Privacy policy

Your account

Name, email address, language, your role or access per app, whether your account is active, and your password. The password is stored only in encrypted form (as a hash); nobody can read it.

Data from Shiftbase

AIFS keeps its employees in Shiftbase. From there, the apps’ server takes only first name, last name, email address, date of birth, employee number, start date and whether you are active in Shiftbase. AIFS uses this to prepare your invitation, to keep your name up to date and to block your account when you are deactivated in Shiftbase. AIFS Portal also compares name and date of birth with certificates you provide.

The server takes no other data from Shiftbase, such as address, bank details or BSN. It only reads and writes nothing back to Shiftbase. Only admins can see the date of birth and employee number from Shiftbase; you don’t see them in the apps either. External people are not in Shiftbase; for them AIFS only has name and email address in the apps.

Where the data comes from

• From you: what you enter, upload and photograph.
• From AIFS admins: for example your invitation, your role, whether you have a driving licence and notices to you.
• From colleagues: for example when someone names you as involved in a report.
• From Shiftbase (see above).
• Automatically: technical data with every connection (see below).

Technical data

Every sign-in and every request to the server involves your IP address and the time. Sign-ins are recorded in a security log.

The apps do not collect location data, contacts or device IDs. They do not send push notifications; reminders come by email. There are no trackers, no analytics and no advertising.

Purposes and legal basis

AIFS uses the data to organise and document the work: keeping track of certificates and deadlines, running AIFS tests, carrying out audits, reporting and investigating incidents, informing employees, showing airlines and the airport that everything is in order, and managing and securing the accounts.

The legal basis is Art. 6(1)(b) GDPR insofar as it concerns your work for AIFS, and Art. 6(1)(f) GDPR: the legitimate interest of AIFS in verifiable quality and safety and in secure access. For health data in AIFS SMS, Art. 9(2)(b) GDPR applies in addition (see AIFS SMS).

Security

• The connection between app or browser and server is encrypted (HTTPS).
• Who may see and change what is enforced by the database itself, not just by the app.
• Files and photos are kept in non-public storage and can only be retrieved by authorised people, through links that are valid for a short time.
• When you sign in and for “Forgot password?”, Cloudflare Turnstile checks that a person is signing in and not an automated program.

Supabase (storage)

Accounts, certificates, test data, reports, incident reports, notices and all files are stored in a database and non-public storage at Supabase, in a data centre in Frankfurt am Main (Germany). Supabase processes them as a processor on behalf of AIFS. For your data, the apps connect directly to Supabase. Supabase is based in the USA; access from there, for example for maintenance, cannot be ruled out.

Cloudflare

Cloudflare, Inc. (based in the USA, with data centres worldwide) does three things:

• It delivers the websites of the apps and this website. In doing so, Cloudflare technically processes the IP address and the time of the request. Your data in the apps does not pass through Cloudflare. This website itself uses no cookies and no scripts.
• Turnstile: when you sign in and for “Forgot password?”, Cloudflare processes technical data of your browser or device and your IP address to stop attacks by automated programs.
• Workers AI: translations and AI functions for admins. Which texts are sent there is described per app below.

For Workers AI, Cloudflare does not commit to processing within the EU; processing in the USA can therefore not be ruled out. Cloudflare does not store the texts after the answer and does not train models with them.

Postmark (email)

Emails from the apps (invitations, codes for “Forgot password?”, reminders and short messages about your access) are sent by Postmark (based in the USA). For this, Postmark receives your email address and the content of the email.

Transfers to the USA

Supabase, Cloudflare and Postmark are processors of AIFS. Where data is transferred to the USA in the process, this is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); Cloudflare is also certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR).

App stores

You get the apps through Apple’s App Store, through Google Play or as an installation file through a link from AIFS. Apple and Google process data according to their own terms. The apps do not send them any data about you. If you have allowed your device to share crash reports with developers, Apple or Google may pass crash reports and statistics to the developer, without your name and without any content from the apps.

What data

• Certificates: the type, the date you obtained the certificate, the expiry date calculated from it (certificates that are valid without limit have none) and the file. The portal stores new files only as PDF.
• Schiphol pass: only the expiry date, not the pass itself.
• Driving licence: admins can note on your account that you have a driving licence. This decides whether certificates for drivers are mandatory for you. You then enter the expiry date yourself (only the date, not the licence); admins can see and change it.
• AIFS tests: every attempt with your answers, the result and the time. If you pass, an AIFS certificate is created with a number, a verification code and a PDF that shows your name.
• Training: admins provide training material (PDF or link) for everyone, for drivers or for selected people. A link opens a website outside the portal; the terms of that website apply there.
• Read & Sign: see below.

Recognition when uploading

In the browser, your device reads the name, date of birth, training and date from the certificate when you upload it, to save you typing. The app does not do this; there you enter the date yourself. The file and the text read do not go to any third-party service for this; the program files for the recognition come from the portal’s own website.

The name and date of birth are stored as they appear on the certificate, together with the certificate, plus whether they were recognised or changed by you. The recognition is only a suggestion: you confirm before anything is stored. If they do not match the data from Shiftbase, the portal may warn you about it; you can still save. Only you and the admins can see these details.

Photos and camera

The app opens your photos or the camera only when you tap it while uploading, and only for that one image. A photo or screenshot is converted to a PDF on your device; location and other image details are removed in the process. Only the PDF is stored. The app deletes copies in its cache as soon as they have been read.

Check page for AIFS certificates

Every AIFS certificate carries a QR code. It leads to a check page that is open without signing in, so that an airline or the airport can verify the certificate. Anyone who has the QR code or the verification code sees the certificate number, your name, the name of the test, the “valid until” date and the status: valid, expired, withdrawn, no longer valid because the test was updated, or test certificate. The page shows nothing more.

The verification code is a long, random code, not the running number. Only pass the QR code on to people who should see your certificate.

Reminder emails

The portal emails you before something expires: for certificates 30 and 7 days before and on the expiry day, for the Schiphol pass and the driving licence 90, 30 and 7 days before. If a mandatory certificate is missing, you receive an email about it and then, every Monday, one summary of what is missing or expired, until everything is there. Whatever is due at the same time arrives in one email.

The emails are sent only during the day (roughly between 7 am and 9 pm), in the language of your account and only to you. They say what expires and when, with a link to the portal. Blocked accounts and admins receive no reminders. Admins can see which reminders went to whom and when, and whether one could not be delivered.

Read & Sign

After an incident, AIFS has to inform the employees concerned. For this, admins send notices in the portal (in Dutch, English or German, sometimes with attachments). You read them and confirm. Until you have confirmed all open notices, the portal shows you only those notices.

For each notice and recipient the portal stores: when you were added, whether and when you confirmed (server time), which version you saw (language and a fingerprint of the content), your name and email address at the time of confirming, and which reminders were sent and when. Once sent, a notice can no longer be changed, and a confirmation cannot be taken back.

This serves as proof that everyone concerned was informed. Admins see all notices and who has and has not confirmed, and can download the status as an Excel file. You see only the notices sent to you; a withdrawn notice only if you had already confirmed it.

If you have not confirmed, you receive an email on the day of the notice, after 3 and after 7 days. It contains only your name in the greeting and a link to the portal, no content of the notice, no names of people involved and no file names. Notices, attachments and confirmations are kept, also if your account is blocked.

Translation

What admins create themselves (names of certificate types, AIFS tests with questions and answers, training material for everyone and Read & Sign notices) is translated automatically by the portal, so that you see it in your language. For this, these texts are sent to Cloudflare Workers AI. Your own entries (certificates, test answers) and your personal data are not sent there. The translations are then stored with the other data in the database in Frankfurt.

AI suggestion for the AIFS test

After an investigated incident, admins can have the portal check whether the AIFS test should be updated. For this, the text from the incident (from AIFS SMS) and the questions and answers of the test are sent to Cloudflare Workers AI. Known names, flight number, registration and airlines are blacked out in the incident text beforehand.

The suggestion (a new or changed question, or a note that the test already covers the incident, with a short reason) is then stored in the database and is visible to admins only. An admin decides whether it is adopted; without an admin, nothing in the test changes.

Who sees what

Employees only see their own certificates, Schiphol pass, driving licence date, test attempts and notices. They never see the correct answers to the tests. AIFS admins see this for all employees, plus the team list (name, email, role, status), the reminders and, for certificates, the recognised details and notes (for example “not recognised” or “changed by hand”; they block nothing). The database enforces these rules.

On your device and in your browser

To keep you signed in, the portal stores your sign-in session and the language you last chose in the app’s storage or your browser’s storage. The session is removed when you sign out. On Android the app’s storage is excluded from backups. A certificate you open in the app stays in the app’s cache until you open the next file or restart the app. On a shared device, sign out after use.

Retention

If an admin deletes a certificate, it disappears from view and the file you provided is removed from storage; for an AIFS certificate the check page then shows “withdrawn”. The PDF of an AIFS certificate stays in storage until AIFS cleans up after the retention period.

What data

• Role: admin, supervisor or auditor.
• Reports: the template, your entries (for example flight number, registration, stand, results, comments), the photos, your name and when you started and sent the audit.

Flights from Schiphol

The start screen shows AIFS flights at Schiphol (flight number, registration, stand and times). The AIFS server fetches this data from Schiphol itself; the app requests it from the server, not from Schiphol. No data about you is sent to Schiphol in the process.

Translation

The texts of the templates that admins create (name, sections, check items and labels of text fields) are translated automatically into the languages of the app. After you send a report, your comments and the texts of your text fields are also sent to Cloudflare Workers AI and translated into English and Dutch, so that the report and the export for the airline are in one language.

Results, flight data, photos, your name and your other personal data are not sent there; so do not write names in comments. Translation happens once, on the server. The translations are stored with the report and are visible only to those who may see the report.

Who sees what

Auditors only see their own reports. Supervisors see all reports with photos and the name of the person who did the audit; they manage nothing. Admins see all reports with photos and the list of people with access to the app (name, email, role, status); they manage templates and accounts and send invitations. The database enforces these rules.

On your phone and in your browser

So that the app also works without a network, the phone holds: your sign-in (until you sign out), the active templates, the dictionary of translations, the chosen language, started audits (drafts) with their photos and sent reports still waiting for a network (outbox). A report in the outbox stays on the phone until the server has confirmed it; the app then deletes its photos. Drafts and waiting reports stay on the phone after you sign out, until you sign in again.

The app is excluded from the Android cloud backup. If you transfer data directly to a new phone (by cable or wirelessly), Android may take the app data along. If you install the app through a link, the installation file comes from a public folder at Supabase in Frankfurt. When it starts and when you open it again, the app asks Supabase whether a new version is available; as with every request, the IP address and time are processed, but the app sends no data about you.

In the web version, your sign-in, the chosen language, the dictionary and started audits are kept in the browser’s storage. The sign-in ends when you sign out; you remove the rest through the site data in your browser settings.

Camera and photos

The camera is only used when you take a photo for a check item. The app does not ask for your location. You take the photo with your phone’s camera app; whether it adds location data to the original photo depends on its settings. The app stores a reduced version without extra details such as location and uploads only that version.

The app deletes the original as soon as the photo has been saved; if the app is closed earlier, it may stay in the app’s cache until Android clears it. Some camera apps also put a copy in the phone’s gallery; your phone’s settings apply to that copy.

Exports

Admins and supervisors can export reports as PDF or Excel files. The file is created on the device and only leaves it when it is sent through the share menu, for example by email or messenger; the terms of that service apply. Only the latest export stays in the app’s cache on the device. In the web version, the PDF is created through the browser’s print dialog and the Excel file goes to the downloads folder.

Retention

Reports serve AIFS as proof towards airlines. Admins can delete individual reports with their photos. You remove what is on the phone in the Android settings for the app under “Storage” or by uninstalling the app; drafts and reports not yet sent are lost in the process. Exports that were sent are with the recipient.

What data

• Access: since when you have had access to AIFS SMS.
• Report: short title, type and severity, your name and when you reported, time, area and location, flight number, aircraft registration, description, people involved (names), supervisor, immediate measures and photos.
• Investigation: the texts of the investigation.
• Closing: who closed an incident and when.
• Addenda to a closed incident: text, photos, your name and when you added the addendum.
• History: who did what and when, for example changed a field, closed the incident or added an addendum.

Health data

A report records whether someone was injured (yes/no) and whether medical help was needed (yes/no). There are no separate fields for the nature or severity of an injury. So do not write details about injuries in the description: it is included in the AI draft. For this data, Art. 9(2)(b) GDPR applies in addition: it is processed to meet obligations under occupational safety law.

AI draft for a notice

Only admins can have a draft notice to employees created for a fully investigated incident. For this, a text is built from the incident: type, area, location, date, whether anyone was injured (yes/no), the description, what the investigation found and what applies from now on. Whether medical help was needed is not included. Known names, flight number, registration and airlines are blacked out beforehand, and the admin checks the text before it is sent to Cloudflare Workers AI. Only what AIFS SMS knows is blacked out; so do not write names in the description.

The draft is not stored in AIFS SMS. If an admin hands it over to AIFS Portal, it appears there as a Read & Sign draft; it is only sent after an admin has checked it in the portal and chosen recipients. The AI suggestion for the AIFS test also uses text from an incident (see AIFS Portal).

Who sees what

You only see your own reports, with their addenda and their history. AIFS admins see all reports with photos, investigation and addenda and manage who has access; in doing so they also see employees’ email addresses. Which notices and test suggestions were made from an incident only appears in the history that admins see. When reporting, everyone with access sees the names of colleagues, so that they can choose the people involved. The database enforces these rules.

In your browser

Drafts and reports not yet sent are kept in your browser’s storage, with reduced photos. Your sign-in and the chosen language are kept there too. Drafts and reports not yet sent stay in the browser after you sign out. The sign-in ends when you sign out; you remove everything else through the site data in your browser settings. Always sign out on a shared computer.

Camera and photos

The camera is only used when you press the button for a photo; a photo from the gallery only when you choose it, and the original there stays unchanged. AIFS SMS does not ask for your location. Photos are reduced and stored without extra details such as location and device data (EXIF); only this version is sent to the server.

Retention

Reports serve AIFS as proof. A closed incident can no longer be changed, and neither can an addendum. If your access is withdrawn, AIFS SMS is blocked for you; your reports are kept.