1.Who is responsible
[LEGAL ENTITY NAME], of [REGISTERED ADDRESS], is the data controller — the organisation that decides how and why your data is used.
Contact: connect@iatas.in
Grievance Officer (as required under India's Digital Personal Data Protection Act, 2023): [NAME], [EMAIL]. If you are in the EU or UK and we are required to appoint one, our Data Protection Officer is [NAME / OR STATE NOT APPLICABLE].
2.What we collect
If you are an engineer
| Category | What it includes |
|---|---|
| Account | Name, email, password (stored hashed, never in readable form), role |
| Contact | Phone number, city, country, nationality |
| Professional credentials | Licence category (e.g. B1.1, B2), issuing authority (DGCA, EASA, FAA, GCAA, UK CAA, CAAS and others), aircraft type ratings, engine variants, approvals and endorsements, years of experience |
| Career history | Employers, job titles, locations, dates, descriptions |
| Education | Qualifications, institutions, years, fields |
| Preferences | Availability and notice period, willingness to relocate, openness to contract or AOG work, preferred base, maintenance types, skills |
| Commercial | Salary expectation, and whether you have a service bond and its value — never shown on your public portfolio |
| Documents | Profile photograph |
| Activity | Applications, saved roles, messages, and a record of which organisations viewed your profile |
If you are a recruiter
Your name, work email, phone, job title, and your organisation's details — name, type, size, website, description, logo, country and city, registration number, and any verification documents you upload.
Automatically
Basic technical data needed to serve and secure the site: IP address, browser and device type, pages requested, timestamps, and error diagnostics. We do not run advertising trackers or third-party analytics profiling.
Sensitive data
We do not ask for, and you should not upload, data revealing health, religion, caste, ethnicity, political opinions, biometrics, or government identity numbers such as Aadhaar or passport numbers. A licence number issued by a civil aviation authority is professional information, not a government identity document, and only appears where you choose to add it.
3.Why we use it
| Purpose | Lawful basis |
|---|---|
| Create and run your account | Performance of a contract with you |
| Show your profile to organisations searching for engineers | Your consent, given by making your profile discoverable — withdrawable at any time |
| Publish your public portfolio and QR link | Your consent, given by keeping discoverability on |
| Match you to relevant roles and rank search results | Performance of a contract; legitimate interests in a useful service |
| Deliver messages between you and organisations | Performance of a contract |
| Send service email — welcome, account and security notices | Performance of a contract |
| Send optional job alerts or updates | Your consent — unsubscribe any time |
| Keep the platform secure, prevent fraud and false credentials | Legitimate interests; legal obligation |
| Meet legal and regulatory obligations | Legal obligation |
We do not make decisions producing legal or similarly significant effects about you by automated means alone. Search ranking and match scores are aids for a human recruiter, who decides.
We do not sell personal data, and we do not use your data to train machine-learning models for third parties.
4.Who can see what
This is the part worth reading closely, because the platform deliberately treats professional information and contact information differently.
| Data | Anyone with your portfolio link | Signed-in organisations |
|---|---|---|
| Name, photo, headline | Visible | Visible |
| Licence, ratings, approvals, experience, skills, education | Visible | Visible |
| City, country, availability, relocation | Visible | Visible |
| Email address and phone number | Not visible | Visible once you are in contact |
| Salary expectation, bond details | Not visible | Visible |
| Messages | Not visible | Only the organisation you are talking to |
All of the above depends on your profile being discoverable. Turn discoverability off and your portfolio page stops resolving and you no longer appear in search.
What we cannot undo: anything already copied, cached, indexed by a search engine or printed on paper before you turned discoverability off. Treat a QR code you have printed as permanent.
6.Where it is stored
Your data is held on Supabase infrastructure in [REGION — confirm in the Supabase dashboard] and served through Cloudflare's global network, which caches public pages close to visitors.
Where data moves outside your country, we rely on appropriate safeguards — [STANDARD CONTRACTUAL CLAUSES / OTHER MECHANISM]. Contact us for details.
7.People who have not signed up
IATAS maintains a talent pool containing limited professional information about aviation professionals who have not yet registered, compiled from professional sources. If that is you, this section is about your data.
What is held: name, professional headline or designation, licence category and authority, years of experience, location, aircraft and engine types, skills, and where available a contact email or phone. Contact details are never displayed to anyone and are used only to send you a single invitation to claim your profile.
What others see: until you claim the profile, organisations see a masked name and professional details only — no contact information.
Lawful basis: our legitimate interest in building a useful aviation talent directory, balanced against your privacy. You can object at any time, and we will act on it.
Your choices — no account needed: email connect@iatas.in and we will, on request, send you a copy of what we hold, correct it, or delete it entirely. We aim to action removals within 7 days and will confirm when done.
8.How long we keep it
| Data | Retention |
|---|---|
| Active account and profile | While your account is open |
| After you delete your account | Removed from live systems promptly; residual backup copies purged within [e.g. 30 days] |
| Messages | Retained for the other participant, with your name shown as a removed user |
| Talent-pool entries | Until claimed, removal is requested, or [PERIOD] of no engagement |
| Records needed for legal, tax or dispute purposes | As long as the law requires |
9.Your rights
Depending on where you live, you have the right to:
- Access — get a copy of the data we hold about you;
- Correct — fix anything inaccurate. Most of it you can edit directly in your profile;
- Delete — have your data erased, subject to what we must legally retain;
- Withdraw consent — turn off discoverability, or unsubscribe from optional email, at any time;
- Object or restrict — challenge processing based on legitimate interests;
- Portability — receive your data in a machine-readable format;
- Nominate — under India's DPDP Act, nominate someone to exercise your rights if you die or become incapacitated;
- Complain — see section 14.
Email connect@iatas.in. We respond within 30 days and will not charge you. We may need to confirm your identity first.
10.How we protect it
- All traffic is encrypted in transit over HTTPS, with HSTS enforced.
- Passwords are hashed by our authentication provider; nobody at IATAS can read them.
- Database access is governed by row-level security, so each account can reach only the records it is entitled to.
- Verification documents are held in a private bucket and served only through short-lived signed links — never a public URL.
- Response headers restrict framing and content sources to limit injection and clickjacking.
- Administrative access is limited to staff who need it.
No system is perfectly secure. If a breach affects your data and creates a risk to you, we will notify you and the relevant authority as the law requires.
12.Children
IATAS is for professionals aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
13.Changes
We may update this policy. The version and effective date at the top will change, and we will notify you of material changes by email or in the platform before they take effect.
14.Contact and complaints
Questions, requests or concerns: connect@iatas.in
Grievance Officer: [NAME], [EMAIL]
Postal: [REGISTERED ADDRESS]
Please come to us first — we would rather fix it. If you are not satisfied you may complain to:
- India — the Data Protection Board of India, once constituted under the DPDP Act, 2023.
- EU / EEA — your national supervisory authority.
- UK — the Information Commissioner's Office (ico.org.uk).