Privacy and cookie policy

1. Controller

GAT – German Aviation Training (owner: Tim Hittinger)
Max-Planck-Straße 22, 72810 Gomaringen, Germany
Phone: +49 7072 1352530 · Email: info@german-aviation-training.de

No data protection officer has been appointed, as there is no legal obligation to do so. For data protection questions and to exercise your rights, please use the contact details above.

2. Legal bases, recipients and transfers

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the applicable national rules, in particular the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). The legal bases are mainly Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures), (c) (compliance with legal obligations), (f) (legitimate interests) and – only where we explicitly ask for it – (a) (consent).

For cookies and similar technologies, Art. 5(3) of Directive 2002/58/EC (ePrivacy Directive) also applies, as implemented in Italy by Art. 122 of the Italian Personal Data Protection Code (Legislative Decree 196/2003) and in Germany by Section 25 TDDDG, together with the cookie guidelines of the Italian data protection authority (Garante per la protezione dei dati personali) of 10/06/2021, «Linee guida cookie e altri strumenti di tracciamento» (guidelines on cookies and other tracking tools).

Who receives data

• Hosting: ALL-INKL.COM – Neue Medien Münnich, Germany (section 3)
• Booking: eTermin GmbH, Switzerland, with servers in Frankfurt am Main (section 6)
• Payment: PayPal or Stripe, depending on the method you choose (section 7)
• Test: Zoom for the video conference, the language testing body LTB 112 (Leonding (Austria)) and, as part of official supervision, Austro Control GmbH (section 8)
• Only with your consent: Google for Google Analytics and Google Ads (section 4)
• Only if you message us on WhatsApp: WhatsApp Ireland Limited (section 5)

We do not use your data for personalised advertising. We do not take decisions based solely on automated processing, including profiling (Art. 22 GDPR): your test level is assigned by the examiners.

Transfers of data outside the European Union

Some recipients may also process data outside the European Union: eTermin is based in Switzerland; Google, Zoom and WhatsApp (Meta) may transfer data to the USA; PayPal and Stripe may pass data to companies in their group, including in the USA, as described in their privacy notices. The European Commission has adopted an adequacy decision for Switzerland (Art. 45 GDPR). Transfers to the USA are based on the adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, and otherwise on standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR).

3. Hosting and server log files

This website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Each time you access the website, the server automatically processes data transmitted by your browser: IP address, date and time, page accessed, referrer URL, amount of data transferred, browser and operating system.

This is technically necessary to deliver the website and keep it secure (Art. 6(1)(f) GDPR). The log data is deleted or anonymised after a short time. We have concluded a data processing agreement with the host under Art. 28 GDPR, appointing it as our processor.

4. Cookies, consent and measurement

Without your consent, this website sets no cookies and embeds no analytics, advertising or social media services. Fonts and graphics are loaded from our own server; the animation explaining the test is also part of the website and uses no external video platform.

On your first visit, a banner asks whether you allow Google Analytics (statistics) and Google Ads (ad measurement); it only offers services that are actually active on the website. The “Accept all” and “Reject all” buttons are equally prominent; with “Customise” you can choose individual services, all of which are switched off at first. Closing the banner with the X is the same as rejecting: you continue without consent. Scrolling the page does not count as consent, and the website remains fully usable without consent.

Only after you agree does your browser load Google services. Content from other providers is only loaded on the booking page, when the eTermin calendar is displayed (section 6).

Change cookie settings

4.1 Storing your choice

We store your choice in your browser’s local storage (entry gat-consent with your selection and the date; this is not a cookie). This is necessary so that we do not ask you again on every page and can document your decision (Art. 5(3) Directive 2002/58/EC; Art. 122(1) Legislative Decree 196/2003; Section 25(2) no. 2 TDDDG; Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

Your choice – including a rejection – is valid for 12 months; after that, the banner appears again. It only appears earlier if the entry has been deleted, if your browser does not allow it to be saved or if the services we use change significantly. You can delete the entry in your browser settings at any time.

4.2 Google Analytics 4

With your consent, we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics shows us how visitors use our pages – for example which pages are viewed and which booking and contact buttons are clicked – and whether a visit ends in a booking.

For this, cookies (_ga, _ga_…, lifetime up to 13 months) with a random identifier are set and usage data is transmitted to Google: pages viewed, clicks, date and time, device, browser, approximate location. Google Analytics 4 does not log or store IP addresses. Google signals and ad personalisation are disabled. In Google Analytics, the data is deleted after 14 months.

4.3 Google Ads conversion tracking

We advertise our services with Google Ads. With your consent, when you click one of our ads, Google stores a click identifier in cookies (_gcl_au, _gcl_aw, lifetime up to 90 days). If you then book, we can see that the booking came from the ad – without receiving any information that allows us to identify you personally.

We do not use remarketing, i.e. personalised advertising based on your visit.

4.4 Google Consent Mode v2

We use Google Consent Mode v2 in its “basic” version: until you consent, Google tags are not loaded and no data at all is sent to Google. After you consent, Google services are told which choice you made, for example statistics yes, ad measurement no. Ad personalisation always remains disabled.

4.5 Legal basis, transfer to the USA and withdrawal

The legal basis for Google Analytics and Google Ads is your consent (Art. 6(1)(a) GDPR; Art. 122 Legislative Decree 196/2003; Section 25(1) TDDDG). Google may also transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).

You can withdraw or change your consent at any time with effect for the future – via “Cookie settings” at the bottom of every page or with the button above. When you withdraw consent, we delete this website’s Google cookies in your browser. More information: Google privacy policy and privacy in Google’s business products .

5. Contact by email, phone or WhatsApp

If you contact us, we process the details you provide (e.g. name, email address, phone number, content of your enquiry) to handle your request (Art. 6(1)(b) or (f) GDPR). We delete the data as soon as it is no longer needed and no statutory retention obligations apply.

If you message us on WhatsApp, your data is also processed by WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland; this may include a transfer to Meta Platforms in the USA. Please only use WhatsApp if you agree to this – alternatively, you can reach us by email or phone.

6. Booking via eTermin

For bookings we use the eTermin service of eTermin GmbH, Mättivor 3, 6430 Schwyz, Switzerland. According to the provider, its servers are located in Frankfurt am Main (Germany). The eTermin calendar is only embedded on our booking page: it loads when you click “Show available slots” or, on larger screens, when you select a test or reach the page via a button or link on our website. On small screens, the button opens eTermin’s booking page directly. At that point, your IP address and technical information are transmitted to eTermin.

When you book, eTermin processes the data you enter on our behalf (e.g. name, email address, phone number, chosen slot, payment status) to manage the appointment and send you confirmations (Art. 6(1)(b) GDPR). Without the mandatory details, you cannot book. We have concluded a data processing agreement with eTermin under Art. 28 GDPR. The European Commission has adopted an adequacy decision for Switzerland. eTermin may set technically necessary cookies, for example for language selection. More information: eTermin privacy policy .

After a booking, eTermin redirects you to our thank-you page. If you have consented to statistics or ad measurement (section 4), the booking is recorded there as an event – with the booked service, the price and a technical booking reference, but without your name, email address or other contact details.

7. Payment

You can pay by PayPal or credit card. For PayPal payments, the controller is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg; credit card payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland.

We or our booking provider transmit the data required for payment to the provider you choose (Art. 6(1)(b) GDPR). The respective provider’s privacy notices also apply.

8. Conducting the test

The test takes place by video conference via Zoom (Zoom Communications, Inc., USA, certified under the EU-US Data Privacy Framework). For the test, the identity check and the certificate, we process your identity and licence data (e.g. name, date and place of birth, address, copy of your ID and licence), your image and voice during the video conference, your test performance and your result. Checking your identity is also one of the conditions ENAC sets for online tests.

The examiners work within the language testing body LTB 112, Leonding (Austria). We pass this data on to LTB 112, which carries out the second assessment, issues the certificate and keeps the test documentation for 7 years, as required by Austro Control’s rules for language testing bodies; under these rules, the documentation also includes the audio recording of the test. As part of official supervision, the data may be made available to the Austrian aviation authority Austro Control GmbH, Vienna. For the processing it is responsible for, LTB 112’s privacy information applies; it is published on the LTB 112 website .

We do not send your result to ENAC: you submit the certificate yourself for the endorsement on your licence.

The legal bases are Art. 6(1)(b) GDPR (performance of the contract) and (c) (obligations under aviation rules for language proficiency assessments). Providing this data is necessary: without an identity check, the test cannot take place. You will receive further details in the privacy form we send you after booking.

9. Tech check and sample tasks

The tech check and the recording feature of the sample tasks run exclusively in your browser. Camera image, microphone signal, recordings and your entries are not transmitted to us or third parties and are not stored. You grant access to camera and microphone yourself via your browser; it ends when you stop the test or leave the page.

10. External links

Links to other websites (e.g. authorities, ProvenExpert, Google or the Zoom test) are only opened when you click them. From then on, the respective provider’s privacy policy applies.

11. Retention periods

We only store personal data for as long as necessary for the purpose for which it was collected:

• cookie choice (gat-consent): 12 months;
• server log files: a short period, then deletion or anonymisation;
• data in Google Analytics: 14 months;
• contact enquiries: as long as needed to answer them;
• test documentation at LTB 112, including the audio recording: 7 years;
• booking and accounting records: according to the retention obligations under German commercial and tax law, usually 6 to 10 years.

How long GAT keeps the data collected for the test is stated in the privacy form you receive after booking.

12. Your rights and complaints

Under the conditions set out in the GDPR, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21). You can withdraw any consent given at any time with effect for the future (Art. 7(3)); this does not affect the lawfulness of processing carried out before the withdrawal. To exercise your rights, simply write to info@german-aviation-training.de.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. In Italy, this is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome (garanteprivacy.it ).

The supervisory authority responsible for GAT in Germany is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

13. Encryption

For security reasons, this website uses TLS encryption. You can recognise it by the padlock symbol and “https://” in the address bar.

14. Changes to this policy

We update this policy when the services we use or the law change. The version published on this page applies.

Legal notice · Terms and conditions

Last updated: October 2026