Home Privacy Policy
Privacy Policy
What we do with personal data on this site and inside the platform, why we are allowed to do it, and how you take control of it.
Who we are
Atolys provides an aviation ERP and MRO platform for Part 145 base, line and heavy airframe maintenance organisations. In this policy, “Atolys”, “we” and “us” mean the company operating this website and the platform.
For everything described here, Atolys is the controller of your personal data — we decide why and how it is used. Questions, requests and complaints go to privacy@atolys.com.
What this policy covers
This policy explains what we do with personal data when you visit atolys.com, contact us, apply for a job, subscribe to something we send, or use the Atolys platform as a named user.
It does not cover websites we link to. Once you follow a link away from here, the policy of that site applies.
Personal data we collect
We collect only what a business relationship actually needs.
- Data you give us
- Name, organisation, work email, phone number, job role, the details of your enquiry and anything else you choose to write to us — through the contact form, by email, at an event or during a demonstration.
- Data created when you use the platform
- Your user account details, the authorisations held against your account, and the record of actions you take in the system: task sign-offs, findings raised, approvals given, with the timestamp and the user who made each change.
- Technical data
- IP address, browser and device type, operating system, referring page, the pages you view and the time of each request. Server logs are recorded for security and availability; analytics only run if you allow them.
- Recruitment data
- Your CV, work history, qualifications, licences and authorisations, right-to-work information where the role requires it, and our notes from interviews.
We do not ask for special categories of data (health, beliefs, and similar) and ask you not to send them to us unless a specific process — such as a workplace adjustment during recruitment — makes it necessary.
Why we use it, and on what basis
| What we do | Data used | Legal basis (GDPR) |
|---|---|---|
| Answer enquiries and arrange demonstrations | Contact and enquiry details | Legitimate interests — responding to someone who approached us; consent where you gave it on the form |
| Provide and support the platform | Account, authorisation and usage records | Performance of the contract with your organisation, and our legitimate interest in supporting it |
| Keep records that aviation and accounting rules require | Sign-off, approval and billing records | Legal obligation |
| Secure the site and the platform | Technical and log data | Legitimate interests — preventing abuse, fraud and outage |
| Measure how the website is used | Analytics cookie data | Consent, withdrawable at any time |
| Send updates you asked for | Name and email | Consent, withdrawable at any time |
| Assess job applications | Recruitment data | Steps before entering a contract, and legitimate interests in filling the role |
| Establish, exercise or defend legal claims | Whatever is relevant to the claim | Legitimate interests and legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights and freedoms, and we will share that assessment if you ask.
Cookies and similar technology
This website does not track you. It sets no analytics, advertising or profiling cookies, so there is no consent banner to click through. Signing in to the Atolys platform sets one strictly necessary session cookie, which keeps you logged in and protects forms against cross-site abuse.
The full detail — what is set, why, and how to control it in your browser — is in the Cookies Policy.
Who we share data with
We do not sell personal data and we do not trade it for advertising.
- Service providers who work for us under contract: hosting and infrastructure, email delivery, customer support tooling, analytics and accounting. They act on our documented instructions only.
- Your own organisation, where you use the platform as a named user — your administrators can see the records of the work done under your account, which is the point of an auditable maintenance system.
- Your customers or ours, where a maintenance record is shared through the customer portal, limited to the workscope in question.
- Authorities and auditors, where an aviation regulator, an auditor or a court is entitled to the record.
- A buyer or successor, if the business or part of it is sold or reorganised. You would be told before anything transferred.
International transfers
We prefer to keep processing inside the European Economic Area. Where a provider processes data outside the EEA, we transfer only on a lawful basis: an adequacy decision, the European Commission’s Standard Contractual Clauses, or another recognised safeguard, together with technical measures such as encryption in transit and at rest.
Ask us at privacy@atolys.com and we will tell you which safeguard applies to a particular transfer and provide a copy of the relevant terms.
How long we keep data
- Enquiries that did not lead anywhere — up to 24 months from our last exchange.
- Customer account and usage records — for the life of the contract, then as long as aviation record-keeping and accounting rules require.
- Maintenance sign-off and traceability records — for the period the applicable airworthiness rules set, which is longer than our own commercial need.
- Server and security logs — normally 12 months.
- Unsuccessful applications — 12 months, unless you ask us to delete them sooner or agree to be kept on file.
- Cookie consent — 12 months from the choice, after which we ask again.
When a retention period ends we delete the data or irreversibly anonymise it.
How we protect data
Access is granted on the least-privilege principle and reviewed regularly. Data is encrypted in transit and at rest, administrative access requires multi-factor authentication, changes to production are logged, and backups are tested rather than assumed.
If a breach is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours of becoming aware of it, and we tell affected people directly where the risk is high.
Your rights
Under the GDPR you can ask us to:
- confirm what we hold about you and give you a copy;
- correct anything inaccurate or incomplete;
- delete data we no longer have a reason to keep;
- restrict processing while a dispute about accuracy or grounds is resolved;
- provide data you gave us in a portable, machine-readable format;
- stop processing based on legitimate interests, by objecting on grounds relating to your situation;
- withdraw consent at any time, which does not affect what was lawful beforehand.
Write to privacy@atolys.com. We reply within one month and will say so if a complex request needs longer. Exercising a right is free; we may charge only where a request is manifestly excessive.
If you are unhappy with how we handled your data, you can complain to the data protection supervisory authority in the EU country where you live, work, or where the problem happened. We would rather hear from you first, so we can put it right.
Customer data inside the platform
When a maintenance organisation runs its operation on Atolys, that organisation decides what goes into the system and why. For that data we act as a processor: we handle it on documented instructions under a data processing agreement, we do not use it for our own purposes, and we return or delete it when the contract ends.
If you are an employee, contractor or customer of an organisation that uses Atolys and you want to exercise a right over that data, approach that organisation first. Tell us and we will point you in the right direction and support their response.
Children
This is a business platform. It is not directed at children and we do not knowingly collect data about anyone under 16. If you believe a child’s data has reached us, write to privacy@atolys.com and we will remove it.
Changes to this policy
We update this policy when what we do changes, or when the law does. The version and date at the top always show the current text. If a change materially affects you, we will say so on the site and, where we hold your address, by email — before it takes effect.
How to contact us
Privacy questions, access requests and complaints: privacy@atolys.com.
Anything else: office@atolys.com.