Your data, on the record.

The controller responsible for processing your personal data under Art. 4(7) GDPR is:

Dataero Europe SRL
Rond-Point Robert Schuman 11
1040 Bruxelles
Belgium
Company / VAT number: BE1004.272.375
Privacy contact: legal@dataero.eu

For the radar.dataero.eu service described in this policy, Dataero acts as data controller. Where Dataero processes personal data on behalf of a business customer under a separate agreement, it acts as a data processor within the meaning of Art. 4(8) GDPR; that processing is governed by the relevant Data Processing Agreement and is outside the scope of this policy.

No Data Protection Officer has been formally appointed under Art. 37 GDPR, as the scope of processing does not trigger the mandatory-designation criteria. All privacy enquiries should be sent to legal@dataero.eu.

Dataero is a commercial company. radar.dataero.eu is operated as a commercial flight-tracking and aviation-data service — it is not a non-profit project and not a purely peer-to-peer data-sharing community. We set this out plainly so that you understand how your contribution is used before you connect a receiver.

3.1 What contributing means

When you run an ADS-B receiver and feed it to us (a « feeder »), your equipment sends us the aircraft signals it picks up. Aircraft ADS-B data — positions, identifiers, altitude, speed and similar flight parameters — describes aircraft, not you, and is not personal data about you. We combine the feeds we receive from many contributors to build a single, global, real-time picture of air traffic.

3.2 How we use contributed data

We use contributed ADS-B data to operate and improve this service and our wider commercial aviation products. Aggregated and processed aircraft data may be shown to the public, made available to our customers, and redistributed as part of our commercial offering. Because aircraft data is global reference data and not personal data about you, it is not subject to the personal-data restrictions set out elsewhere in this policy.

3.3 What we commit to as a contributor's privacy

Your relationship with us as a contributor is governed by clear limits:

• We never sell your personal data, and we do not trade it to third parties for their own marketing or commercial purposes.
• Your precise receiver location is treated as private. We use it to position and quality-check your feed; we do not publish your exact coordinates or home address.
• Your identity as a contributor is not published. Where contribution statistics or leaderboards are shown, they are tied to the profile name you choose — not to your real identity, unless you choose to reveal it.
• Contributing is voluntary. You can stop feeding at any time and request deletion of the personal data linked to your account (see section 10).

3.4 Why we tell you this

Operators of feeder software and the wider ADS-B community rightly ask data consumers to be explicit about their model and their intentions. Ours is straightforward: a commercial service that respects the people who contribute to it — open about the commercial use of aircraft data, and protective of contributors' personal data and receiver privacy.

4.1 Account data

When you create an account via our identity provider at sso.dataero.eu:

• Identity: first name, last name, e-mail address.
• Optional profile fields you provide: phone, gender, date of birth, profile picture.
• Optional home location (latitude / longitude) if you set one in your profile.

4.2 Technical & usage data

• ADS-B aircraft positions you submit as a feeder, linked to your account.
• Approximate receiver location, used to position and quality-check your feed; kept private and never published as your exact coordinates (see section 3.3).
• Your IP address, used only to serve / route requests and to detect abuse; not stored beyond what is needed to operate the service.
• Minimal browser metadata sent by your browser when it loads the application.

4.3 Local storage on your device

We persist the following items on your device using localStorage:

• radar-theme: your dark / light theme preference.
• radar-cookie-consent: JSON record of your cookie choice, the timestamp when it was given, and the policy version; kept for 12 months, then the banner re-appears.
• radar-map-center: the last map position you viewed.
• A single sign-on session token while you are logged in.

These items are strictly necessary for the service to function (Art. 5(3) ePrivacy) and are exempt from consent.

5.1 Strictly necessary

No advertising or cross-site tracking cookies are set. The items in section 4.3 are either first-party cookies or localStorage entries required to run the service.

5.2 Analytics (optional, off by default)

We use Google Analytics 4 (measurement ID G-WCDV5WRGRS), implemented with Google Consent Mode v2. Specifically:

• Before you choose, analytics_storage is set to denied: GA4 is loaded, but no cookies are written and no identifiers are sent to Google. Only aggregated, cookie-less pings may be transmitted if Consent Mode is pinged.
• If you click Accept, analytics_storage becomes granted and Google may then set these first-party cookies on your device:
  • _ga: used to distinguish users (lifetime: 2 years).
  • _ga_WCDV5WRGRS: session state (lifetime: 2 years).
• If you click Reject, consent remains denied and no analytics cookies are written.
• ad_storage, ad_user_data, and ad_personalization remain denied regardless of your choice. We additionally disable Google Signals (allow_google_signals: false) and ad-personalization signals (allow_ad_personalization_signals: false); no data is shared with Google advertising products.
• GA4 does not log IP addresses; IP is used only transiently to derive coarse geolocation before being discarded by Google's infrastructure.

5.3 Bot protection (Cloudflare Turnstile)

To keep automated scripts from harvesting the live map data, radar.dataero.eu runs an invisible Cloudflare Turnstile check when the application loads. Nothing is shown to you and no interaction is required. To tell a person from a script, Turnstile processes your IP address and technical signals from your browser and device; Dataero only receives the pass / fail result. The check is necessary to deliver the map to real visitors and is based on our legitimate interest in protecting the service (section 6).

Cloudflare's processing of this data is described in the Cloudflare Turnstile Privacy Addendum, which forms part of this policy for the Turnstile check.

• Account management and API-key features: legal basis: contract (Art. 6(1)(b) GDPR).
• Feeder data ingestion and per-user statistics: legal basis: contract (Art. 6(1)(b)).
• Operating our commercial aviation-data service: processing of the non-personal aircraft data you contribute (see section 3); this is outside the scope of personal-data legal bases, but we set it out here for transparency.
• Service security, abuse and fraud prevention: legal basis: legitimate interest (Art. 6(1)(f)); our interest is keeping the platform available and protecting users, and we have balanced this against your rights and freedoms.
• Audience measurement (Google Analytics 4): legal basis: consent (Art. 6(1)(a)) obtained via the cookie banner.

We do not sell, rent, or trade your personal data to any third party for their own independent marketing or commercial purposes. We share personal data only with the processors listed below, each bound by an Art. 28 GDPR data processing agreement:

• Google Ireland Ltd. (controller of record for EEA users) and Google LLC (US sub-processor): Google Analytics 4. Bound by Google's Data Processing Terms. See business.safety.google/privacy.
• Cloudflare, Inc.: Turnstile bot protection (section 5.3). See the Turnstile Privacy Addendum.
• Amazon Web Services EMEA SARL: profile-picture storage in an S3 bucket located in region eu-central-1 (Frankfurt).
• Hosting and infrastructure providers acting as processors under Art. 28 GDPR.

Where personal data is transferred outside the European Economic Area, the transfer relies on one of the safeguards listed in Chapter V GDPR:

• United States (Google LLC, analytics): covered by the EU-US Data Privacy Framework (DPF) adequacy decision of the European Commission dated 10 July 2023. Google LLC is DPF-certified. Secondary safeguards: Standard Contractual Clauses (Commission Decision 2021/914) and additional technical measures (Consent Mode v2, disabled Google Signals, no ad personalisation).
• United States (Cloudflare, Inc., Turnstile): covered by the EU-US Data Privacy Framework adequacy decision; Cloudflare, Inc. is DPF-certified.
• Transfers within AWS are restricted to the eu-central-1 region and stay in the EEA.

You can obtain a copy of the safeguards in place by writing to legal@dataero.eu.

• Account data: kept for as long as your account exists; you can request deletion at any time.
• Raw ADS-B messages linked to your account: retained up to 90 days, then aggregated into anonymised statistics.
• Cookie-consent record: 12 months (then the banner is shown again).
• Google Analytics event data: 14 months, the shortest retention available on the GA4 property.
• Security / abuse logs: up to 12 months.

You may, at any time and free of charge (Art. 12(5) GDPR), exercise:

• The right of access to your personal data (Art. 15).
• The right to rectification of inaccurate or incomplete data (Art. 16).
• The right to erasure / « right to be forgotten » (Art. 17).
• The right to restriction of processing (Art. 18).
• The right to data portability in a structured, machine-readable format (Art. 20).
• The right to object to processing based on legitimate interest (Art. 21).
• The right to withdraw your consent (Art. 7(3)) for analytics at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact legal@dataero.eu. We reply within one month as required by Art. 12(3) GDPR, extendable by two months for complex requests (you will be informed).

You also have the right to lodge a complaint with a supervisory authority. Our lead authority, since we are established in Belgium, is the Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA):

Rue de la Presse 35 / Drukpersstraat 35
1000 Brussels, Belgium
Tel: +32 2 274 48 00
Email: contact@apd-gba.be
autoriteprotectiondonnees.be

If you are located in another EU/EEA member state, you may also lodge a complaint with the supervisory authority of your country of residence; the full list is maintained by the European Data Protection Board at edpb.europa.eu.

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, within the meaning of Art. 22 GDPR.

We apply appropriate technical and organisational measures under Art. 32 GDPR, including:

• HTTPS / TLS for all browser-to-server and service-to-service traffic.
• Authentication and password management delegated to a hardened identity provider using industry-standard protocols and strong password hashing.
• Least-privilege database access with schema-scoped roles.
• Server-side obfuscation of sensitive API payloads in transit.
• Segregation of production and development environments.

This service is not directed at children. We do not knowingly collect personal data from persons under 16 years of age (Art. 8 GDPR). If you become aware that a minor has provided data without valid parental consent, please contact us at legal@dataero.eu and we will delete it.

In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours (Art. 33 GDPR) and, where required, inform affected users without undue delay (Art. 34 GDPR).

When we change how we process personal data, we update this page and the « Last updated » date above. For changes requiring consent (e.g. new analytics purposes), we bump the cookie-consent version, which invalidates stored consents and prompts you again.