Learn how NordFly processes personal data, which services our virtual airline website uses and how you can exercise your privacy rights.
Last updated:
NordFly – Virtual Airline
This privacy policy explains how we process personal data when you visit our website and use the associated services and functions.
Protecting your personal data is important to us. We treat personal data confidentially and in accordance with applicable data protection law, in particular the General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
NordFly is a privately operated, non-commercial flight-simulation project. Personal data is processed solely to provide and administer our services, ensure technical security, and for the purposes described below.
The controller within the meaning of the GDPR is:
Bastjan Alan James Schmidt
NordFly
Weygandtstraße 138
22419 Hamburg
Germany
Email: Email address loading …
Website: https://www.nordfly-vag.com
You may send data-protection enquiries to the email address above at any time.
We generally process personal data only to the extent necessary to provide our website, operate virtual flights, manage user accounts, communicate with our members or maintain technical security.
Personal data may also be processed for statistical purposes where an appropriate legal basis exists.
Personal data is processed in particular on the following legal bases:
Where information is stored on or read from your device, we also observe the requirements of Section 25 TDDDG.
We generally retain personal data only as long as necessary for the relevant processing purpose.
Data is retained longer only where a statutory obligation, valid consent or another data-protection legal basis permits it.
Once the purpose no longer applies and no further legal basis exists, the relevant data is deleted or permanently anonymised.
Our website is hosted on server infrastructure located in Berlin, Germany.
When our website is accessed, technically necessary connection data is processed. This may include in particular:
This information is required to deliver the website technically, ensure stability, analyse errors and detect abusive access.
Legal basis: Article 6(1)(f) GDPR.
Our legitimate interest is the secure, stable and functional operation of our website.
Server log files are generally deleted no later than seven days after collection, unless longer retention is necessary to investigate a security incident or to establish, exercise or defend legal claims.
To protect our website and its underlying technical infrastructure, we use Cloudflare services.
Provider:
Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA
Website: https://www.cloudflare.com
Cloudflare provides security and networking functions that help protect our website against cyberattacks, unauthorised access, abusive requests and distributed denial-of-service (DDoS) attacks.
When you use our website, connection requests may be routed through Cloudflare's network and checked for potential security threats.
The following data may be processed in particular:
Cloudflare may process this information to identify potential attacks, block suspicious requests and ensure the website remains available.
Processing is based on Article 6(1)(f) GDPR.
Our legitimate interest is protecting our website, technical infrastructure and users' data against cyberattacks, unauthorised access and other security threats.
Depending on the enabled security functions, Cloudflare may use technically necessary cookies.
These may include in particular:
__cf_bm – to detect and assess automated access.cf_clearance – to store the result of a successful security check.These cookies serve security purposes and are not used by NordFly to create advertising profiles.
Where the storage of or access to information on a device is strictly necessary to provide the service expressly requested, this takes place under Section 25(2)(2) TDDDG without separate consent.
As Cloudflare is based in the United States and operates a globally distributed network, personal data may be processed outside the European Union or European Economic Area.
Any transfer of personal data to third countries must comply with Articles 44 et seq. GDPR. Depending on the recipient and transfer, an adequacy decision, particularly under the EU–US Data Privacy Framework, or appropriate safeguards such as the European Commission's Standard Contractual Clauses may apply.
Further information about Cloudflare's processing of data is available at:
https://www.cloudflare.com/privacypolicy/
https://www.cloudflare.com/trust-hub/gdpr/
Our website uses technically necessary storage mechanisms and, where consent has been given, cookies in connection with the maps and the LiveMap (see section 5).
Technically necessary storage mechanisms serve basic functions, the storage of privacy preferences and security.
We use your browser's local storage to save your selections in the consent banner.
The entry is named nordfly_cookie_consent_v1.
It contains the selected privacy settings and a timestamp.
This storage allows us to respect your choice on subsequent visits.
Legal basis: Section 25(2)(2) TDDDG and Article 6(1)(f) GDPR.
Our legitimate interest is to reliably respect your privacy preferences and meet legal data-protection requirements.
You may change your settings at any time using the “Cookie settings” link in the footer.
Alternatively, you can delete the relevant data in your browser settings.
If you switch between light and dark mode using the toggle in the header, we store your choice in a cookie.
The cookie is named nf_theme and has the value light or dark.
It contains only the selected display mode, is read solely to display the website and is not shared with third parties.
The cookie is set only when you use the toggle and is deleted automatically after one year.
Legal basis: Section 25(2)(2) TDDDG and Article 6(1)(f) GDPR.
Our legitimate interest is to keep the display mode you have explicitly chosen on subsequent visits.
You can delete the cookie at any time in your browser settings. The website will then be shown in light mode again.
With your express consent, we operate first-party website statistics on our own server infrastructure to evaluate aggregate website usage.
This is intended to help us understand website usage and continuously improve content, navigation, usability and technical performance.
Local analytics is intended in particular to determine:
Analysis is exclusively for internal statistical and technical purposes.
We do not intend to use the information to create personal advertising profiles or identify individual visitors.
Our consent-based statistics record only aggregate page views by UTC date, page path, language and broad device category (desktop, tablet or mobile). The statistics file does not store IP addresses, individual visitor identifiers, referrers or individual sessions. Statistics are retained for a maximum of 90 days and are removed automatically when the next statistics event is processed. Separate technically necessary server and security logs may still exist.
Our first-party website statistics activate only with your prior consent through the cookie settings. You can withdraw your consent at any time in the footer. Legal basis: Article 6(1)(a) GDPR. Storing your privacy choice in the browser is technically necessary.
Independently of this, technically necessary server logs may be evaluated on the basis of legitimate interests where the applicable legal requirements are met.
Legal basis: Article 6(1)(f) GDPR, insofar as processing is limited to data-minimising evaluation of technically necessary server data and the conditions of a legitimate-interests assessment are met.
If additional cookies, comparable storage technologies or tracking functions requiring consent are used, these will be activated only after the relevant consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR has been obtained.
On our homepage we embed the LiveMap from our OperationCenter, and on the “Route network” page an interactive route map. Both maps load map tiles from an external provider. We use a two-click solution for this: the maps are only loaded once you agree to the “Maps & LiveMap” category in the cookie banner or activate the respective map yourself using the “Load map” button. Before that, no connection is established to this provider.
The LiveMap is provided by our OperationCenter (operationcenter.nordfly-vag.com), which runs on our own server infrastructure (see section 1). When the LiveMap is loaded, the OperationCenter sets the session cookies phpvms_session and XSRF-TOKEN. They serve the secure operation of the application and are deleted automatically after twelve hours.
To display the map, the LiveMap loads map tiles from CARTO (CartoDB Inc., USA; map data © OpenStreetMap contributors). In doing so, your IP address and technical connection data (in particular browser type, date and time and the requested file) are transmitted to CARTO. Fonts and code libraries are provided by the OperationCenter itself.
The route map uses the Leaflet map library, which we provide ourselves on our server, and map tiles from CARTO (CartoDB Inc., USA) based on OpenStreetMap data. When the map is loaded, your IP address and technical connection data are transmitted to CARTO.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future using the “Cookie settings” link in the footer. If you load a map only once using “Load map” without selecting “Always load maps from now on”, this applies to that page view only.
CARTO is based in the USA and may use servers there. Where the provider is certified under the EU–US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision. Otherwise, it is based on Standard Contractual Clauses where available and additionally on your explicit consent pursuant to Art. 49(1)(a) GDPR. Third countries may offer a lower level of data protection; in particular, authorities there may be able to access data.
Independently of the maps, our website retrieves current figures and content, such as the number of flights in the air, schedule and route data and pilot voices, directly from the OperationCenter on our own server infrastructure. This involves processing the technically required connection data, in particular the IP address. No cookies are set in the process. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in presenting our flight operations up to date.
Fonts, images, stylesheets and JavaScript files used on our website are generally served directly from our own website infrastructure.
We do not use externally embedded Google Fonts.
Where media or other content from external providers is embedded, we provide separate information about the associated processing of personal data.
If you contact us by email, we process the personal data you send to handle and respond to your enquiry.
This may include in particular:
Processing is based on Article 6(1)(b) GDPR where your enquiry concerns entering into or performing a user relationship.
In other cases, processing is based on Article 6(1)(f) GDPR.
Our legitimate interest is handling incoming enquiries appropriately.
Data is deleted once your enquiry has been fully handled and no statutory retention obligations or other legal reasons justify further storage.
Our website contains links to external services and platforms.
These include in particular:
Simply displaying an ordinary external link generally does not establish a direct connection with its provider.
You leave our website and access the relevant third-party service only when you follow such a link.
The relevant provider is responsible for the processing of personal data there in accordance with its own data-protection responsibilities.
Please consult the privacy notices of the relevant platforms.
A personal user account is required to participate in NordFly's virtual flight operations.
During registration and subsequent membership, we process in particular the following personal data:
The IP address and date and time of registration may also be stored when registering.
Data is processed in particular to:
Where processing is necessary to provide the user account and perform the user relationship, it is based on Article 6(1)(b) GDPR.
Where data is processed to prevent abuse or protect our technical systems, it is based on Article 6(1)(f) GDPR.
For additional voluntary processing, separate consent is obtained where required under Article 6(1)(a) GDPR.
Personal member data is stored on our server infrastructure in Germany unless different processing is expressly described for individual services.
Access to personal data is restricted according to the permissions granted.
Database access is protected and limited to authorised persons.
People who have access to personal data are required to maintain confidentiality or are instructed accordingly.
Personal membership data is not sold.
Personal data is transferred to external service providers only where a valid legal basis exists and the transfer is necessary to provide the relevant services.
In connection with virtual flight operations, the following data in particular may be processed:
This data is used to conduct and document virtual flight operations and provide related functions.
Where information is publicly displayed, its scope depends on the function concerned and the applicable privacy settings.
We may send necessary operational information and notifications as part of membership.
These include information about user accounts, membership rules, security-related matters, organisational changes and virtual flight operations.
Where necessary for the user relationship, processing is based on Article 6(1)(b) GDPR.
Separate consent is obtained for additional advertising or marketing messages requiring consent.
Members may request the deletion of their active user account through the NordFly Group Installer™.
After successful confirmation, the active account is removed.
As part of this process, content provided through the Installer and installed on the relevant device may also be uninstalled.
Deletion of an active account does not necessarily mean that all previously stored personal data is immediately and completely erased.
Certain information may continue to be stored in a separate access-restricted archive under the conditions set out below.
Depending on the processing purpose, the following data may initially remain in a separate archive:
Continued storage is not automatic but depends on the specific data category, purpose and legal basis.
The following personal data may continue to be stored after deletion of an active account if express consent has been given under Article 6(1)(a) GDPR:
Consent must be voluntary, informed and explicit.
Consent may be withdrawn at any time with effect for the future.
For this purpose, an email to the following address is sufficient:
Email address loading …
After an effective withdrawal, data stored solely on the basis of this consent will be deleted unless another legal basis justifies its further retention.
Regardless of consent-based archiving, certain personal data may continue to be stored where necessary to pursue legitimate interests and these interests are not overridden by the interests or fundamental rights of the data subject.
This may in particular concern information required to:
Legal basis: Article 6(1)(f) GDPR.
Our legitimate interest is protecting our platform, members and the orderly operation of NordFly.
The necessity and proportionality of retention are reviewed with regard to the data category concerned.
We do not retain all archived data solely because of former membership where there is no sufficient legal basis for doing so.
If a user has received a registration or airline ban due to a serious breach of the rules, data necessary to enforce that ban may continue to be stored.
This serves in particular to prevent users from circumventing an existing ban by registering again.
Storage is based on Article 6(1)(f) GDPR where justified by the necessary balancing of interests.
For time-limited bans, the necessity of continued storage is reviewed no later than when the ban expires.
For bans without a fixed end date, continued necessity and proportionality are reviewed regularly.
Under Article 21(1) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR.
After receiving an objection, we assess whether compelling legitimate grounds justify continued processing or whether the data is required to establish, exercise or defend legal claims.
If these conditions are not met, processing will stop and the personal data concerned will be deleted.
Archived personal data is stored only as long as necessary for the relevant processing purpose.
Once the purpose no longer exists and no further legal basis applies, the data is deleted or permanently anonymised.
Fully anonymised statistical information may be retained indefinitely provided that individual people cannot be identified.
Personal data is disclosed to third parties only where there is a legal basis for doing so.
This may apply in particular where:
Member data is not sold commercially.
Where external service providers process personal data on our behalf, they are engaged on the basis of data processing agreements pursuant to Article 28 GDPR to the extent required by law.
We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, manipulation and other misuse.
These include in particular:
These measures are reviewed and adapted according to technical requirements and existing risks.
Subject to the applicable statutory conditions, you have in particular the following rights:
Right of access under Article 15 GDPR
You may ask whether we process your personal data and, if so, what data we process.
Right to rectification under Article 16 GDPR
You may request correction of inaccurate data or completion of incomplete personal data.
Right to erasure under Article 17 GDPR
Under the statutory conditions, you may request erasure of your personal data.
Right to restriction of processing under Article 18 GDPR
You may request that processing of your personal data be restricted under certain conditions.
Right to data portability under Article 20 GDPR
Under the statutory conditions, you may request certain personal data in a structured, commonly used and machine-readable format.
Right to object under Article 21 GDPR
You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR.
Right to withdraw consent under Article 7(3) GDPR
Consent may be withdrawn at any time with effect for the future.
This does not affect the lawfulness of processing carried out before withdrawal.
To exercise your rights, you may contact us at any time:
Email address loading …
Under Article 77 GDPR, you have the right to lodge a complaint with a competent data protection supervisory authority.
In particular, the following authority is competent:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany
Website: https://datenschutz-hamburg.de
Providing certain personal data may be necessary to create a user account and participate in NordFly's virtual flight operations.
Without the required information, registration or certain functions may not be available.
Our publicly accessible website can generally be used without registration.
Where consent is required for optional analytics functions, granting consent is not a condition for visiting our website in general.
Solely automated decision-making within the meaning of Article 22 GDPR that produces legal effects or similarly significant adverse effects is not planned in connection with the processing described here.
Automated technical checks, such as those used to detect security threats or verify membership requirements, are distinct from this and are conducted in accordance with the applicable data-protection requirements.
We reserve the right to update this privacy policy if our website, technical services, processing operations or legal requirements change.
The latest version is available on our website.
If individual provisions or wording of this privacy policy are or become wholly or partly invalid, incomplete or incompatible with applicable law, the remaining independent parts of this privacy policy are unaffected.
The relevant statutory provisions apply in place of any incorrect or invalid statements.
NordFly reserves the right to review and correct such statements and to amend this privacy policy where necessary.
The statutory rights of data subjects and the controller's obligations under data protection law remain fully unaffected.
Last updated: