Effective date: 10 August 2026
1. Introduction
This Privacy Policy explains how Sector North GmbH i.G., a company under formation under Austrian law, Linzerberg 5, 4209 Engerwitzdorf, Austria ("Sector North", "we", "us", "our"), collects and uses personal data in connection with our marketing website (sector-north.com) and our flying club management platform (app.sector-north.com, together the "Service").
We process personal data in line with the EU General Data Protection Regulation ("GDPR") and applicable Austrian data protection law.
2. Who We Are
Sector North GmbH i.G. is the entity responsible for this website and the Service. You can reach us regarding any privacy matter at hello@sector-north.com or by post at the address above. We have not appointed a formal Data Protection Officer, as this is not currently required of us under Article 37 GDPR; privacy inquiries are handled directly by our team at the contact above.
3. Scope and the Two Roles We Play
Depending on the context, we act in one of two capacities:
- As a controller, for personal data of visitors to our marketing website, of people who contact us, and of the individuals who represent a club or organisation in its business relationship with us (for example, the person who signs up for an account or manages billing).
- As a processor, for personal data that a club or organisation (our "Customer") submits to the Service about its own members, instructors or staff (for example, member profiles, flight logbook entries, bookings, invoices and internal messages). In that case, the Customer is the controller of that data and determines the purposes for which it is processed; we process it only on the Customer's documented instructions, under a data processing agreement, as described in Section 5.
If you are a member of a flying club that uses Sector North and you have questions about your personal data, please contact your club first, since your club controls that data. We will assist your club in responding to your request as required by our data processing agreement with them.
4. Information We Collect as a Controller
Website visitors
Our marketing website does not use advertising cookies, and we do not track you across other websites. We use Umami, a privacy-focused analytics tool that we run ourselves on infrastructure we control in the European Union, to understand how many people visit sector-north.com and which pages they find useful. Umami does not use cookies and does not collect information that identifies you individually; it records aggregate statistics such as page views, referrers, approximate (country-level) location and device or browser type, based on our legitimate interest in understanding and improving our website (Article 6(1)(f) GDPR). Visiting sector-north.com also causes standard technical information (such as your IP address, browser type and pages requested) to be processed in our hosting provider's access logs, for security and to keep the website running, on the same legal basis. Our footer embeds a status widget from Better Stack (Better Uptime), which may load content from betteruptime.com and process standard technical data in the same way as any embedded third-party content.
Prospective and current customers
When you contact us, sign up for an account, or manage a subscription, we collect the information you provide, such as your name, email address, phone number, the name of your organisation, and billing details. We use this to respond to you, set up and administer your organisation's account, and process payments (Article 6(1)(b) GDPR, and Article 6(1)(c) GDPR for invoicing and tax records we are legally required to keep).
5. Information Processed on Behalf of Customers (As a Processor)
When a club uses the Service, it may submit the following categories of personal data about its members, instructors or staff, which we process solely on the club's instructions:
- member profile and contact details (such as name, email address, phone number and postal address, including any fields the club chooses to mark as visible only to certain roles);
- flight logbook entries (such as pilot-in-command records, flight and block times, launches and landings, and free-text remarks);
- bookings and resource availability records;
- maintenance and defect reports relating to aircraft, which may include a reporter's identity and free-text descriptions;
- billing and invoicing records relating to a member's account with their club;
- messages, announcements, comments and reactions posted within a club's internal community area; and
- documents and files uploaded and associated with a club or its aircraft.
We do not decide why this data is collected or how long it is used for beyond what is needed to provide the Service; those decisions belong to the Customer as controller. We only use it to operate, secure and support the Service, and as otherwise instructed by the Customer or required by law.
6. Cookies and Similar Technologies
Our marketing website does not set advertising or marketing cookies, and our analytics tool (Section 4) does not use cookies either. When you sign in to the Platform at app.sector-north.com, we use strictly necessary cookies or local storage to keep you signed in and to keep your session secure; these are essential to providing the Service and do not require consent under applicable law. If we add cookie-based analytics or marketing technology in the future, we will update this Policy and request your consent where required.
7. How We Use Information
We use personal data described above to:
- provide, maintain and improve the Service (Article 6(1)(b) and, where we act as processor, the Customer's instructions);
- authenticate users and keep accounts and data secure, including through our identity provider and bot-protection service (Article 6(1)(f), our legitimate interest in keeping the Service secure);
- process payments and comply with accounting and tax obligations (Article 6(1)(b) and (c));
- communicate with you about the Service, including service notices and support (Article 6(1)(b) and (f)); and
- comply with applicable law or respond to lawful requests from public authorities (Article 6(1)(c)).
8. Automated Processing of Uploaded Images
When an image is uploaded to the Service (for example, a profile picture or an attachment to a maintenance report), we use an automated content-moderation check to detect and block content that is inappropriate for the platform. This check assesses the content of the image itself; it does not otherwise evaluate people, and it is not used to make decisions with legal or similarly significant effects about any individual.
9. Who We Share Information With
We share personal data with service providers who process it on our behalf (our "subprocessors"), currently:
- Amazon Web Services (Cognito, S3, SES and Rekognition) — for authentication, file storage, transactional email and automated image-content moderation;
- Cloudflare (Turnstile) — for bot and abuse protection on sign-up. Turnstile's processing of personal data is described in Cloudflare's Turnstile Privacy Policy Addendum; and
- Stripe — for processing subscription payments.
We require our subprocessors to protect personal data under terms consistent with this Policy and applicable law. We do not sell personal data, and we only disclose it beyond the above where required by law, to protect our rights or the security of the Service, or with your consent.
10. International Data Transfers
Our infrastructure runs in the European Union. Where a subprocessor is headquartered outside the European Economic Area or may transfer data outside it (for example, Cloudflare or Stripe), we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the subprocessor's participation in a recognised transfer framework, to ensure your data remains protected to a standard equivalent to the GDPR.
11. How Long We Keep Information
We keep personal data for as long as needed for the purposes described in this Policy. In particular:
- account and member data is kept for as long as the relevant account is active;
- messages and announcements within a club's community area are retained for a period tied to the club's subscription plan, as described on our pricing page, after which older messages are deleted automatically;
- invoicing and accounting records are kept for the period required by applicable tax and commercial law (currently up to seven years under Austrian law); and
- when a member's account is deleted, whether by their club or upon request, we delete their name, contact details and uploaded files from our production systems and deactivate their login, subject to any information we must keep for the legal and accounting reasons described above.
12. Children and Junior Members
Sector North is a business-to-business platform intended for use by flying clubs and their members, which may include junior or minor members in the ordinary course of club activity. Our website is not directed at children. Where a club submits personal data about a junior member to the Service, the club is responsible, as controller, for having the appropriate legal basis for doing so, including any parental or guardian consent required under applicable law; we process that data only as the club's processor, as described in Section 5.
13. Security
We use technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest on our cloud infrastructure, role-based access controls, and limiting staff access to personal data to what is necessary to provide support and keep the Service running. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
14. Your Rights
Subject to applicable law, you have the right to request access to, rectification or erasure of, or a restriction on the processing of your personal data; to receive a portable copy of certain data you provided to us; and to object to processing based on our legitimate interests. Where we act as a processor for your club, please direct your request to your club in the first instance; we will support them in responding to it.
You can exercise these rights by contacting us at hello@sector-north.com. You also have the right to lodge a complaint with a supervisory authority. In Austria, this is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria (dsb.gv.at).
15. Changes to This Policy
We may update this Policy from time to time to reflect changes to the Service or applicable law. We will notify you of material changes by email or within the Platform at least 30 days before they take effect, other than changes required sooner by law.
16. Contact Us
Questions about this Policy can be sent to hello@sector-north.com or by post to Sector North GmbH i.G., Linzerberg 5, 4209 Engerwitzdorf, Austria.