that name is part of the record and is kept and deleted with it.
• Your final assessment, after that: when the three years are over, everything above is deleted except the signed final assessment ("student qualification") with its exercise list. That one document is kept until ten years after your training ended, in a separate archive that only administrators can open — so that the school can show what training you received if a claim is made against it; ten years is the general limitation period under Swiss law. If a training ended without such a form, a list of the exercises flown is kept instead, taken from the sessions before they are deleted and marked as such. Then it is deleted too, and the deletion is recorded as below. It no longer depends on your account: if nothing else of yours is left, your account is deleted, and the archived document stays until its own date.
• Your medical certificate, ID copy and similar personal documents: deleted automatically 90 days after your training ends, together with the uploaded file. They are proof of fitness to fly at the time, not part of the training record, so there is no reason to keep them afterwards. For staff, these documents are kept while the working relationship lasts.
• The security log (who did what in the system): 365 days, then deleted automatically. Your name stays in it for that period even if your account is deleted earlier — the log has to remain complete to be worth anything.
• Your account — name, login name, licence number: for as long as your training record (first point above) is still kept. Once nothing is left, the system tells an administrator that the account can go. Your name, licence number and course are copied into the archived final assessment, so that it stays readable without the account.
• A record of the deletion itself: 10 years. When something above is deleted, one line is written down — your name, the course, when the training ended, what was deleted and who did it. If the record was removed because it was wrong rather than because its time was up, that line also carries the reason given and the names of the two administrators involved. It is kept so the school can still show, years later, that your data was deleted properly rather than lost or quietly retained; ten years is the general limitation period under Swiss law. Nothing of the training record itself survives in it, and it is visible only to administrators. Then it too is deleted automatically.
• A refused request to remove a record: 365 days. Removing a record as wrongly created needs two administrators. If the second one refuses, that refusal is kept for a year — your name, the course, the reason that was given and the reason it was refused — so that the same request coming back repeatedly is visible. Nothing was deleted in that case. Visible only to administrators, then deleted automatically.
• Passkeys: for as long as you keep them. You remove them yourself under My account, and they go with your account if it is deleted. They are a way in, not a record of anything, so there is no period to run.
• That you read this notice: the date and which version, for as long as your account exists. The school has to be able to show that it informed you, and this is that proof. It is nothing more than a date — there is no record of what you clicked or how long you looked.

Backups mean deletion is not instant: a deleted record can still exist in encrypted backup copies for up to about two months before the last of them is overwritten. If you want to know how long a specific record about you will be kept, ask — you are entitled to that answer.

7. Your rights

You can, at any time and free of charge:

• Ask what we hold about you and receive a copy — including the administrative notes and log entries described in section 2.
• Have incorrect data corrected. A wrong date, a wrong rating, a misspelled name.
• Ask for your data to be deleted, where the school is not required to keep it (see section 6). For the archived final assessment, the school weighs such a request against its need to defend itself while a claim can still be made, and tells you the outcome and the reason.
• Receive your data in a common electronic format, or have it passed to another organisation.
• Object to a particular use of your data.

Contact the school office. You will get an answer within 30 days; if that is not possible, you will be told why and when to expect one.

8. If you are not satisfied

You can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Bern. If you live in the European Union, you may also be able to complain to the supervisory authority of your country of residence.

9. Changes to this notice

This notice is dated at the top. If how the school handles your data changes in a way that matters to you, the notice is updated and the date changes with it — and the next time you sign in, you are asked to read it again. That is why you were asked once already: everything below was in place before, but nobody had ever been told.

What changed on 13 October 2026: every night an encrypted image of the whole server now also goes to Infomaniak's backup service in Switzerland, where it is kept for up to four weeks. Infomaniak already operates the server; the password that unlocks the backup stays with the school. How long a deleted record can survive in backups does not change — see sections 5 and 6.

What changed on 11 October 2026: the system can now hold your previous training — a paper record of this school from before StudentRec, or training at another school — with its hours, the exercises and stage checks credited from it, landings, a route and scans of that record. It counts towards your standing in the course, is visible to the same people as the rest of your training record, and is kept and deleted with it — see sections 2, 4 and 6.

What changed on 8 October 2026: after the three years, the signed final assessment with its new exercise list is no longer deleted with the rest of the training record but kept until ten years after the training ended, visible to administrators only, as evidence in case of a claim — see sections 2, 3, 4, 6 and 7.

What changed on 1 September 2026: for flight instructors, a passkey replaces the password once it has been used to sign in — see section 2, If you set up a passkey.

What changed on 30 August 2026: when someone ticks a line on your checklist, marks it as not applicable or uploads a document for it, their name and the date are now kept on that line and shown next to it — see sections 2 and 6.

What changed on 29 August 2026: section 2 now says plainly that the reports page adds up each instructor's sessions and hours, what those figures are for, and what is not done with them.

What changed on 27 August 2026: section 4 now says that training management, not only an administrator, can open a medical certificate or an ID copy for checking.

What changed on 10 August 2026: section 6 now also names two things the school keeps that it did not keep before — a refused request to remove a record, and the fact that you read this notice.