Privacy notice

1. Who is responsible

Mountain Flyers 80 Ltd. · ATO CH.ATO.0298
Flugplatzstrasse 9, 3123 Bern-Belp

If you have a question about your data, or want to exercise any of the rights in section 7, contact the school office.

2. What this system holds about you

StudentRec is the training record of the school. Depending on your role it holds:

If you are a student

• Your name, your login name and — where it applies — your licence number.
• The courses you are enrolled in, and your enrolment status.
• Every training session: date, instructor, helicopter type, dual / solo / cross-country / instrument / simulator times, the exercises flown, and a rating from 1 to 5 for each of them, with the instructor's comments.
• Mountain landings, stage checks, theory attendance, theory examination results and school-internal progress test results.
• The aerodromes flown on a navigation session, as a route (departure, landings en route, arrival). This is the list of aerodromes only — no positions, no track of where the helicopter was during the flight — and it is recorded because the skill test form requires the aerodromes and distances of your solo cross-country flight.
• Debriefing comments and a short note on what the next session should focus on.
• Hand-drawn signatures — yours and your instructor's — where a session, a theory record or a test is signed.
• Personal documents you or the school upload: your medical certificate, language proficiency, radiotelephony licence and a copy of your passport or ID, together with their expiry dates.
• Files attached to sessions, and any files uploaded against checklist items.
• Confirmations that you have read a notice shown to you after a stage check — the notice, the course and the date you confirmed it.
• Your end-of-training assessment ("student qualification"): a rating from 1 to 4 — or "not applicable" — for each criterion of the school's assessment form, covering your knowledge, your flying skills and your conduct during training (for example communication, decision making, workload management, punctuality and preparation). It also records that you were shown the form, that you confirmed having received training in accordance with the syllabus, and your signature and your instructor's, each with a place and a date. This assessment is gone through with you before you sign it — nothing in it is hidden from you, and nothing in it is decided by the system.

The school also calculates two things from the record above, for planning how much instructor capacity the coming months need. Both are shown to the school only, and only as totals:

• How far through your course you are — the share of syllabus exercises you have reached the required standard in at least once, or, for a mountain rating, your landings against the number required. Students are counted in three groups (roughly the first, middle and last third of a course); the report shows how many people are in each group, not who.
• An estimate of the flying hours still to come — your average pace over the last six months, projected forward until you would reach the end of your syllabus. This estimate is computed per person but is only ever displayed added up across everyone: no predicted completion date is shown, stored or exported for you individually.

Neither figure is a decision about you, and neither is used to make one. They do not affect your ratings, your progress or your training programme — those are set by your instructor, not by a calculation. The level at which an exercise counts as reached is a school setting and is visible on the pages that show these numbers. You can ask us what your own figures are at any time (see Your rights below).

If you are an instructor or administrator

• Your name, your login name and licence number, and your roles and group memberships.
• Which sessions you taught, evaluated and signed, and which theory records and tests you confirmed.
• Which checklist lines you recorded. When you tick a line on a student's checklist, mark it as not applicable, or upload a document for it, your name and the date are kept on that line — and they are shown on the student's own training page, next to the line. It says who confirmed that a required document is on file, which is the point of the list; it is not a measure of your work. This is part of the training record and is kept for as long as that record is (see How long we keep it), not for the 365 days of the security log.
• Totals from those sessions. The reports page adds them up per instructor: how many sessions and hours you flew, broken down by course, and how those hours are spread over the months. This is for planning — who is available, and how the work is shared out — and not an assessment of your performance. Nothing is calculated, rated or ranked from it, nothing is stored, and it is visible only to administrators and to accounts holding the reporting role. There is no way from those figures to individual sessions, and they carry no times of day.
• The same personal documents as above, where the school records them for you.
• If you also train here — for example for a type rating — everything listed for students applies to you as well.

If you set up a passkey

• A passkey is an alternative to typing your password: your device signs you in with Face ID, a fingerprint or its PIN. If you are a student or an administrator, setting one up is entirely optional — nothing changes for you if you do not. If you are a flight instructor, it is not optional in the same way: see the point below.
• For flight instructors, a passkey replaces the password. Once you have signed in with a passkey once, your password stops working for signing in. Setting one up does not by itself do this — it takes effect only after the passkey has actually got you in, so a passkey that turns out not to work on your device leaves you no worse off than before. There are two ways back: you can remove your own passkey under My account, and your password works again; or, if you have lost the device, an administrator issues you a one-time password, which lets you in once so that you can set a new password and register a new device. This does not apply to accounts that also hold the administrator role.
• If you do, this system stores only the public half of the key, a name you choose for the device ("iPhone", "Notebook"), and the dates it was added and last used. The private half never leaves your device. Nobody at the school can set it, read it, or sign in as you with it — which is precisely the point of offering it.
• Your device stores the private half where it keeps your other credentials — the iCloud Keychain, the Google Password Manager or Windows Hello. If you have that synchronisation switched on, it is also held in your own account with that provider, together with this site's address and the name shown to you in the sign-in dialog. That is your device and your account, not the school's, and it is the same as choosing to save a password in your browser. We mention it so that it is not a surprise.
• You can remove a passkey yourself at any time under My account. Nobody at the school can remove it for you — there is deliberately no such function, for the same reason that nobody can create one for you.
• What others can see. Adding, using or removing a passkey is recorded in the security log like any other change to an account, so an administrator reading that log can see that you did it. For flight instructors, administrators are additionally shown a reminder while a passkey has been set up but not yet used to sign in — the unfinished step described above, shown so that someone can help, not to check up on you. Nothing else about your passkeys is shown to anyone.

Two things you should know, because they are not visible to you

• Administrative notes. Instructors can record a note about a session (“Administrative notes”), and administrators a note on a user profile (“Notes”), that is not shown to the student. These notes exist, they are part of your personal data, and your right of access covers them — if you ask for your data, they are included.
• Security log. A separate log records who changed or accessed what, and when, together with the IP address of the request. Failed sign-in attempts are recorded with the login name used and the IP address. This is a security record, not a record of your work: ordinary page views are deliberately not logged.

3. Why we hold it

• To prove your training. As an approved training organisation the school is required to keep records of each student's ground, flight and simulator instruction and of progress reports (ORA.ATO.120).
• To run your training. Tracking progress, deciding what to repeat, and preparing the next session — this is what the training agreement between you and the school is for.
• To keep flying safe. Monitoring the expiry of medical certificates, language proficiency and radiotelephony licences, so that nobody flies without a valid prerequisite.
• To keep the system secure. Managing accounts and access rights, and keeping the security log described above.
• To apply for your licence and skill test. Putting together the documents the Federal Office of Civil Aviation requires for your practical examination — see section 4.
• To document your assessment. Before a skill test the school has to assess you and go through that assessment with you. The signed form is the record that this happened, and the authority may ask to see it when it audits the school.

Under Swiss law these purposes rest on the training agreement, on the school's legal obligations as a training organisation, and on its legitimate interest in operating a secure system. Where the GDPR applies, the corresponding bases are Art. 6(1)(b), (c) and (f), and for health data Art. 9(2)(b) and (g).

4. Who can see it

• You — your own training record.
• Your instructors — the students and courses they are assigned to. An instructor who is not assigned to your enrolment cannot open it.
• Administrators — everything.
• Staff with a school-wide task. Training management enrols students, maintains the syllabi and keeps your paperwork in order; reporting evaluates the school's figures. The Head of Training and the Chief Flight Instructor confirm, before your training starts, that you meet its pre-entry requirements, and confirm before it is closed that the required documents are complete — they can therefore see the training record of every student, and not only of the ones they teach. What they cannot do is record or rate any training, and they cannot open your medical certificate or ID (see the next point). User administration manages accounts and roles and sees no training record at all. Which person holds which of these roles is recorded in the system and can be listed at any time.
• Your medical certificate and ID are handled more narrowly. Only you and the people who check those documents — administrators and training management — can open the file itself. An instructor sees the document's name, its expiry date and whether it is still valid — not the document. Every download of such a file is logged.
• The Federal Office of Civil Aviation (FOCA/BAZL), when the school applies for your skill test. The school then assembles the documents the application requires and uploads them to the FOCA portal. Where identity or medical documents are part of that application, a copy of them is included. Only an administrator can produce such a package, each document is selected individually for that one application, and the security log records which documents were included and who exported them. Sending them to FOCA is part of applying for your licence — it is not a transfer abroad and involves no other recipient. Your end-of-training assessment is not part of that package; it stays in this system and is shown to the authority only if it asks for it during an audit of the school.
• Nobody else. Your data is not shared with other students, and it is not passed to third parties, unless the school is legally required to do so.

5. Where it is stored

• On a server in Switzerland, operated for the school by Infomaniak Network SA, Geneva.
• The connection to this site is encrypted.
• Backups are made daily, encrypted, and a copy is kept away from the server.
• If you set up a passkey, its private half is stored by your own device, not here — see section 2. That is the only part of your sign-in that lives outside this server, and it lives there because it must, for the method to mean anything.
• This system does not send your data anywhere by itself. It sends no email, calls no external service, and loads no third-party scripts, fonts or trackers. It uses no advertising or analytics cookies — the only cookies it sets are the ones needed to keep you signed in and to remember your own filter settings. The one way documents leave it is an administrator downloading them deliberately, as described in section 4.

6. How long we keep it

• Your training record — sessions, ratings, comments, checklists, theory results, the final assessment and any files attached to them: kept for three years after your training ends, whether it ended with a completed course or not. The school is required to keep it for at least that long. In a specific case it may be kept longer — for example while a dispute or an official procedure is running — and the reason for that is recorded. The checklist lines carry the name of the staff member who ticked, marked or uploaded them; that name is part of the record and is kept and deleted with it.
• Your medical certificate, ID copy and similar personal documents: deleted automatically 90 days after your training ends, together with the uploaded file. They are proof of fitness to fly at the time, not part of the training record, so there is no reason to keep them afterwards. For staff, these documents are kept while the working relationship lasts.
• The security log (who did what in the system): 365 days, then deleted automatically. Your name stays in it for that period even if your account is deleted earlier — the log has to remain complete to be worth anything.
• Your account — name, e-mail, licence number: for as long as any record above is still kept. Once nothing is left, the system tells an administrator that the account can go.
• A record of the deletion itself: 10 years. When something above is deleted, one line is written down — your name, the course, when the training ended, what was deleted and who did it. If the record was removed because it was wrong rather than because its time was up, that line also carries the reason given and the names of the two administrators involved. It is kept so the school can still show, years later, that your data was deleted properly rather than lost or quietly retained; ten years is the general limitation period under Swiss law. Nothing of the training record itself survives in it, and it is visible only to administrators. Then it too is deleted automatically.
• A refused request to remove a record: 365 days. Removing a record as wrongly created needs two administrators. If the second one refuses, that refusal is kept for a year — your name, the course, the reason that was given and the reason it was refused — so that the same request coming back repeatedly is visible. Nothing was deleted in that case. Visible only to administrators, then deleted automatically.
• Passkeys: for as long as you keep them. You remove them yourself under My account, and they go with your account if it is deleted. They are a way in, not a record of anything, so there is no period to run.
• That you read this notice: the date and which version, for as long as your account exists. The school has to be able to show that it informed you, and this is that proof. It is nothing more than a date — there is no record of what you clicked or how long you looked.

Backups mean deletion is not instant: a deleted record can still exist in encrypted backup copies for up to about two months before the last of them is overwritten. If you want to know how long a specific record about you will be kept, ask — you are entitled to that answer.

7. Your rights

You can, at any time and free of charge:

• Ask what we hold about you and receive a copy — including the administrative notes and log entries described in section 2.
• Have incorrect data corrected. A wrong date, a wrong rating, a misspelled name.
• Ask for your data to be deleted, where the school is not required to keep it (see section 6).
• Receive your data in a common electronic format, or have it passed to another organisation.
• Object to a particular use of your data.

Contact the school office. You will get an answer within 30 days; if that is not possible, you will be told why and when to expect one.

8. If you are not satisfied

You can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Bern. If you live in the European Union, you may also be able to complain to the supervisory authority of your country of residence.

9. Changes to this notice

This notice is dated at the top. If how the school handles your data changes in a way that matters to you, the notice is updated and the date changes with it — and the next time you sign in, you are asked to read it again. That is why you were asked once already: everything below was in place before, but nobody had ever been told.

What changed on 30 August 2026: when someone ticks a line on your checklist, marks it as not applicable or uploads a document for it, their name and the date are now kept on that line and shown next to it — see sections 2 and 6.

What changed on 29 August 2026: section 2 now says plainly that the reports page adds up each instructor's sessions and hours, what those figures are for, and what is not done with them.

What changed on 27 August 2026: section 4 now says that training management, not only an administrator, can open a medical certificate or an ID copy for checking.

What changed on 10 August 2026: section 6 now also names two things the school keeps that it did not keep before — a refused request to remove a record, and the fact that you read this notice.