Privacy notice.
How we handle personal data — on this website and on our training platform, training.cofa.aero. Short version: we store what is needed to deliver training and issue certificates, it stays on servers within the EU, your employer only ever sees its own staff, and nothing is sold or used for marketing.
Who we are
cofa.aero and training.cofa.aero are operated by CofA BV, Nieuwpoortsesteenweg 943, 8400 Ostend, Belgium, VAT BE 1028.511.982 ("CofA", "we"). For anything related to your personal data, contact info@cofa.aero.
This website
cofa.aero is an informational site. It sets no cookies and uses no analytics, tracking or advertising.
If you use the contact form, we receive what you enter — name, company, e-mail address, phone number and your message. It is delivered to our mailbox as e-mail and used only to answer you; we keep it as ordinary business correspondence.
The training platform
On training.cofa.aero we store:
- Account details: your name, e-mail address, preferred language and any optional profile fields you fill in yourself.
- Training records: enrolments, progress, attempts and scores on tests and exercises, course completions, and issued certificates (your name, the course, the date and a unique verification code).
- Technical logs: activity log entries with IP address and timestamps, kept for security and for evidencing training activity.
The platform uses only the functional cookies needed to keep you signed in. We use this data to give you access to the training that you or your employer arranged (performance of a contract), to issue certificates and keep the training records that you or your employer may need to demonstrate compliance to aviation authorities under EASA regulations (legitimate interest and, for your employer, legal obligations), to keep the platform secure (legitimate interest), and to remind you by e-mail when one of your certificates is about to expire, so that you can arrange recurrent training before it lapses — such a reminder names the follow-up course that renews the qualification (legitimate interest). We do not sell your data and we make no automated decisions about you. The only e-mails we send concern your account, your courses and expiring certificates; we send no newsletters or advertising.
Who can see your data: CofA staff who deliver the trainings and administer the platform; if your employer booked the training, the designated contact at your employer, who sees the progress, results and certificates of the employer's own staff only; and aviation authorities, who receive training records via your employer during audits or from us when we are legally required to provide them. There are no other recipients.
Where your employer has concluded a data processing agreement with us, your employer decides on your training record (enrolments, progress, results and certificates) and we keep it on your employer's behalf. We remain responsible for your account, the security of the platform and its technical logs.
The same notice is shown on the platform itself and accepted at first sign-in — see the current policies.
Where your data is kept, and how it is protected
All data is stored on servers within the European Union (hosted by Hetzner in Finland). Connections are encrypted (TLS). Our administrative tools are reachable only through a private network, and our internal partner portal only after sign-in with a one-time code. Backups are made daily to a secured CofA system in Belgium and rotate automatically: no backup copy is older than about five weeks.
Access from outside the EU
Your data is stored inside the European Union, but three of our providers may access or process it from outside:
- Zoho, which provides our mailboxes, may allow its group companies in India to access data for support and debugging. This is set out in our data processing agreement with Zoho Corporation B.V. (Netherlands).
- Brevo, which sends the platform's e-mails and the messages from our contact form, may use group companies outside the EU, notably in the United States and India, for support and maintenance.
- Cloudflare, Inc. (United States), which hosts this website and provides the sign-in and the secure connection for our internal partner portal, where CofA staff follow training progress and results, may process data outside the EU.
These transfers take place under the safeguards in each provider's data processing terms, such as the European Commission's standard contractual clauses.
Service providers
We use a small number of providers that process data on our behalf, under EU data processing terms: Hetzner Online GmbH (hosting of the training platform, Germany/Finland), Brevo — Sendinblue SAS (e-mail delivery for the platform and the contact form, France), Zoho Corporation (our mailboxes, EU datacentres) and Cloudflare, Inc. (DNS and hosting of this website, and the sign-in and secure connection for our internal partner portal).
How long we keep it
- Training records and certificates: five years after course completion — the audit trail that aviation regulation expects. Longer only where your employer's contract requires it.
- Account details: for as long as your account is active; removed on request.
- Backups: rotate automatically; the oldest copy is about five weeks old.
- Contact-form messages: kept as ordinary business e-mail.
Your rights
Under the GDPR you can request access to (and an export of) your data, have it corrected, object to or restrict processing, and ask for erasure. Platform users can do this from their profile (Privacy and policies → Data requests); for anything else, e-mail info@cofa.aero. Training records and certificates that form part of the regulatory audit trail may need to be retained for the period above even if you ask for erasure. You can also lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be) or the supervisory authority of your own EU country.
Changes to this notice
Updates are published on this page; platform users are asked to agree to the new version at their next sign-in. Version: 4 October 2026.