This privacy policy outlines how XLB Simulations Oy collects, uses, and protects your personal data in accordance with the General Data Protection Regulation (GDPR).
1. Who We Are
XLB Simulations Oy
Business ID: 3510522-4
Address: Linnoitustie 6, 02600 Espoo, Finland
Email: contact@xlbsimulations.com
XLB Simulations acts as the data controller for personal data processed via our website and simulator services.
2. What We Collect and Why
We may collect and process the following types of information:
- Information you provide directly:
- Name and contact details (Legal basis: consent)
- Email address for notifications or newsletter sign-up (Legal basis: consent)
- Booking and service data:
- Reservation details including dates, times, duration, and services selected (Legal basis: contract performance)
- Billing contract and invoice records (Legal basis: contract performance)
- Terms and conditions acceptance records including timestamp (Legal basis: contract performance)
- Information collected automatically:
- Website usage (via cookies and analytics tools like Google Analytics or HubSpot) (Legal basis: consent)
- IP address, browser type, and session data (Legal basis: legitimate interest)
- Facility-related data (if you are an active subscriber):
- Access logs (entry times, PIN usage) (Legal basis: legitimate interest)
- Security camera recordings (for safety, operational integrity, and security) (Legal basis: legitimate interest)
All personal data is collected only with your explicit consent or based on a legitimate interest under GDPR. You can withdraw your consent at any time by contacting us or managing your preferences through our website's settings or email links.
3. How We Use the Data
- To provide access to our services and manage membership
- To send updates, newsletters, and invitations (with opt-out option)
- To ensure safety, security, and authorized use of the simulator
- To analyze website performance and improve user experience
4. Data Storage and Protection
- Personal data we directly control (bookings, account data, simulator usage records) is stored within the EU/EEA
- Some of our processors listed in Section 5 are based outside the EEA, primarily in the United States. Where personal data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework as the legal basis for transfer
- We apply strict access control and encryption where applicable
- Camera recordings are retained for up to 30 days
- Access logs are stored for 6 months
5. Sharing and Processors
We may share limited personal data with trusted partners:
- Supabase (for user authentication and booking data storage)
- Stripe (for payment processing)
- HubSpot (for customer relationship management and email campaigns)
- Mailgun (for transactional email delivery such as login links and booking confirmations)
- Calendly (for appointment scheduling)
- Analytics providers (Google Analytics, HubSpot)
- Vercel (for website hosting and content delivery)
- Mapbox (for interactive map rendering and tile delivery on the live map and flight ideas pages; see the Mapbox Privacy Policy). Map data is partly derived from OpenStreetMap; see the OSMF Privacy Policy
We do not sell personal data.
6. Your Rights
You have the right to:
- Request access to your data
- Request correction or deletion
- Withdraw consent at any time
- Object to the processing of your data based on legitimate interest
- Request data portability
- Lodge a complaint with a data protection authority
You can update your email or cookie preferences at any time by following the relevant links in our emails or accessing the cookie preferences section of our website.
Requests can be submitted to contact@xlbsimulations.com
7. Cookie Use
We use essential and optional cookies. Analytics and marketing cookies are only set with your consent. You can manage preferences via our cookie banner or browser settings.
8. Policy Updates
We may update this policy from time to time. The latest version will always be available on our website.
Last updated: April 2026