Your data, and what we do with it

Two organisations share responsibility for the data involved in an assessment, in what the GDPR calls a joint / layered controller arrangement:

• The operator (airline or employer) who invited you is the controller for the recruitment decision. They decide to assess you and use the result to inform hiring. Requests about that decision are usually best directed to them.
• Phase of Flight is the controller for the design of the assessment, its scoring and the comparison (“norm”) pool, and it operates the platform on the operator's behalf. We process candidate results under a written data-processing agreement with each operator.

You can contact Phase of Flight about anything in this notice at privacy@phaseofflight.nl. Registered office: Bagijnenweid 13, 1695 EA Blokker, the Netherlands (KvK 90169158).

Depending on how far you get in the process, we may hold:

• Identity & contact details — your name and email address, and the operator that invited you.
• Application profile — the background and experience you enter before the assessment (e.g. licences, hours, availability).
• Assessment responses & results — your answers, timing and game telemetry across the five modules, and the scores derived from them, including the behavioural / personality profile.
• Account & technical data — authentication records and the consent choices you made when setting up your account.

We do not ask for special-category data (such as health, ethnicity, religion or trade-union membership) or criminal-record data, and you should not enter any into free-text fields.

We process your data for these purposes and legal bases:

• To run the assessment and give the operator a selection result — the legal basis is the legitimate interests (Article 6(1)(f) GDPR) of the operator in selecting safe, competent flight crew, and of ours in providing that screening service. We have balanced this against your interests; the assessment is job-relevant, proportionate, and you are told about it in advance.
• To keep records for the duration of the recruitment process — legitimate interests and, where applicable, taking steps at your request prior to a possible employment contract (Article 6(1)(b)).
• To improve and validate the assessment using anonymised data — this relies on your separate, optional consent (Article 6(1)(a)), which you gave (or declined) when setting up your account. Once data is irreversibly anonymised it can no longer be traced back to you and falls outside the GDPR. Withdrawing this consent is easy and does not affect anything else.

The assessment produces scores and a Pilot Suitability Index — this is profiling under the GDPR. It is deliberately designed as decision support, not an automatic verdict: the report is reviewed by a person at the operator, who makes the hiring decision. You are not subject to a decision based solely on automated processing.

You have the right to an explanation of the outcome, to express your point of view, and to contest a decision. To do so, use the request form or contact the operator that invited you.

Your data is only ever seen by:

• The operator that invited you — their authorised reviewers see your profile and results, scoped so they cannot see candidates from other organisations.
• Our infrastructure providers, acting strictly as processors under contract — principally our hosting and database provider (Supabase) and email delivery. They process data only on our instructions.

We never sell your data or use it for advertising.

We keep your identifiable assessment data for up to 12 months after your assessment is completed, after which it is deleted or irreversibly anonymised. An operator may instruct us to delete your data sooner.

If you consented to it, fully anonymised, aggregated results may be kept beyond that period to validate and improve the assessment. Because anonymised data cannot be linked back to you, it is no longer personal data.

We host data on infrastructure located in the European Union wherever possible. If any processing involves a transfer outside the European Economic Area, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses, with additional safeguards where needed.

Assessment answer keys and scoring run on our servers, never in your browser, so results cannot be tampered with. Access to candidate data is restricted by row-level security so each operator only sees its own candidates, and access is authenticated. We keep results immutable once recorded.

If a personal-data breach ever occurs, we will notify the Autoriteit Persoonsgegevens (AP) within 72 hours where required, and affected individuals without undue delay where the risk is high.

We use only strictly necessary cookies — the session cookie that keeps you signed in and protects the platform. These are exempt from consent under the ePrivacy rules (in the Netherlands, the Telecommunicatiewet), so no cookie wall blocks your access.

We do not use tracking, analytics or advertising cookies. If that ever changes, we will ask for your consent first through the cookie banner, and you can reopen your cookie preferences at any time from the footer.

Under the GDPR you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — have your data deleted where there is no overriding reason to keep it.
• Restriction & objection — object to, or restrict, processing based on legitimate interests.
• Portability — receive data you provided in a machine-readable form.
• Withdraw consent — for the anonymised-data use, at any time, without affecting anything else.

To exercise any of these, use the information & data request form on our homepage, or email privacy@phaseofflight.nl. We respond within one month. We may ask you to confirm your identity first so we don't release your data to someone else.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), in The Hague, the Netherlands.