PRIVACY POLICY

This privacy policy outlines how XLB Simulations Oy collects, uses, and protects your personal data in accordance with the General Data Protection Regulation (GDPR).

1. Who We Are

XLB Simulations Oy
Business ID: 3510522-4
Address: Linnoitustie 6, 02600 Espoo, Finland
Email: contact@xlbsimulations.com

XLB Simulations acts as the data controller for personal data processed via our website and simulator services.

2. What We Collect and Why

We may collect and process the following types of information:

• Information you provide directly:
  • Name and contact details (Legal basis: consent)
  • Email address for notifications or newsletter sign-up (Legal basis: consent)
• Booking and service data:
  • Reservation details including dates, times, duration, and services selected (Legal basis: contract performance)
  • Billing contract and invoice records (Legal basis: contract performance)
  • Terms and conditions acceptance records including timestamp (Legal basis: contract performance)
• Information collected automatically:
  • Website usage via Google Analytics, only if you accept analytics cookies (Legal basis: consent). Nothing is sent to Google Analytics before you accept
  • IP address, browser type, and session data (Legal basis: legitimate interest)
  • Cookie choices (Accept Analytics or Only Necessary) and how often the cookie banner is shown, as anonymous daily counts with no identifier, so we know how many visitors accept analytics and how often no choice is made (Legal basis: legitimate interest)
  • Bot- and abuse-protection signals when submitting our forms, via Cloudflare Turnstile (Legal basis: legitimate interest)
• Facility-related data (if you are an active subscriber):
  • Access logs (entry times, PIN usage) (Legal basis: legitimate interest)
  • Security camera recordings (for safety, operational integrity, and security) (Legal basis: legitimate interest)

All personal data is collected only with your explicit consent or based on a legitimate interest under GDPR. You can withdraw your consent at any time by contacting us or managing your preferences through our website's settings or email links.

3. How We Use the Data

• To provide access to our services and manage membership
• To send updates, newsletters, and invitations (with opt-out option)
• To ensure safety, security, and authorized use of the simulator
• To analyze website performance and improve user experience

4. Data Storage and Protection

• Personal data we directly control (bookings, account data, simulator usage records) is stored within the EU/EEA
• Some of our processors listed in Section 5 are based outside the EEA, primarily in the United States. Where personal data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework as the legal basis for transfer
• We apply strict access control and encryption where applicable
• Camera recordings are retained for up to 30 days
• Access logs are stored for 6 months
• Google Analytics keeps user- and event-level data for 14 months and then deletes it automatically. Google Analytics does not store IP addresses

5. Sharing and Processors

We may share limited personal data with trusted partners:

• Supabase (for user authentication, booking data storage and the anonymous cookie banner tally)
• Stripe (for payment processing)
• Mailgun (for transactional email delivery such as login links and booking confirmations)
• Analytics providers (Google Analytics)
• Vercel (for website hosting and content delivery)
• Cloudflare (Turnstile — bot and abuse protection on our web forms; processes IP address and browser signals to distinguish human users from automated traffic; see the Turnstile Privacy Policy)
• Mapbox (for interactive map rendering and tile delivery on the live map page; see the Mapbox Privacy Policy). Map data is partly derived from OpenStreetMap; see the OSMF Privacy Policy

We do not sell personal data.

6. Your Rights

You have the right to:

• Request access to your data
• Request correction or deletion
• Withdraw consent at any time
• Object to the processing of your data based on legitimate interest
• Request data portability
• Lodge a complaint with a data protection authority

You can update your email or cookie preferences at any time by following the relevant links in our emails or accessing the cookie preferences section of our website.

Requests can be submitted to contact@xlbsimulations.com

7. Cookie Use

We use necessary cookies, which the site needs to work, and analytics cookies, which are set only if you accept them. Google Analytics is not loaded at all until you accept. If you later withdraw your consent, we stop analytics and delete its cookies. Visitor-level data is deleted when its 14-month retention ends. You can change your choice at any time with the button below or in your browser settings. The same choice applies on xlbsimulations.com and pilots.xlbsimulations.com.

Videos in our logbook load from YouTube (youtube-nocookie.com) only when you press play. YouTube may then store data on your device under its own privacy policy.

Update Cookie Preferences

8. Policy Updates

We may update this policy from time to time. The latest version will always be available on our website.

Last updated: November 2026