Privacy

Privacy Policy

Last updated: 17 October 2026

In short

We do not sell or hand your data to anyone. Aviation companies may reach the community through Pilot Network, but we are the ones who show their message here: they receive no email address and no name unless you, in a specific case, press "I want more information" and authorise it.
If you wish, you can fill in a professional profile (situation, licence, approximate hours, aircraft, country, interests). It is optional field by field, deleted whenever you want, and it serves to show you what fits you and to understand the community in aggregate figures ("how many A320 pilots there are"), never person by person.
You can use almost the whole site without registering. An account is needed to publish and read feedback in full, request its documents, use the CV builder without a watermark and enter the study material Drive. If you publish as "Anonymous", only the administration knows which account published it.
Nobody knows your password, not even us: it is stored as a cryptographic hash that cannot be reversed.
Your data is stored on servers in the European Union (Ireland).
You can delete your entire account from your profile, without writing to us or giving reasons, and your data goes with it.
Third-party analytics (Google, Clarity) only run if you accept them in the cookie notice. If you decline, they are never loaded.

1. Who processes your data

The data controller — who decides what happens with your data and to whom you can complain — is:

Controller: César Martínez Sernández
Address: Calle Valcotos 25, Meco, 28880 Madrid, Spain
Email: pilotnetworkspain@gmail.com
Phone: +34 634 487 486
Website: pilotnetwork.es

Pilot Network is not required to appoint a Data Protection Officer (Art. 37 GDPR and Art. 34 of Spanish Organic Law 3/2018), and has not appointed one. For anything to do with your data, write to the address above: the controller answers you directly.

2. What data, what for, and for how long

Everything this site does with personal data is listed separately, with its own legal justification and its own retention period. There is no all-or-nothing.

2.1 · Contact form

What data: Name, email address, the website language and the content of your message, with the date. And, if we reply, our reply. We do not store your IP address or browser.
Purpose: To read your enquiry and reply to you. The message reaches our inbox and is also stored in the private administration area of the website, which only the controller can see, to reply from there. To stop anyone flooding the form, it is limited to a few messages per email address and hour.
Legal basis: Your consent when submitting the form (Art. 6(1)(a) GDPR). If you write to propose a collaboration, also pre-contractual measures (Art. 6(1)(b) GDPR).
Retention: One year after the last activity (your message or our last reply). After that, the website deletes it automatically every night, with its replies. The copy that reaches our inbox is deleted on the same schedule. You can ask for it to be deleted sooner at any time.

2.2 · Your user account

What data: Email address, the display name you choose, your @handle (if you choose one) and the record of the ones you have had, the sign-up date and the date of last access, and the date and version of the terms you accepted. If you ever sign in with Google (not enabled today), also the profile picture Google sends us. If you sign in with email and password, a cryptographic hash of your password — never the password itself.
Purpose: To identify you, let you into the parts that require an account, and restore your access if you forget your password.
Legal basis: Performance of the terms of use you accept when registering (Art. 6(1)(b) GDPR).
Retention: For as long as the account exists. When you delete it, your data is erased immediately and it cannot be undone. It can only remain in backups, which roll over within 30 days at most; after that nothing remains. When you delete it you receive one last email confirming it; your address is used only for that message. One exception: the record of your @handles is kept for 6 months after you leave each one (also if you delete your account), so nobody can take it and impersonate you; this is our legitimate interest in preventing impersonation (Art. 6(1)(f) GDPR). After that only the handle remains, with nothing linking it to you.

If you have not signed in for over three years, we email you and, if you do not sign in within the following 30 days, the account is closed, its data is deleted and you receive one last email confirming it. To keep it, signing in once is enough. There is no point keeping data on someone who no longer uses the service.

2.10 · Your professional profile and the Pilot Network audience

What data: Only if you fill it in, and field by field, like a flying CV: your situation (student, First Officer, Captain, instructor), your licences by authority and level (EASA ATPL, FAA CPL…), ratings, courses and instructor or examiner qualifications (IR, ME, MCC, JOC, FI, TRI, TRE…), the languages you speak and their ICAO language proficiency level, ranges of flight hours (total, as PIC, on jets; not the exact figure), the type of operation you fly in now (not the company name), your availability for a new position, the country where you live (not the city), the aircraft types you fly, are rated on or are interested in, and what you are professionally interested in right now. Also, if you add them: a photo or logo (stored privately, cropped and resized, without camera data, and only you can see it), a few lines introducing yourself, the link to your LinkedIn profile, and the job-board jobs you save and which ones you have applied to (with the date you tick). We neither ask for nor store your date of birth, licence number, employer, exact hours, nationality or any health or medical-class data in the profile (if you save a CV that includes it, section 2.4 applies).
Purpose: Three things, each with its own switch:
(a) Understanding the community in aggregate figures. How many pilots there are per aircraft, hours range, country or interest. These figures are computed over the whole and none is ever shown below 20 people, so no combination can point at anyone. They are what Pilot Network uses to explain to airlines, schools and simulator centres what its audience looks like.
(b) Personalisation within the site, if you switch it on: sorting what you see by your profile (jobs for your aircraft first, courses that fit you, sponsored messages aimed at your profile). Everything happens inside the site; nothing leaves it.
(c) Emails, only if you tick the box for each type. Today there are job alerts: you choose one or more positions (cadet, type-rated or non type-rated First Officer, Senior First Officer, Second Officer, Captain, instructor, examiner, business aviation, recruitment events), optionally the aircraft, the licences the job must accept and whether you only want jobs whose hours you meet, and, when new matching jobs are published, you get one email with all of them (at most one every ten minutes). They are never pre-ticked and you can opt out with one click in any email or from your account.
Legal basis: Your consent (Art. 6(1)(a) GDPR), separate for each purpose: filling in a profile field is consenting to (a); the "Use my profile to sort what I see" box is (b); each email box is (c). We store the date and the version of this text with every consent and every withdrawal, so we can prove it (Art. 7(1)). Commercial emails also comply with Art. 21 of the Spanish LSSI: prior consent only, with an unsubscribe link in every message.
Retention: For as long as the account exists or until you delete it, field by field or all at once, from your account. Deleting it withdraws consent; of the withdrawal only the record that you made it remains, without the data. The "Fill in step by step" guide only takes you from one question to the next: it saves nothing on its own; data is saved when you press "Save profile".

COMPANIES DO NOT RECEIVE YOUR DATA. When an airline, a school or a centre books a campaign with Pilot Network, it defines who it wants to reach with criteria ("B737 pilots with more than 1,500 hours"), and it is this site that decides, when rendering your screen and only if you have personalisation on, whether to show it to you. The company receives aggregate reach figures (how many times it was seen, how many clicks), never who. Only if YOU press "I want more information" on a campaign are you shown, before anything is sent, exactly which data would be sent, to which company and what for, and you must confirm it; then that and only that is sent, we keep a copy of what was sent as proof, and we confirm it to you by email. That transfer is a disclosure with your specific consent (Art. 6(1)(a)), and the receiving company is bound by contract with Pilot Network to use it only to contact you about that and to honour your rights.

2.11 · If you ask us for feedbacks (by email or with the form)

What data: The full name, phone number and email address you give us when asking, by email or with each airline's form; the airline and the feedbacks you ask for; if you use the form, the date and time, the IP address and the browser you send it with and the version of the terms you accept in it; and, when you accept the terms of use of the document, the date and time, the IP address, the browser and the version of the text you accepted. If the delivery includes attached documents sent by link, how many times you download them.
Purpose: Sending you the document you ask for (and its attachments, if included), marked with your details on every page so that it is known which copy it comes from if it turns up where it should not, and being able to prove that you accepted the personal-use terms.
Legal basis: The relationship you yourself request when asking for the document (Art. 6(1)(b) GDPR) and Pilot Network's legitimate interest in protecting its feedback database against unauthorised sharing (Art. 6(1)(f) GDPR).
Retention: Form requests that are not approved are deleted automatically after 30 days. If you do not accept the terms, the link expires after 14 days and the data are deleted automatically 30 days later. If you accept them, they are kept for as long as claims for misuse of the document can be brought (as a reference, five years: Art. 1964.2 of the Spanish Civil Code).

Your data are not shared with anyone: they are printed on YOUR copy of the document and stored only in the Pilot Network database. The email is sent with Resend, the same processor that already sends the site's other emails.

2.3 · Experiences and feedback you share

What data: What you write in the form (airline, position, dates, hours, aircraft, your previous experience and your account of the process), the name or nickname you choose — or "Anonymous" —, any documents you attach and which account published it, with the date and the version of the terms you accepted. Since 17 October 2026, on this website an account is needed to publish and the email is no longer asked separately (it is the account's). When you submit, Cloudflare checks you are not a robot (see 2.7).
Purpose: To publish it so other pilots can consult it, which is the whole point of the section. Knowing which account published it means someone is responsible for each piece of content, lets us contact you if there is a problem with what you posted (for example, a copyright claim) and shows you your feedback in your profile. That information is never published or shown to anyone, airlines included: only the administration sees it.
Legal basis: Your consent (Art. 6(1)(a) GDPR) to publish the name or nickname you choose, given when you submit the form knowing it will be published; and the terms of use you accept when publishing (Art. 6(1)(b) GDPR) to keep which account published it.
Retention: The feedback stays published under the licence in the Legal Notice (section 5). Your personal data does not: at any time and without giving a reason you can ask for your name to be removed (it becomes “Anonymous”) and for the link to your account to be deleted. If you delete your account, that link is deleted automatically and the feedback remains anonymous.

Who sees it. Without an account, anyone can read the most recent feedback for each airline; the rest, and the documents, only account holders. Documents are always downloaded with a watermark (see 2.5). It is published instantly, without prior review: what you write will be read by people. Do not include third parties' details (names of instructors, colleagues or examiners) or anything you would not want published, and do not attach medical or psychological reports or aptitude test results: they are specially protected data (Art. 9 GDPR). If we see, or are told about, other people's personal data or that kind of information, we take it down.

2.4 · CV builder

What data: What you type into the CV form: contact details, licences, ratings, flight hours, training and experience.
Purpose: To compose the PDF and give it back to you.
Legal basis: Performance of the service you request (Art. 6(1)(b) GDPR).
Retention: On our servers, nothing, unless you save it to your account. To give you the PDF, what you type is sent to the server, the document is composed and returned to you; no copy is kept. The draft you are filling in is saved only in your own browser (local storage), so you do not lose it when you close the tab: we cannot see it, and it is erased when you clear the site's data in your browser or press "Start over". On a shared computer, press "Start over" when you finish: otherwise whoever uses that browser next could see the draft.
My saved CVs. If you have an account and press «Save» under «Save to my account», we keep that CV's data (up to 3 CVs, with the name you give them) so you can open, edit and download it from any device. Only you can see them; nobody else has access, companies included. They are kept until you delete them in «My account» → «My CVs» or delete your account, and they are included in the copy of your data if you ask for it. Legal basis: performance of the service you request by pressing «Save» (Art. 6(1)(b) GDPR). This applies to both builders (the 15-template one and the simple one); for the 15-template one neither the photo nor the signature is saved, only the text and the design.
Fill from my profile and logbook hours. «Fill from my profile» copies into the CV, in your browser, data from your own professional profile (section 2.10); nothing is sent to anyone. «Logbook hours» reads the file you choose in your browser: it is not uploaded to any server nor kept; only its hours are added up into your CV. To work out night hours from the sun's position, your browser downloads the public airport list from this website (the same for everyone): your airports are not sent to anyone. The same applies in your profile («Work it out from my logbook»): only the hour ranges are stored there, if you set them and save your profile, never the file or the exact figures. The letter tailored to an offer uses the public offers of the job board.

A pilot's CV may contain information about your medical certificate. If you choose to include it, bear in mind it may count as health data (Art. 9 GDPR): you include it yourself, voluntarily and solely because you want it on your CV, and it is not used for anything else.
If you save to your account a CV that includes it, before saving we ask for your explicit consent with a separate box (Art. 9(2)(a) GDPR); without ticking it, the CV is not saved. It is kept only to give it back to you inside that CV: it does not go into your profile, it is not used to sort what you see or for statistics, and nobody else sees it. You can withdraw consent at any time without affecting what came before: leave those fields blank and save, or delete the CV.

2.5 · Downloads and access to study material

What data: Your account identifier, which file you downloaded and when. In addition, the documents attached to feedback (PDF, Word and images) that you download are watermarked: they carry your email address, a download code derived from your account, the date and a cover page with the terms of use, visibly and on every page.
Purpose: To check you have an account before giving you the file, to detect automated bulk downloading that would take the service down and, through the watermark, to be able to tell who downloaded a document if it turns up published where it should not. Those documents contain personal data of the person who shared them and may contain third-party information; the watermark protects those people.
Legal basis: Performance of the terms of use (Art. 6(1)(b) GDPR) and legitimate interest in protecting the service from abuse and in protecting the data of those who share their documents against unauthorised disclosure (Art. 6(1)(f) GDPR). You are told about the watermark before downloading, on the cover page of the document itself and here.
Retention: 12 months for the download log. The watermark is part of the file you take away and stays in it; the download code is derived from your account identifier and is not stored separately.

If you ever see a Pilot Network document circulating outside the site, the code in the footer identifies the account that downloaded it. Sharing it without permission breaches the Terms of Use, infringes Pilot Network's rights over its database (Arts. 133 to 137 of the Spanish Intellectual Property Act) and, where there is a profit motive, may be a criminal offence (Art. 270 of the Spanish Criminal Code).

2.6 · Our own usage metrics

What data: What was clicked and when: an application sent to a job posting, a download, an entry to the Drive. No IP address, no cookie and no personal identifier. These are counts, not a record of who did what.
Purpose: To know which postings and materials genuinely matter, so we can decide what to keep and what to expand.
Legal basis: Legitimate interest in understanding how our own site is used (Art. 6(1)(f) GDPR). Because the count cannot identify anyone, your privacy is not affected: that is why no consent is asked for, and why it works the same whether or not you accept cookies.
Retention: Indefinitely, because from the moment it is recorded it is no longer personal data.

2.7 · Form security

What data: Your IP address and technical browser data, processed by Cloudflare at the moment a form is submitted.
Purpose: To tell a person from a robot and stop the form filling up with automated junk.
Legal basis: Legitimate interest in keeping the service standing (Art. 6(1)(f) GDPR, and Recital 49 on network security).
Retention: We do not store it. Cloudflare retains it under its own policy.

2.8 · Third-party web analytics

What data: Pages visited, time spent, device type, approximate country and, for Clarity, an anonymous recording of mouse movement and clicks.
Purpose: To understand how the site is navigated so it can be improved.
Legal basis: Your consent alone (Art. 6(1)(a) GDPR and Art. 22.2 of Spanish Law 34/2002). If you do not accept analytics cookies, these tools are never even loaded.
Retention: According to each tool's own periods, set out in the Cookies Policy.

Clarity records the session. Form fields are masked: what you type into them is not recorded.

2.9 · Email and social media

What data: Your email address, your name and the content of the conversation.
Purpose: To answer enquiries and maintain the relationship with members and collaborators.
Legal basis: Legitimate interest in replying to whoever writes (Art. 6(1)(f) GDPR) and consent where applicable.
Retention: Two years from the last message, or until you request erasure.

3. Where the data comes from

All the data comes from you: typed into a form, entered when registering, or written to us. The only exception would be signing up with Google (not enabled today): in that case Google would send us your email, name and profile picture, and does so because you authorise it on Google's own screen before continuing. We do not buy lists or obtain data from third parties.

You are not obliged to give us anything. If you do not provide a form's data, we simply cannot handle that particular request.

4. Who else sees it

Your data is not sold, not handed over and not shared for commercial purposes. It only leaves here for the companies that provide the technical services that make the site work and, solely if you ask for it by pressing "I want more information" on a specific campaign, for that company and with the data you have seen and confirmed (section 2.10). All of them act as processors: they may only use the data to provide the service to us and on our instructions, under contract (Art. 28 GDPR).

Company	What for	Transfer safeguard
Supabase Pte. Ltd. Singapore	Database, user accounts, file storage and server functions. Data is stored in region eu-west-1 (Ireland, European Union), on Amazon Web Services infrastructure.	Standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR) covering access from Singapore and the United States. Processing agreement
Vercel Inc. United States	Website hosting and content delivery network.	EU-U.S. Data Privacy Framework certification and, as a fallback, standard contractual clauses. Processing agreement
Cloudflare, Inc. United States	Anti-bot form verification (Cloudflare Turnstile). Receives the IP address and technical browser data at the moment a form is submitted.	EU-U.S. Data Privacy Framework certification and standard contractual clauses. Processing agreement
Plus Five Five, Inc. (Resend) United States	Sending contact-form emails and account emails (confirmation, password recovery).	EU-U.S. Data Privacy Framework certification and standard contractual clauses, included in its processing agreement. Processing agreement
Google LLC United States	Email (Gmail), «Sign in with Google» identification and, if analytics cookies are accepted, Google Analytics 4.	EU-U.S. Data Privacy Framework certification.
Microsoft Corporation United States	Microsoft Clarity: heatmaps and session recording, only if analytics cookies are accepted.	EU-U.S. Data Privacy Framework certification and standard contractual clauses.

Your data may also be disclosed to courts, law enforcement or public authorities where there is a legal obligation.

"Sign in with Google" is a separate case

When you sign in with Google, Google does not act as our processor but as an independent controller of your Google Account: what Google does with that information is governed by its own policy, not this one. We are responsible only for what we do with the email, name and picture we receive. You can withdraw this site's permission at any time from your Google Account permissions.

Links to other platforms

The site links to Telegram communities and social media profiles. The moment you click the link you leave here and become subject to their policies:

Telegram: https://telegram.org/privacy
Instagram y Facebook (Meta): https://www.facebook.com/privacy/policy
LinkedIn: https://www.linkedin.com/legal/privacy-policy

The same applies to job postings: the apply button takes you to the company's own website or job portal. Your application is received by that company, not by Pilot Network, and from there its privacy policy governs. We only record that the button was pressed, without knowing who pressed it.

5. Transfers outside Europe

Your account, your files and everything you store are held in the European Union, specifically in data centres in Ireland.

Even so, some processing involves transferring data to the United States or Singapore: website hosting, database technical support, email and — only if you accept them — the analytics tools. Those transfers are covered by the Chapter V GDPR safeguards listed in the table above: the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and standard contractual clauses (Art. 46(2)(c) GDPR).

An honest note: the EU General Court upheld the EU-U.S. Data Privacy Framework on 3 September 2025 (Case T-553/23, Latombe), and that judgment is under appeal before the Court of Justice. In the meantime, the Framework remains in force. That is why, with the providers that allow it, we rely additionally on standard contractual clauses: were the Framework to fall, the transfer would still be covered.

6. Your rights

You are in charge of your data. You can exercise these rights at any time, free of charge, by writing to pilotnetworkspain@gmail.com:

Access: to be told what data we hold about you and be given a copy.
Rectification: to correct anything wrong or incomplete.
Erasure ("right to be forgotten"): to have your data deleted.
Restriction: to have it kept but not used while a dispute is resolved.
Portability: to take your data away in a format you can open and reuse elsewhere.
Objection: to object to processing based on legitimate interest, on grounds relating to your particular situation, and in any case to personalisation and commercial messages (Art. 21(2)), which you can also switch off from your account.
Withdrawal of consent where that is the basis, without affecting what was done before withdrawal. For cookies, via the "Cookie preferences" link in the footer.

Deleting needs no email at all: you can delete your entire account from your profile, without explaining yourself. If you want a copy of your data (access or portability), write to us and we will send it in a format you can open and reuse.

If you do write, we reply within one month of receiving the request, extendable by two more if the request is particularly complex, in which case we would tell you within the first month (Art. 12(3) GDPR). We may ask for something to confirm it is really you; it is not used for anything else.

7. Complaining to the AEPD

If you believe we have not handled your request properly, or that we are processing your data improperly, you can complain to the supervisory authority. In Spain that is the Spanish Data Protection Agency (AEPD):

C/ Jorge Juan, 6, 28001 Madrid, Spain
https://www.aepd.es
Electronic office: https://sedeagpd.gob.es

You do not have to write to us first: you can go straight to the AEPD. That said, if you tell us first we can probably fix it faster.

8. How it is protected

Article 32 GDPR requires measures appropriate to the risk. These are the ones in place, specifically:

Passwords are not stored. A salted cryptographic hash is stored, from which the original password cannot be recovered. Neither the controller nor anyone with database access can read your password.
All traffic is encrypted with TLS, and data is also encrypted at rest on the server.
Each user can only read their own data. The database enforces row-level access rules checked on the server, not in the browser. Even if someone tampered with the site on their own computer, they could not read another person's data.
Your CV files have no public address and only you can read yours. Feedback documents are delivered, within the site, only after your session has been verified on the server, and with a watermark.
Server keys never reach the browser. Everything requiring privileges happens on the server.
Daily database backups, plus an additional copy of our own that checks itself.

No system is infallible. If a breach nonetheless occurred that posed a high risk to your rights, we would tell you without undue delay and notify the AEPD within 72 hours (Arts. 33 and 34 GDPR).

9. Minors

You must be 16 or older to create an account or publish feedback, and you confirm it when you register. Spanish law currently allows consent from 14 (Art. 7 of Organic Law 3/2018), but raising it to 16 is going through Parliament; 16 is also the GDPR default (Art. 8), and what is shared here — professional history, selection processes — belongs to people already in training or at work.

If we detect an account or content from someone under 16, we delete it. If you are a parent or guardian and believe this has happened, write to pilotnetworkspain@gmail.com and we will sort it out right away.

10. Automated decisions

No automated decisions with legal or similarly significant effects are made about you (Art. 22 GDPR): nothing decides on its own about your application, your access or your CV, and there are no user scores.

What does exist, if you switch it on, is personalisation based on the professional profile you fill in yourself (section 2.10): sorting what you see and deciding which sponsored messages are shown to you. This is profiling for personalisation and advertising purposes, with no legal effects, which you can switch off at any time from your account and which you have the right to object to (Art. 21(2) GDPR). Nor is your data used to train artificial intelligence models.

11. Changes to this policy

This policy will be updated when the services or the law change. The date at the top shows when it was last reviewed.

If a change affects you significantly — a new processing activity or a new recipient, say — and you have an account, we will email you before it takes effect. Minor wording changes are published directly here.