GDPR Compliance

Our Commitment to GDPR

Passion Highway, Inc. ("Company," "we," "us," or "our") is committed to protecting the privacy and security of personal data for all users of our Services, including those in the European Economic Area (EEA), United Kingdom, and Switzerland. AviatorDB and AirplaneID are service marks of Passion Highway, Inc.

This page explains how we comply with the General Data Protection Regulation (GDPR) and outlines your rights under this regulation.

Data Controller

Passion Highway, Inc. is the data controller for personal data collected through the AviatorDB website and AirplaneID mobile application. This means we determine the purposes and means of processing your personal data.

Legal Basis for Processing

Under the GDPR, we must have a legal basis for processing your personal data. We rely on the following legal bases:

• Contract Performance: Processing necessary to provide you with our Services and fulfill our contractual obligations to you, such as managing your account and processing subscriptions.
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our Services, preventing fraud, and ensuring security, where these interests are not overridden by your rights.
• Consent: Where you have given explicit consent for specific processing activities, such as receiving marketing communications.
• Legal Obligation: Processing necessary to comply with legal requirements to which we are subject.

Your Rights Under GDPR

If you are located in the EEA, UK, or Switzerland, you have certain rights regarding your personal data:

Right of Access

You have the right to request access to your personal data and to receive a copy of the personal data we hold about you.

Right to Rectification

You have the right to request that we correct any inaccurate personal data or complete any incomplete personal data we hold about you.

Right to Erasure ("Right to be Forgotten")

You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of your data.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority in your country of residence if you believe that our processing of your personal data violates the GDPR.

International Data Transfers

As we are based in the United States, your personal data may be transferred to and processed in the United States or other countries outside the EEA. When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place to protect your data, including:

• Standard Contractual Clauses approved by the European Commission
• Binding Corporate Rules where applicable
• Other legally recognized transfer mechanisms

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. When determining retention periods, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements.

Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include encryption, access controls, secure hosting infrastructure, and regular security assessments.

Your Data, Your Control

Consistent with our Privacy Policy, we want to emphasize our commitment to your data rights:

• We do not sell your personal data. Under no circumstances do we sell your information to third parties.
• We do not use your uploads for AI training. Content you upload to our platform is never used to train artificial intelligence models.
• Your activity remains private. Your activity on our platform is never shared with third parties except as required by law.

Exercising Your Rights

To exercise any of your rights under the GDPR, or if you have any questions about our data protection practices, please contact us at:

We will respond to your request within one month, as required by the GDPR. In complex cases, we may extend this period by up to two additional months, but we will inform you of any such extension within the initial one-month period.

Updates to This Policy

We may update this GDPR compliance information from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this page. We encourage you to review this page periodically.