Skip to content
Book a discovery call

furqan@aerocomplianceservices.com
+49 176 238 55733

Legal

Data Processing Agreement

Last updated: December 2025

Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the service agreement between Aero Compliance Services (the “Processor”) and the Client (the “Controller”) for the provision of aviation regulatory compliance consulting services.

This DPA reflects the parties’ agreement with regard to the processing of personal data in accordance with Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the UK Data Protection Act 2018.

Definitions

For the purposes of this DPA:

  • “Personal Data” means any information relating to an identified or identifiable natural person.
  • “Processing” means any operation performed on Personal Data, whether or not by automated means.
  • “Controller” means the natural or legal person which determines the purposes and means of Processing.
  • “Processor” means the natural or legal person which Processes Personal Data on behalf of the Controller.
  • “Data Subject” means the identified or identifiable natural person to whom Personal Data relates.
  • “Sub-processor” means any Processor engaged by the Processor to assist in fulfilling its obligations under this DPA.

Details of Processing

The Processing under this DPA is carried out as follows:

Subject matter: Aviation regulatory compliance consulting services
Duration: For the term of the service agreement
Nature and purpose: To provide regulatory compliance advice, documentation support, and certification management services
Types of Personal Data: Contact details, professional information, and compliance-related records of the Controller’s staff and representatives
Categories of Data Subjects: The Controller’s employees, contractors, and authorised representatives

Obligations of the Processor

Aero Compliance Services agrees to:

  • Process Personal Data only on documented instructions from the Controller
  • Ensure that persons authorized to process Personal Data have committed themselves to confidentiality
  • Implement appropriate technical and organizational security measures
  • Not engage sub-processors without prior written authorization
  • Assist the Controller in ensuring compliance with GDPR obligations
  • Make available to the Controller all information necessary to demonstrate compliance
  • Allow for and contribute to audits by the Controller
  • Notify the Controller without undue delay after becoming aware of a personal data breach
  • Delete or return all Personal Data to the Controller at the end of the provision of services

Sub-processors

The Controller authorizes the Processor to engage the following categories of sub-processors:

  • Cloud storage and hosting providers
  • IT support and maintenance services
  • Professional advisors (legal and accounting)

The Processor shall:

  • Enter into a written agreement with each sub-processor imposing data protection obligations substantially similar to those in this DPA
  • Remain fully liable to the Controller for the performance of sub-processors’ obligations
  • Notify the Controller of any intended changes concerning sub-processors

Security Measures

The Processor implements the following technical and organizational security measures:

  • Encryption of data in transit (TLS 1.3) and at rest (AES-256)
  • Access controls based on role and need-to-know principles
  • Regular security assessments and penetration testing
  • Secure backup and disaster recovery procedures
  • Staff training on data protection and security awareness
  • Physical security measures for offices and equipment

Data Breach Notification

In the event of a personal data breach, the Processor shall:

  • Notify the Controller without undue delay and in any case within 24 hours of becoming aware
  • Provide details of the breach including:
    • Nature of the breach
    • Categories and approximate number of affected Data Subjects
    • Likely consequences
    • Measures taken or proposed to address the breach

The Processor shall cooperate fully with the Controller in investigating and remedying any breach.

Data Subject Rights

The Processor shall promptly notify the Controller of any request received from a Data Subject to exercise their rights under GDPR. The Processor shall not respond to such requests directly unless expressly authorized by the Controller.

The Processor shall assist the Controller in fulfilling its obligations to respond to Data Subject requests, including:

  • Access requests
  • Rectification requests
  • Erasure requests
  • Restriction of processing requests
  • Data portability requests
  • Objection requests

Return or Deletion of Data

Upon termination of the service agreement, the Processor shall, at the Controller’s choice:

  • Return all Personal Data to the Controller, or
  • Delete all Personal Data and certify the deletion in writing

This obligation does not apply to the extent that the Processor is required by applicable law to retain Personal Data.

Contact Information

For questions regarding this DPA, please contact:

Aero Compliance Services
Data Protection Officer
Email: furqan@aerocomplianceservices.com
Phone: +49 176 238 55733
Address: Bobinger Str. 93, 86199 Augsburg, Germany

Book a discovery call