Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Pilot-Next Terms of Service (the “Terms”). It applies between:

• the Customer: the flying club, school or other organisation that uses Pilot-Next under the Terms, as controller; and
• Now-Next, Parkweg 208, 2271 BE Voorburg, the Netherlands, Chamber of Commerce no. 72975652, as processor.

The Customer accepts this DPA together with the Terms. On request, Now-Next will sign a copy with the Customer; the text stays the same.

This DPA covers the personal data that the Customer keeps in Pilot-Next about its members, pilots, instructors and staff. It does not cover the data Now-Next processes as a controller for its own purposes, such as the Customer’s own subscription, billing and the pilot-next.com website; those are described in the Privacy Policy.

1. Subject matter, nature and purpose

1. Now-Next processes personal data on behalf of the Customer only to provide Pilot-Next, namely:
   • keeping the member administration of the Customer;
   • aircraft bookings, scheduling and availability;
   • flight logs, aircraft hours and maintenance planning;
   • member accounts, balances, invoices and payment reminders;
   • sending e-mails and calendar invitations that the Customer's use of Pilot-Next triggers;
   • transferring invoices and related member data to the Customer's own Exact Online administration, if the Customer connects it;
   • backups, troubleshooting and security of the service.
2. Now-Next does not use the data for its own purposes. It does not sell the data, does not use it for advertising and does not use it to train AI models.

2. Categories of data and data subjects

1. Data subjects: the members, pilots, students, instructors, staff and other users the Customer registers in Pilot-Next.
2. Categories of personal data:
   • name, e-mail address, telephone number and other contact details;
   • login data, roles and access logs (including IP addresses);
   • bookings, flight logs, flight times and aircraft used;
   • account balances, invoices and payment status.
3. Pilot-Next is not designed for special categories of personal data (such as medical data). The Customer will not store such data in free-text fields.

3. Duration

This DPA applies for as long as Now-Next processes personal data on behalf of the Customer, including the period after the end of the subscription until deletion (Section 10).

4. Instructions

1. Now-Next processes the data only on documented instructions from the Customer, including with regard to transfers to a country outside the European Economic Area. The Terms, this DPA and the way the Customer uses and configures Pilot-Next together constitute those instructions.
2. If Union or Member State law requires Now-Next to process the data otherwise, it will inform the Customer before processing, unless that law prohibits this.
3. If Now-Next believes that an instruction infringes data protection law, it will inform the Customer immediately.

5. Confidentiality

Everyone who can access the data on behalf of Now-Next is bound by confidentiality. Now-Next only looks at the Customer’s data where needed for support the Customer asks for, to fix a fault, or to monitor security.

6. Security

Now-Next takes appropriate technical and organisational measures as referred to in Article 32 GDPR, taking into account the state of the art, the costs and the risks. As of the date of this version these include:

• Separation between customers. Each club’s data is logically separated and access is limited to that club’s users and roles.
• Encryption in transit. All connections are encrypted (HTTPS/TLS).
• Access control. Users only see what their role allows; administrative actions are restricted to club administrators.
• Hosting in the EU. The application and database run in Frankfurt (Germany) and files are stored in Stockholm (Sweden).
• Backups. The database is backed up by the hosting provider.

Now-Next may change these measures as long as the level of security does not decrease.

7. Sub-processors

1. The Customer gives Now-Next general authorisation to engage sub-processors. Now-Next imposes on them data protection obligations that are at least equivalent to those in this DPA, and remains fully liable to the Customer for their performance.
2. As of the date of this version these are:

3. Transfers outside the European Economic Area only take place with an appropriate safeguard: an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or the European Commission’s Standard Contractual Clauses.
4. Before adding or replacing a sub-processor, Now-Next will give at least 30 days’ notice by e-mail and on pilot-next.com/dpa. The Customer may object on reasonable grounds within that period. If the parties cannot agree, the Customer may terminate its subscription with effect from the date of the change and will receive a refund of any amount paid in advance for the period after that date.

Not sub-processors: Exact Online, which processes data under the Customer’s own agreement with Exact when the Customer connects it; AI assistants a user connects to Pilot-Next (via MCP), which read data with that user’s own login under the user’s own agreement with its provider; and Stripe, which only processes the Customer’s own subscription and not member data.

8. Data subject rights

1. If a data subject makes a request about their own data (access, rectification, erasure, restriction, portability or objection), Now-Next assists the Customer where reasonable. Much of this the Customer can do itself in Pilot-Next.
2. If such a request reaches Now-Next, it forwards it to the Customer and does not answer it itself.

9. Personal data breaches

1. If Now-Next becomes aware of a breach of security affecting the Customer’s personal data, it notifies the Customer without undue delay and no later than 36 hours after becoming aware of it.
2. The notification contains what Now-Next knows at that moment: what happened, which data and how many people are likely affected, the likely consequences, and the measures taken or proposed. Further information follows as soon as it is available.
3. The Customer decides whether to notify the supervisory authority and the data subjects. Now-Next does not notify a breach of the Customer’s data itself unless the Customer asks it to or the law requires it.
4. Now-Next keeps a record of all breaches, including those that did not need to be notified.

10. End: return and deletion

1. For 30 days after the end of the subscription the Customer can export its data.
2. No later than 30 days after that, Now-Next deletes the Customer’s personal data. Copies in backups are deleted in the normal backup cycle, no later than 30 days after that.
3. If the law requires Now-Next to keep certain data for longer, it keeps that data only for that legal purpose.

11. Assistance, information and audits

1. Now-Next assists the Customer where reasonable with a data protection impact assessment, a prior consultation and questions from the supervisory authority (Articles 32 to 36 GDPR).
2. On request, Now-Next provides the Customer with the information needed to demonstrate compliance with this DPA.
3. Audit. Once a year, or more often if there is a serious indication that Now-Next does not comply with this DPA, the Customer may have an audit carried out by an independent expert bound by confidentiality. The Customer gives at least 30 days’ notice. The audit must not disrupt the service or affect the data of other customers. The Customer bears the costs, unless the audit reveals a material failure by Now-Next.

12. Liability

The limitation of liability in the Terms applies to this DPA. A fine imposed by a supervisory authority is borne by the party to whom the infringement is attributable.

13. Precedence and governing law

1. If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.
2. This DPA is governed by the laws of the Netherlands. Any dispute is submitted to the competent court in The Hague, the Netherlands.