Privacy Notice

1. Introduction

Protecting personal data and safeguarding confidential information are fundamental principles of flyXware GmbH’s corporate governance. As an innovative engineering company, flyXware GmbH develops and manufactures advanced electronic components and fully integrated automated aviation systems for industrial, scientific and institutional applications.

Responsible data processing forms an integral part of our business operations. We process personal data only where necessary, in compliance with the requirements of the European General Data Protection Regulation (“GDPR”) and all other applicable data protection legislation.

This Privacy Notice explains how flyXware GmbH collects, processes, stores and protects personal data when you visit our website, communicate with us or engage with us in the course of our business activities.

Our objective is to ensure that all processing activities are transparent, lawful and limited to what is necessary for the respective purpose.

2. Data Controller

The controller responsible for processing personal data within the meaning of the GDPR is:

flyXware GmbH
Steinbachstr. 7
52074 Aachen
Germany

Represented by:
Dr.-Ing. Lutz Eckstein
Managing Director

E-mail: info@flyxware.com
Website: www.flyxware.com

At present, flyXware GmbH has not appointed a Data Protection Officer, as the applicable legal requirements for such appointment are currently not met. Any questions concerning data protection or the processing of personal data may be directed to the contact details provided above.

3. Scope of this Privacy Notice

This Privacy Notice applies to all personal data processed by flyXware GmbH in connection with:

• the use of our corporate website;
• communication by e-mail;
• business relationships with customers, suppliers and service providers;
• cooperation with research institutions and project partners;
• research and development activities;
• other business-related communications.

This Privacy Notice applies exclusively to processing activities carried out by flyXware GmbH. Where our website contains links to external websites operated by third parties, their respective privacy notices shall apply.

4. Principles of Data Processing

flyXware GmbH processes personal data in accordance with the principles established by Article 5 GDPR.

Accordingly, personal data is processed::

• lawfully, fairly and transparently;
• only for specified and legitimate purposes;
• limited to what is necessary for the intended purpose;
• accurately and, where necessary, kept up to date;
• only for as long as required;
• using appropriate technical and organisational safeguards.

Beyond compliance with legal obligations, protecting confidential business information, engineering data, research results and intellectual property forms an essential element of our corporate governance and information security strategy.

Our processing activities are designed to ensure confidentiality, integrity, availability and resilience of the information entrusted to us.

5. Legal Basis for Processing

Depending on the respective processing activity, flyXware GmbH processes personal data on one or more of the following legal bases:

• Article 6(1)(a) GDPR – Consent;
• Article 6(1)(b) GDPR – Performance of a contract or implementation of pre-contractual measures;
• Article 6(1)(c) GDPR – Compliance with legal obligations;
• Article 6(1)(f) GDPR – Legitimate interests pursued by flyXware GmbH or a third party.

Legitimate interests may include, in particular:

• maintaining secure and reliable IT systems;
• protecting our website against misuse;
• conducting business communications;
• documenting business transactions;
• ensuring network and information security;
• protecting confidential information and intellectual property;
• developing and improving our products and services.

Where processing is based on consent, such consent may be withdrawn at any time with future effect.

6. Website Operation

When you access our website, your browser automatically transmits certain technical information to our web server.

The following categories of information may be processed:

• IP address;
• date and time of access;
• browser type and browser version;
• operating system;
• referring website (where transmitted);
• requested pages and files;
• amount of data transferred;
• HTTP status code.

These data are processed solely for the purposes of:

• providing the website;
• maintaining operational security;
• ensuring system stability;
• detecting and preventing unauthorised access;
• analysing technical errors;
• maintaining network and information security.

The legal basis for this processing is Article 6(1)(f) GDPR.

Our legitimate interest lies in providing a secure, stable and functional online presence.

7. Website Hosting

Our corporate website is hosted by an external hosting provider.

The hosting provider processes personal data only to the extent necessary for operating the website and exclusively on our behalf under a data processing agreement in accordance with Article 28 GDPR.

Hosting-related processing may include, in particular:

• server log data;
• technical communication data;
• system security information;
• backup and recovery information.

flyXware GmbH carefully selects service providers that provide appropriate technical and organisational measures to protect personal data.

8. Secure Data Transmission (TLS)

To protect the confidentiality of communications transmitted via our website, flyXware GmbH uses Transport Layer Security (TLS).

Encrypted communication can generally be recognised by the “https://” protocol and the padlock symbol displayed in modern web browsers.

TLS encryption helps protect transmitted information against unauthorised access, alteration or disclosure during transmission between your device and our web servers.

While no internet transmission can be guaranteed to be completely secure, we continuously review and improve our technical security measures to maintain an appropriate level of protection.

9. Server Log Files

For technical and security-related reasons, our web servers automatically generate server log files.

These log files may contain technical information relating to website usage and system access.

Server log files are processed exclusively for purposes including:

• maintaining operational reliability;
• ensuring system security;
• identifying technical malfunctions;
• detecting misuse and cyber security incidents;
• analysing attacks against our IT infrastructure;
• safeguarding network availability.

The information contained in server log files is not combined with other data sources for the purpose of identifying individual website visitors unless required by law or necessary for investigating security incidents.

Server log files are retained only for as long as necessary to fulfil the purposes described above or to comply with statutory obligations.

10. Communication by E-mail

If you contact flyXware GmbH by e-mail, we process the personal data you voluntarily provide solely for the purpose of responding to your enquiry and maintaining business communication.

Depending on the nature of your enquiry, this may include:

• your name;
• company or organisation;
• business contact details;
• the content of your correspondence;
• attachments transmitted by you;
• date and time of communication;
• any additional information voluntarily provided.

Personal data are processed only to the extent necessary to respond to your request, establish contact, initiate a business relationship or fulfil contractual obligations.

The legal basis for such processing is Article 6(1)(b) GDPR where the communication relates to contractual or pre-contractual matters. In all other cases, processing is based on Article 6(1)(f) GDPR, reflecting our legitimate interest in maintaining efficient business communications.

Correspondence is retained only for as long as necessary for the respective purpose or as required by applicable statutory retention obligations.

11. Business Relationships

As part of our commercial activities, flyXware GmbH processes personal data relating to customers, suppliers, service providers, consultants, cooperation partners and other business contacts.

The categories of personal data processed may include:

• names;
• job titles;
• employer or organisation;
• business addresses;
• telephone numbers;
• e-mail addresses;
• contractual information;
• business correspondence;
• invoicing and payment information where required.

Processing is carried out for purposes including:

• initiating business relationships;
• negotiating and concluding contracts;
• contract administration;
• procurement;
• supplier management;
• customer support;
• regulatory compliance;
• accounting and financial administration.

The legal basis for this processing is Article 6(1)(b), (c) and (f) GDPR.

flyXware GmbH processes only those personal data that are necessary for the respective business purpose.

12. Research and Development Activities

Research, engineering and technological innovation form the core of flyXware GmbH’s business activities.

Within the scope of research and development projects, we may process personal data relating to representatives of customers, research institutions, universities, suppliers, industrial partners and public organisations.

Processing may be necessary for purposes such as:

• project planning;
• technical coordination;
• collaborative engineering activities;
• project administration;
• contractual documentation;
• communication with project partners;
• quality assurance;
• regulatory compliance.

Only those categories of personal data required for the respective project are processed.

Where appropriate, confidentiality obligations, contractual non-disclosure agreements and information security requirements apply in addition to data protection legislation.

Processing is generally based on Article 6(1)(b) GDPR for contractual cooperation or Article 6(1)(f) GDPR reflecting our legitimate interest in conducting research and development activities.

13. Protection of Confidential Information and Intellectual Property

Protecting confidential business information represents an essential element of flyXware GmbH’s corporate governance.

In addition to personal data, we implement appropriate measures to protect confidential information including:

• engineering documentation;
• software and source code;
• technical specifications;
• research results;
• design documentation;
• prototypes;
• project documentation;
• trade secrets;
• intellectual property.

Access to confidential information is granted exclusively on a need-to-know basis and only to authorised personnel.

Appropriate technical and organisational measures are implemented to ensure confidentiality, integrity and availability throughout the entire information lifecycle.

These measures support both compliance with applicable legal obligations and the protection of our customers’ and business partners’ legitimate interests.

14. Microsoft 365 and Microsoft Teams

flyXware GmbH uses Microsoft 365 and Microsoft Teams as part of its business communication and collaboration environment.

Depending on the respective business process, personal data processed may include:

• names;
• business contact details;
• meeting invitations;
• calendar information;
• communication content;
• documents shared during collaboration;
• technical connection data;
• user account information.

These services are used solely for legitimate business purposes including:

• internal communication;
• communication with customers and suppliers;
• online meetings;
• project collaboration;
• document management;
• appointment scheduling.

Where Microsoft processes personal data on our behalf, such processing is governed by applicable contractual arrangements and data protection requirements.

Where required under applicable law, appropriate safeguards are implemented for any international transfer of personal data.

Further information regarding Microsoft’s processing of personal data is available in Microsoft’s own privacy documentation.

15. Recipients of Personal Data

Personal data are disclosed only where necessary for the purposes described in this Privacy Notice or where disclosure is required by law.

Depending on the respective processing activity, recipients may include:

• IT service providers;
• website hosting providers;
• cloud service providers;
• telecommunications providers;
• external consultants;
• legal advisors;
• tax advisors;
• auditors;
• banks and payment service providers;
• public authorities;
• courts;
• regulatory authorities.

Where external service providers process personal data on behalf of flyXware GmbH, such processing is carried out under data processing agreements in accordance with Article 28 GDPR.

All processors are selected carefully and are required to implement appropriate technical and organisational measures to ensure the protection of personal data.

16. International Data Transfers

As a general principle, flyXware GmbH processes personal data within the European Union and the European Economic Area.

Where, in exceptional cases, personal data are transferred to countries outside the European Economic Area, such transfers are carried out only where one of the conditions laid down in Chapter V GDPR is fulfilled.

Appropriate safeguards may include:

• an adequacy decision adopted by the European Commission;
• the European Commission’s Standard Contractual Clauses;
• other safeguards recognised under Articles 44–49 GDPR.

flyXware GmbH regularly reviews its international data processing activities to ensure ongoing compliance with applicable European data protection legislation.

17. Retention of Personal Data

flyXware GmbH retains personal data only for as long as necessary to fulfil the purposes for which the data were collected or to comply with applicable legal obligations.

The applicable retention period depends in particular on:

• the purpose of the processing activity;
• contractual obligations;
• statutory retention requirements under commercial and tax legislation;
• limitation periods for legal claims;
• legitimate interests relating to the establishment, exercise or defence of legal claims.

Once personal data are no longer required for these purposes and no statutory retention obligation applies, they are securely deleted or anonymised in accordance with our internal retention procedures.

18. Technical and Organisational Security Measures

Protecting personal data, confidential business information and technical know-how is an integral part of flyXware GmbH’s corporate governance and information security framework.

We implement appropriate technical and organisational measures (“TOMs”) designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

These measures are regularly reviewed and adapted to reflect technological developments, operational requirements and the evolving risk landscape.

Depending on the processing activity, our security measures include, among others:

• encrypted communication using Transport Layer Security (TLS);
• access control and role-based authorisation concepts;
• authentication procedures for authorised users;
• regular system maintenance and security updates;
• backup and recovery procedures;
• logging and monitoring of relevant security events;
• protection against malware and cyberattacks;
• physical protection of IT infrastructure;
• secure management of user accounts and permissions;
• confidentiality obligations for employees and external service providers.

Access to personal data is granted only to individuals who require such access to perform their professional responsibilities.

19. Rights of Data Subjects

Under the GDPR, you have various rights concerning the processing of your personal data.

Right of Access
You have the right to obtain confirmation as to whether we process personal data relating to you and, where this is the case, to request access to such data together with the information required under Article 15 GDPR.

Right to Rectification
If personal data processed by us are inaccurate or incomplete, you have the right to request that such data be corrected or completed without undue delay.

Right to Erasure
Subject to the conditions laid down in Article 17 GDPR, you may request the deletion of your personal data where the legal requirements are fulfilled.

Right to Restriction of Processing
Under the circumstances set out in Article 18 GDPR, you may request that the processing of your personal data be restricted.

Right to Data Portability
Where processing is based on consent or on a contract and carried out by automated means, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format and, where technically feasible, to have those data transmitted directly to another controller.

Right to Object
Where processing is based on Article 6(1)(f) GDPR, you may object to such processing at any time on grounds relating to your particular situation.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to such processing. At present, flyXware GmbH does not use personal data collected through this website for direct marketing purposes.

Withdrawal of Consent
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

Withdrawal of consent shall not affect the lawfulness of processing carried out prior to the withdrawal.

20. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes applicable data protection legislation, you have the right to lodge a complaint with a competent supervisory authority.

You may contact, in particular:

• the supervisory authority responsible for the registered office of flyXware GmbH; or
• the supervisory authority in your Member State of habitual residence, place of work or the place of the alleged infringement.

Lodging a complaint does not affect any other administrative or judicial remedies available under applicable law.

21. Changes to this Privacy Notice

flyXware GmbH reserves the right to amend this Privacy Notice whenever necessary to reflect changes in legal requirements, regulatory guidance, technical developments or our business processes.

The latest version published on our website shall apply.

We recommend that visitors review this Privacy Notice periodically to remain informed about how personal data are processed and protected.

Contact

If you have any questions regarding this Privacy Notice or the processing of your personal data, please contact:

flyXware GmbH
Steinbachstraße 7
52074 Aachen, Germany

Represented by:
Dr.-Ing. Lutz Eckstein
Managing Director

E-mail: info@flyxware.com

Website: www.flyxware.com

Document Information

Document Title: Privacy Notice

Version: 1.0

Effective Date: July 2026

Document Owner: flyXware GmbH

Applicable Law: Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and applicable German data protection legislation.