Data processing agreement

Last changed 03.11.2026. A draft: the reviewed text will be part of your agreement.

1. Parties and roles

The company that uses AeroViktros is the controller; [owner/lawyer: the legal name of the company that runs AeroViktros] ("AeroViktros") is the processor. This agreement is part of the terms of service.

2. What is processed

• Subject and purpose: providing AeroViktros - recording, signing, printing and keeping the company's maintenance and airworthiness records, and its customer portal.
• Duration: while the agreement runs, then the read-only period of 24 months, then until the company asks for deletion (section 4). [lawyer: what happens to the records when the company does not respond by the end of the read-only period - e.g. a final export kept for hand-over for N years, then deletion (GDPR art. 28(3)(g))]
• Data subjects: the company's staff, its customers' portal users, people named in its records.
• Categories: identification and contact data, role, the certifying staff register and NDT qualifications, signed work records, times, photos and files, training records, occurrence reports (a confidential reporter's name read by Quality only), audits, findings and CAPA, sign-in sessions (device shortened, IP prefix) and audit records.
• Data concerning health: only the date, validity and examiner of NDT vision exams (EN 4179); never results or diagnoses. [lawyer: Art. 9(2)(b), employment obligations]

3. Our obligations

• We act only on the company's documented instructions - the service as configured by the company is the instruction.
• Everyone with access to the data is bound to confidentiality.
• We keep the measures in Annex 2 (art. 32).
• We use the sub-processors on Sub-processors (Annex 1); we tell the company before adding or replacing one, so it can object [lawyer: how long before].
• We help the company answer data-subject requests: the company deactivates a person and removes their contact details in the app; the name on signed records stays (Part-145.A.55, GDPR art. 17(3)(b)).
• We help with security, breach notification and data protection impact assessments.
• A personal data breach: we tell the company without undue delay after we become aware of it, with what we know; the company notifies its supervisory authority within 72 hours where required.
• Audits: [lawyer: audit rights and their cost].

4. The end of processing

The company exports all its records as a ZIP at any time. At its request, after it has downloaded a full export newer than its last record, its company and files are deleted; the platform's audit of the deletion and the billing records (10 years) are kept. Deleted data leaves the backups within [owner/lawyer: backup retention days (BACKUP_RETENTION_DAYS)]. [lawyer: what happens when the company does not respond by the end of the read-only period (GDPR art. 28(3)(g))]

Assistant conversations and AI usage are kept [owner/lawyer: period].

Annex 1 - Sub-processors

The list on Sub-processors, last changed 03.11.2026.

Annex 2 - Technical and organisational measures

What AeroViktros does today, as built:

• Separation: each company's data lives in its own database schema; the company in the address must match the signed-in company, otherwise the request is refused.
• Roles and access: every route has one rule in an access policy, refused by default; a company can read it as "Who may do what". Signatures are checked against the certifying staff register and the NDT register, never against the role alone.
• Passwords and sessions: passwords are stored only as Argon2id hashes; repeated wrong passwords lock the account for a time; sign-in, password reset and the API are rate-limited; a password or role change, a deactivation or "Sign out everywhere" ends every session at once; a sign-in lasts at most 12 hours; a password reset link is stored only as its SHA-256, works once and expires after 30 minutes.
• Web protection: cookies are HttpOnly and SameSite=Strict (Secure in production); every change must come from the same site; the log-in and administration forms carry a CSRF token; a Content-Security-Policy allows only the site's own scripts, named versions of Bootstrap, Chart.js and Fabric from one CDN, and inline scripts carrying the page's nonce - no inline event handlers; HSTS in production.
• Records that are not changed: the CRS, its prints, the certifying staff history, record changes, CAMO changes and their decisions and other records are insert-only - the database itself refuses to change or delete them; each CRS carries the SHA-256 of its content and a Verify page compares it; every change in the app is written to an audit trail.
• AI: every AI call goes through one gateway with limits per feature (tokens, time, size of the input); the logs keep the feature, tokens, time and outcome - never a prompt or an answer.
• Offline copies: offline copies are limited to 5 aircraft and 7 days per device, never hold a password or token, and are removed at logout on request; damage recorded offline is kept on the device with its photos (resized, with no location data), until it is sent (the mark's text, without its photos, a day after that).
• Logs: no passwords or tokens; e-mail addresses masked; kept 30 days.
• Backups: [owner: provider, how often, where, how long they are kept, when a restore was last tested]
• Export: the company's records as a ZIP with a manifest of every file and its SHA-256; downloading it needs the administrator's password again and is logged.