Privacy Policy

Last updated: 22 October 2026

This notice explains how SkyLearner Aviation Limited uses personal information about website visitors, prospective and enrolled Students, parents or guardians, instructors, and Partner School contacts. It covers our website, learning platform, training and examination-related services, bookings, payments, support and training integrity reviews. It explains your choices and rights under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025.

At a glance: We use your information to provide and administer aviation training, keep training records, take payments and protect account and assessment integrity. Your responsible training organisation can access the training information needed to oversee your course. Training records are normally retained for five years after completion or withdrawal. Optional marketing and advertising are subject to separate rules and choices. You can ask questions, exercise your rights or make a privacy complaint using the contact details below. This notice is information about our processing; accepting our Terms or continuing to use the website does not itself give consent to optional processing.

Find what you need: Contact us · Purposes and lawful bases · Account monitoring · Sharing · Cookies · Retention · Younger Students · Your rights · Complaints

1. Who is responsible and how to contact us

SkyLearner Aviation Limited, company number SC612380, is the controller where it decides why and how personal information is used.
Registered office: 48 West George Street, Glasgow, G2 1BP, United Kingdom.
Trading and privacy correspondence address: Suite 6 & 9, Carrickfergus Enterprise Building, Carrickfergus, Co. Antrim, BT38 8YF, United Kingdom.
Email: helpdesk@skylearner.co.uk — please mark privacy enquiries “Privacy”.
Telephone: +44 (0)28 9360 3606.

If a Partner School enrols you, that school is normally a separate controller for its training, enrolment, recommendations and regulatory decisions. SkyLearner may act as its processor when operating the Platform on its documented instructions, and as a separate controller for purposes SkyLearner determines, such as its own billing, security and legal obligations. The role depends on the activity. Your school’s privacy notice and any specific data-processing arrangement also apply. Contact us if you need help identifying the responsible organisation; we will help route a request where appropriate.

2. Information we collect and where it comes from

• Account and contact details: name, email, telephone, address, login credentials, account identifiers, preferences, and age or date of birth where needed for eligibility or safeguards.
• Training and assessment information: enrolment, school or group affiliation, course access, study activity and recorded time, attendance where recorded, progress, assessment attempts, answers and results, instructor feedback, training-file documents, recommendations and certificates. Identity, licence or CAA reference details are collected where relevant to the service or regulatory requirement.
• Bookings and financial records: purchases, invoices, subscriptions, payment status, transaction references, refunds, debt and correspondence about payments. Card processing is provided through payment services such as Stripe; the information needed for a particular payment is explained at checkout.
• Communications and submissions: enquiries, emails, support tickets, complaints, safety or quality reports, and files you choose to provide. If you submit a screenshot, voice note or video through support, its contents become part of your submission. Please avoid including information about other people unless necessary. We do not record telephone calls.
• Technical and usage information: IP address, browser and device information, login and session records, page and feature activity, errors and security events. Cookies and similar technologies are explained in section 9.
• Community information: profile details, posts, comments and messages you choose to contribute. The audience depends on the feature and its visibility settings; consider that audience before posting. Do not put medical, identity or confidential training information into public posts.

We obtain information directly from you; from your use of our website and Platform; from the Partner School, instructor or authorised person managing your training; and, where relevant, from payment providers, examination bodies and aviation authorities. A parent or guardian may provide information when helping a younger Student enrol. If we obtain information indirectly, we provide the relevant privacy information within the legally required period—normally within one month, or earlier at our first communication or disclosure where required—unless a specific lawful exception applies.

3. Why we use information and our lawful bases

We use only the information needed for the relevant purpose. The following bases apply according to the activity; they are not interchangeable permissions for any use:

• Answer enquiries and provide training, accounts, bookings, support and payments: steps at your request before a contract, and performance of our contract with you (Article 6(1)(b)). Where a school or another person holds the contract, our legitimate interests in providing the requested service and administering that relationship (Article 6(1)(f)) apply to our controller activities.
• Maintain required training, examination and financial records, and respond to binding lawful requirements: compliance with applicable aviation recordkeeping, tax, accounting or other legal obligations (Article 6(1)(c)). Where a record is necessary for training oversight or accountability beyond a specific legal requirement, we assess our legitimate interests under Article 6(1)(f).
• Monitor accounts, protect security and investigate training integrity concerns: our legitimate interests, and those of responsible training organisations and Students, in preventing misuse, maintaining trustworthy training records and assessments, and protecting aviation safety (Article 6(1)(f)); legal obligation applies where a specific requirement requires processing. Additional rules for sensitive information are explained in section 5.
• Handle complaints, disputes, debt and legal claims: our legitimate interests in resolving issues, recovering amounts lawfully due and establishing, exercising or defending legal rights (Article 6(1)(f)), and applicable legal obligations where relevant.
• Improve the service: our legitimate interests in understanding service performance and correcting problems (Article 6(1)(f)), using anonymous or aggregated information where possible. Optional device tracking is separately subject to PECR and consent where required.
• Send marketing and use optional analytics or advertising technologies: consent (Article 6(1)(a)) where required. For our own similar products or services, electronic marketing may use the customer “soft opt-in” only where every legal condition is met, with legitimate interests as the data-protection basis. See sections 8 and 9.

When relying on ordinary legitimate interests, we consider necessity, your reasonable expectations and the impact on your rights, including the greater protection needed for children. You may ask about the assessment and object as explained in section 12. Information needed to create an account, administer training, verify eligibility, complete a payment or meet a legal requirement may be compulsory for that service; without it, we may be unable to enrol you, provide the service or issue the relevant documentation. Optional marketing and other optional fields are not conditions of training.

4. Account monitoring and training integrity reviews

Accounts and training activity are monitored to administer learning, identify technical or security problems and detect possible misuse. Relevant data may include login/session times, IP and device information, recorded study activity, progress, assessment attempts, answers, scores and audit records. Patterns such as inconsistent recorded activity or unusual assessment behaviour can prompt review; they are indicators for investigation, not proof of dishonesty.

Where there are reasonable grounds for concern, relevant evidence may be reviewed by authorised SkyLearner staff and the Head of Training of your Responsible Training Organisation, or their formally nominated representative. Necessary information may be shared with the relevant aviation authority or another competent authority where required or otherwise lawful and proportionate. We distinguish suspicions, your explanation and established findings, consider technical errors and legitimate explanations, and limit access to those who need the information.

For the training integrity process in section 15 of our Terms & Conditions, a final adverse misconduct decision is made by the responsible person following review, rather than solely by an automated flag or AI-detection score. You can provide an explanation, challenge inaccurate information and request reconsideration through that process. Precautionary restrictions and any consequences are explained in the Terms. These Terms do not override your data protection rights or themselves authorise unrestricted sharing.

5. Health information, safeguarding and allegations of offences

If you provide health, disability or accessibility information, we limit its use to the relevant support, adjustment, eligibility or other stated purpose. This is special category information and requires both an Article 6 basis and an additional Article 9 condition. For voluntary support arrangements this may be your explicit consent (Article 9(2)(a)); information necessary for legal claims may be processed under Article 9(2)(f). If another legal condition applies, we explain it for the particular collection. Please do not send a full medical record when limited information will suffice. Withdrawing consent may affect an optional arrangement that depends on that information, but does not remove other rights or legal duties.

An allegation of fraud or another criminal offence can be criminal offence data even without a conviction. Legitimate interests alone are insufficient. Before processing such information, the responsible controller must also meet Article 10 and an applicable Data Protection Act 2018 Schedule 1 condition. Depending on the facts, this may include preventing or detecting unlawful acts under paragraph 10, where its requirements are met, or information necessary for legal claims under paragraph 33. Required safeguards, including an appropriate policy document where required, must be in place. Sharing and retention are assessed case by case; neither enrolment nor this notice is blanket consent to processing allegations.

6. Who receives information

• Authorised staff, instructors and your Responsible Training Organisation: account, learning, assessment and relevant support or integrity information needed for their role. Unrelated schools are not entitled to your training file simply because they use the Platform.
• Pressidium: website hosting and backups. Our website hosting is in the United Kingdom. This does not mean that every separate supplier or all remote support processing takes place only in the UK.
• Microsoft: email services and associated correspondence.
• QuickFile: accounting, invoicing and relevant customer and payment records.
• Payment providers, including Stripe where used: details necessary to process, authenticate and reconcile payments and handle fraud or disputes. Payment providers may also act as controllers for their own legal and payment-network duties.
• IT, support and service suppliers: suppliers supporting the learning platform, communications, security, document delivery and maintenance, to the extent needed for the service. Installation of software on our own site does not by itself mean its developer receives your data.
• Google and Meta services: website analytics, advertising and campaign measurement where enabled and lawfully used. These can receive online identifiers and website event information. See section 9 for consent and choices.
• Authorities and professional advisers: the CAA or other relevant aviation authorities, examination bodies, law enforcement where appropriate, courts, accountants, insurers and legal advisers where disclosure is required or otherwise lawful and necessary.
• A potential or actual business successor: relevant information for a lawful sale or restructuring, subject to confidentiality, necessity and continued data protection safeguards.

Suppliers acting as processors must process information on documented instructions under appropriate data-processing terms. Separate controllers have their own responsibilities and notices. Relevant supplier notices include Microsoft, QuickFile, Stripe and Google. Contact us for information about the recipients relevant to your account. Paying for a Student’s course does not automatically entitle a sponsor or parent to unrestricted access to that Student’s personal information.

7. International processing and transfers

Although our website is hosted in the UK, email, payment, analytics, advertising and support suppliers may process information in other countries, including the European Economic Area and the United States. Access by a separate overseas organisation may also be a restricted transfer. The location of a server alone does not determine all processing locations.

A restricted transfer requires an applicable UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses, together with the required data protection test or transfer risk assessment and any necessary additional measures. A narrow statutory exception may be used only where its conditions are met. The UK–US data bridge applies only where the particular US recipient and processing are covered by valid certification; it does not cover every US supplier. You can request details of the countries, recipients and transfer mechanism relevant to your information, and a copy of relevant safeguards with confidential details redacted where necessary. A supplier’s privacy policy alone is not a transfer safeguard.

8. Marketing and your right to object

You can object to direct marketing at any time, including related profiling. Use the unsubscribe option in a marketing message or email helpdesk@skylearner.co.uk. You do not need to justify your objection. We will stop the marketing covered by your objection and may retain limited suppression information to ensure your choice is respected.

Marketing emails, texts or direct messages to individuals require specific consent unless the applicable customer soft opt-in conditions are satisfied: we obtained the contact details during a sale or genuine sales discussion, market our own similar services, and offered a clear opt-out both when collecting the details and in every message. Consent must be separate from accepting the Terms or reading this notice. Necessary account, training, booking, payment, safety and regulatory messages are service communications and may continue without marketing consent; they must not be used to disguise promotional messages.

9. Cookies, analytics and advertising

Cookies, pixels, tags and similar technologies can store or access information on your device or send information about website activity. Necessary technologies support functions such as login, session security, a requested shopping basket and remembering privacy choices. Optional technologies can measure website use, attribute purchases to advertising, or support advertising audiences. Google Analytics, Google Ads/Tag Manager and Meta Pixel technologies are present on our site; what they may lawfully do depends on the purpose, configuration and your choices. Tag Manager is a delivery tool and does not itself make the tags it deploys exempt from consent.

Advertising and related tracking require prior valid consent where PECR applies. Optional analytics also require consent unless a specific statutory exception applies in full. The limited statistical exception is not a general exemption for identifying or following individual visitors, or for advertising measurement. Consent is not inferred from scrolling, continued browsing, a pre-ticked box, or acceptance of these Terms. You may refuse or withdraw optional consent without losing access to the core training service. Withdrawal does not affect processing lawfully carried out before withdrawal.

Use any cookie preference controls provided on the website to review your choices, or contact us at helpdesk@skylearner.co.uk for help withdrawing consent and for details of the technologies, providers and lifetimes relevant to your visit. Browser controls can also remove or block stored cookies, although blocking necessary cookies can prevent login or other requested functions. Deleting cookies alone does not necessarily stop future tracking or withdraw consent recorded elsewhere. Optional third-party embeds may also involve cookies and transfers; their privacy information and applicable choices should be provided when they are offered.

10. How long we keep information

• Training records: normally five years from completion of, or withdrawal from, the relevant training. This covers the necessary enrolment, progress, assessment and certification evidence, not an automatic five-year entitlement to Platform access. An applicable regulatory requirement, the responsible organisation’s lawful retention instruction, or a necessary legal hold may require a different period. We explain the applicable reason where relevant.
• Accounting and tax records: normally six years from the end of the relevant company financial year, or longer where tax law or an unresolved enquiry requires it.
• Support, enquiries and complaints: for the period needed to resolve the matter, provide relevant follow-up and maintain necessary evidence of the response. Relevant items forming part of the training record follow that record’s retention period; other items are assessed by their purpose and any applicable claim period.
• Security, technical and integrity records: for as long as needed to investigate and resolve an incident, protect the service and satisfy applicable audit, reporting or legal requirements. We consider the seriousness of the issue, evidence needed, investigation status and relevant limitation periods; an unproven allegation does not justify indefinite retention.
• Marketing: while a valid permission or other applicable basis continues and the information remains necessary; limited opt-out records may be retained to prevent unwanted contact. Cookie and supplier-held data lifetimes depend on the relevant technology and service.

When information is no longer needed, it should be securely deleted or irreversibly anonymised. Where a necessary legal or regulatory hold applies, only relevant information is retained and access remains restricted. Backup copies awaiting scheduled overwrite are kept out of ordinary use and must not be used to extend operational retention; if restored, relevant deletion and restriction instructions must be reapplied. Closing an account does not automatically erase required training or financial records. Ask us for the retention period or criteria applicable to a particular record.

11. Younger Students, parents and guardians

Students under 18 may enrol with appropriate parent or guardian involvement and applicable training eligibility safeguards. The Student’s information remains their personal information. A parent’s payment or involvement does not automatically give them unrestricted access: we consider the Student’s understanding, any authority to act, their best interests and applicable law. Where consent is the basis for an online service offered directly to a child under 13, valid parental authorisation is required. This age rule does not mean every training activity uses consent as its legal basis.

For younger Students: We keep information about your account, learning and test results so we and your training school can help you learn and check the training is completed properly. We also check account activity to keep the system safe and investigate possible cheating. You can ask what we hold, tell us something is wrong, or ask for help using your rights. Contact us using the details in section 1; you can involve a trusted adult if you want. You do not have to agree to optional marketing to study with us.

12. Your data protection rights

• Access: ask for a copy of your personal information and information about its use.
• Correction: ask us to correct inaccurate or incomplete information. A disputed training finding may need an annotation and review rather than deletion of an accurate historical record.
• Erasure and restriction: ask for deletion or restricted use where the legal conditions apply. These rights do not automatically override required training records, legal duties or necessary legal claims.
• Portability: receive qualifying information you supplied in a commonly used, machine-readable format where processing is automated and based on consent or a contract with you.
• Objection: object to processing based on legitimate interests on grounds relating to your circumstances. We must stop unless a permitted overriding ground applies. Your right to object to direct marketing is absolute.
• Withdraw consent: withdraw it at any time for consent-based processing, without affecting its prior lawfulness.
• Automated decisions: where applicable law gives safeguards for a solely automated decision with a legal or similarly significant effect, request information, make representations, contest the decision and seek human intervention. Section 4 explains human review in our misconduct process.

Contact us by email, telephone or post using section 1. No special wording or paid subscription is needed. We may ask for proportionate information to verify identity or authority to act, but should not request excessive identity documents. Rights requests are normally free and answered without undue delay and within one calendar month. Where the law permits an extension, clarification pause, fee or refusal, we will explain the reason and applicable timing; a permitted extension for complexity or number of requests can be up to two further months. If we cannot act, we explain why and your complaint rights. A privacy complaint does not suspend the separate deadline for a rights request.

13. Privacy complaints

To complain about our use of your information or our response to a rights request, contact us at helpdesk@skylearner.co.uk, by telephone or by post using section 1. Describe the concern and the outcome you are seeking; you do not need to quote legislation. Tell us if you need help or an accessible way to complain. Someone acting on your behalf may need to demonstrate their authority.

We will acknowledge a data protection complaint within 30 days, investigate and make appropriate enquiries without undue delay, keep you informed of progress, and explain the outcome and any action taken without undue delay. The acknowledgement period is not a reason to postpone investigating your complaint.

You may complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113. The ICO recommends giving us a chance to resolve the matter first, but you retain your right to approach the regulator and seek a court remedy. Where another country’s mandatory data protection law applies to your information, its applicable regulator and rights may also be available.

14. Security, AI-enabled features and changes

We use organisational and technical measures proportionate to the risks, including controlling access to account and training information. No internet service can guarantee absolute security. Please protect your login details and report suspected unauthorised access promptly. If a personal data breach occurs, applicable assessment, regulator notification and individual notification duties apply.

AI-generated content is not necessarily a decision about you. If an AI-enabled feature is offered that uses personal information, the relevant feature notice must explain the purpose, information sent, provider or recipient category, retention and any overseas processing, together with the lawful basis and applicable choices. This general notice does not grant permission to send confidential training, health or investigation information to an external AI service. Do not include such information in an optional tool unless its stated purpose and safeguards cover it. Contact us if you need to understand how a particular feature uses your information.

We review this notice when our processing or applicable law changes. Material new purposes will be brought to your attention before the new processing where required, and fresh consent obtained where necessary. Updating this notice does not retrospectively authorise an incompatible use of information. The date above identifies this version; earlier versions are available on request.