Privacy Policy

1. Introduction

Aero Leadership respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect personal data when you:

• Visit the Aero Leadership website;
• Create an account;
• Purchase or access an Aero Leadership course;
• Subscribe to our newsletter;
• Contact us;
• Interact with our advertisements; or
• Otherwise use our website, course platform, videos or related services.

This Privacy Policy also explains your rights under the European Union General Data Protection Regulation, or GDPR, the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights, and other applicable privacy and electronic- communications laws.

2. Who is responsible for your personal data?

The data controller responsible for the processing described in this Privacy Policy is: Aero Leadership Carrer de Gertrude Stein 1, 2-2B 07004 Palma, Spain Email: hello@aeroleadership.com In this Privacy Policy, “Aero Leadership”, “we”, “us” and “our” refer to the business operating the Aero Leadership website, courses and related services. Aero Leadership has not appointed a Data Protection Officer. Questions or requests concerning personal data may be sent to hello@aeroleadership.com.

3. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed through:

• The Aero Leadership website;

• User registration and account functions;
• The Aero Leadership newsletter;
• Course purchases;
• Course accounts and course participation;
• Embedded course videos;
• Customer-support communications;
• Analytics and website-performance tools;
• Advertising measurement and audience tools; and
• Multi-seat licences and organizational purchases.

This Privacy Policy does not govern websites or services operated independently by third parties. Those third parties may process personal data under their own privacy notices.

4. Personal data we collect

The information we collect depends on how you interact with Aero Leadership.

4.1 Information you provide directly

We may collect:

• First and last name;
• Email address;
• Account username or identifier;
• Password or authentication credentials;
• Billing address;
• Country or region;
• Company or organization name;
• Tax or VAT identification number;
• Information provided during checkout;
• Newsletter preferences;
• Marketing consent;
• Questions, comments and correspondence;
• Support requests;
• Survey and feedback responses; and
• Any other information you voluntarily provide.

Passwords and authentication credentials are handled through the relevant platform and should be stored in protected or encrypted form. Aero Leadership does not need access to your password in plain text.

4.2 Purchase and transaction information

When you purchase a course or licence, we may process:

• The product or course purchased;
• Purchase date;
• Transaction reference;
• Price, currency and discount applied;
• Billing information;
• Payment status;
• Refund or dispute information;
• Invoice information;
• Coupon or affiliate code;
• Organization or licence information; and
• Other records required for accounting, taxation and legal compliance.

Payments are processed by Stripe. Aero Leadership does not normally receive or store your complete payment-card number, card security code or full bank-account credentials. Stripe processes payment details according to its own privacy documentation and security requirements.

4.3 Course activity and account information

When you create an account or participate in a course, we may collect:

• Account registration date;
• Courses available to your account;
• Course progress;
• Modules, chapters or lessons accessed;
• Video progress or completion;
• Dates and times of course activity;
• Quiz or assessment results, where applicable;
• Certificates or completion records;
• Account status;
• Length of course access;
• Login history;
• Course feedback;
• Technical support history; and
• Actions necessary to administer a multi-seat licence.

We may use this information to deliver the program, track progress, maintain course access, improve the learning experience and update the program.

4.4 Technical and usage information

When you visit or use our website or course services, we and our service providers may collect:

• Internet Protocol address;
• Browser type and version;
• Device type;
• Operating system;
• Approximate location derived from an IP address;
• Language and time-zone settings;
• Referring website or campaign;
• Pages visited;
• Links and buttons selected;
• Date, time and duration of visits;
• Cookie identifiers;
• Advertising identifiers;
• Login and security records;
• Error reports; and
• Other technical information about how the services are used.

4.5 Communications

When you contact Aero Leadership, we may collect:

• Your name and email address;
• The content of your message;
• Attached documents or information;
• The date and time of the communication;
• Our response;
• Records of support provided; and
• Any follow-up correspondence.

Email communications are received and managed using Zoho Mail.

4.6 Newsletter information

When you subscribe to our newsletter, we may collect:

• Name, where requested;
• Email address;
• Date and method of subscription;
• Consent record;

• Newsletter preferences;
• Emails delivered;
• Email opens and link interactions, where enabled;
• Unsubscribe requests; and
• Information necessary to demonstrate or manage your consent.

Our newsletter and email-marketing services are provided through SendFox.

4.7 Cookie, analytics and advertising information

Subject to your cookie choices, we may use Google Analytics and the Meta Pixel to collect information about:

• Website visits;
• Page views;
• Referral sources;
• Campaign performance;
• Website interactions;
• Browser and device information;
• Conversion events;
• Purchases or registrations;
• Advertising effectiveness; and
• Audiences that may be interested in Aero Leadership services.

Google Analytics cookies and Meta Pixel technologies are non-essential technologies. Where consent is legally required, they will not be activated until you have given your consent through the cookie banner. You will be offered the ability to:

• Accept non-essential cookies;
• Reject non-essential cookies; and
• Customize your cookie preferences.

You may later withdraw or change your consent through the cookie-preference tool available on the website. More information will be provided in our Cookie Policy.

5. How we use personal data

We may use personal data for the following purposes.

5.1 Providing the website and courses

We use personal data to:

• Create and manage accounts;
• Authenticate users;
• Process course registrations;
• Provide access to purchased content;
• Deliver videos and course materials;
• Track course progress;
• Maintain course availability;
• Administer multi-seat licences;
• Issue completion records or certificates;
• Provide customer support; and
• Communicate important service information.

5.2 Processing purchases

We use personal data to:

• Process orders and payments;
• Confirm purchases;
• Apply coupons or discounts;
• Administer affiliate attribution;
• Create invoices;
• Manage payment disputes;
• Prevent fraudulent transactions;
• Maintain financial records; and
• Comply with accounting and tax obligations.

5.3 Improving the website and program

We may use personal data and usage information to:

• Understand how users interact with the website and courses;
• Identify technical problems;
• Improve navigation and accessibility;
• Improve the learning experience;
• Update course content;
• Develop new lessons or services;
• Analyze course engagement and completion;
• Evaluate the effectiveness of communications;

• Conduct internal reporting; and
• Protect the reliability and security of our systems.

Where possible, we use aggregated or de-identified information for analysis and improvement.

5.4 Communications and customer support

We use contact and communication information to:

• Respond to questions;
• Resolve technical problems;
• Manage complaints;
• Provide information about purchases or accounts;
• Send administrative and security messages; and
• Maintain a record of our communications.

5.5 Newsletter and marketing

With your consent, we may use your email address to send:

• Course-launch notifications;
• Discount codes;
• Important course announcements;
• Educational content;
• News about Aero Leadership; and
• Relevant promotional communications.

You may withdraw your marketing consent at any time by using the unsubscribe link in an email or contacting hello@aeroleadership.com. Withdrawing consent will not affect the lawfulness of processing carried out before consent was withdrawn.

5.6 Analytics

With your consent, we may use Google Analytics to:

• Measure website traffic;
• Understand which pages are visited;
• Evaluate website performance;
• Identify how visitors find our website;
• Measure registrations and purchases; and
• Improve the website and user experience.

5.7 Advertising measurement

With your consent, we may use the Meta Pixel to:

• Measure the performance of advertising campaigns;
• Understand whether advertisements result in website visits, registrations or purchases;
• Create or refine advertising audiences;
• Limit or improve the relevance of advertising; and
• Produce aggregated campaign reports.

Meta may process information collected through the Meta Pixel for its own purposes in accordance with its privacy documentation and applicable arrangements with website operators.

5.8 Security and legal compliance

We may process personal data to:

• Protect accounts and systems;
• Detect misuse, fraud or unauthorized access;
• Enforce our Terms of Service;
• Establish, exercise or defend legal claims;
• Respond to lawful requests from public authorities;
• Comply with tax, accounting and consumer-law requirements; and
• Meet other legal obligations.

6. Legal bases for processing

Under the GDPR, we must have a lawful basis for each processing activity.

6.1 Performance of a contract

We rely on the necessity of performing a contract, or taking steps at your request before entering into a contract, when we process personal data to:

• Create and administer your account;
• Process your course purchase;
• Provide course access;
• Track your progress;
• Deliver purchased content;
• Manage a multi-seat licence;
• Provide customer support connected to your purchase; and
• Communicate about the service you requested.

Without certain information, we may be unable to create an account, process a purchase or provide course access.

6.2 Legal obligations

We process personal data when necessary to comply with legal obligations, including:

• Accounting requirements;
• Tax requirements;
• Invoicing obligations;
• Consumer-protection requirements;
• Fraud-prevention obligations;
• Responses to legally valid public-authority requests; and
• The establishment and retention of legally required business records.

6.3 Consent

We rely on consent for activities including:

• Sending newsletter and promotional emails;
• Placing non-essential analytics cookies;
• Activating Google Analytics;
• Activating the Meta Pixel;
• Using advertising or behavioural-measurement technologies; and
• Other optional processing clearly presented as consent-based.

You may refuse or withdraw consent without losing access to essential website functions or content you have purchased.

6.4 Legitimate interests

Where permitted, we may rely on our legitimate interests to:

• Maintain the security of our services;
• Prevent fraud and misuse;
• Respond to general enquiries;
• Maintain ordinary business correspondence;
• Improve essential website functionality;
• Understand service problems;
• Protect our legal rights;
• Keep limited records of consent and opt-out requests; and
• Operate and improve Aero Leadership in a proportionate manner.

Before relying on legitimate interests, we consider whether our interests are overridden by your rights and reasonable expectations. We do not rely on legitimate interests to place non-essential analytics or advertising cookies where consent is required.

6.5 Legal claims

Where necessary, personal data may be retained or processed for the establishment, exercise or defence of legal claims.

7. Cookies and similar technologies

Cookies are small files or similar technologies stored on or accessed through a device. We may use the following categories of cookies.

7.1 Strictly necessary cookies

These cookies are required for functions such as:

• Website security;
• Account login;
• Session management;
• Shopping or checkout functions;
• Course access;
• Cookie-preference storage; and
• Other services explicitly requested by the user.

Strictly necessary cookies do not require consent where they are essential to provide the requested service.

7.2 Analytics cookies

With your consent, analytics cookies help us understand website use and performance. These may include Google Analytics cookies.

7.3 Advertising and measurement cookies

With your consent, advertising technologies may measure campaign performance and user interactions. These may include the Meta Pixel.

7.4 Cookie choices

When you first visit the website, you will be able to accept, reject or customize non- essential cookie categories.

Rejecting non-essential cookies will not prevent you from accessing the basic website or a course you have purchased, although some optional features or personalization may be unavailable. Consent may be changed or withdrawn through the website’s cookie-preference settings. Additional information about individual cookies, their purposes, providers and duration will be included in our Cookie Policy and cookie-preference tool.

8. When we disclose personal data

Aero Leadership does not sell personal data. We also do not disclose personal data to third parties for their independent direct- marketing purposes merely in exchange for payment. However, we must disclose limited personal data to carefully selected service providers where necessary to operate our website, process payments, deliver courses, send requested communications and measure performance. These providers may include the following.

8.1 Lovable

Lovable is used in connection with the creation, hosting, deployment or operation of the main Aero Leadership website. Depending on the website configuration, Lovable and its infrastructure providers may process technical information, form submissions, IP addresses and website interactions.

8.2 OnlineCourseHost

OnlineCourseHost is used to host and deliver Aero Leadership courses. It may process account information, login details, course enrolment, course access, progress information and other information required to operate the learning platform.

8.3 Bunny Stream

Bunny Stream, provided through bunny.net services, is used to host and deliver course videos embedded within OnlineCourseHost. It may process technical information necessary to deliver video content, such as IP address, device information, video requests and playback data.

8.4 Stripe

Stripe processes payments and may process:

• Name;

• Email address;
• Billing address;
• Payment-card or payment-method information;
• Transaction details;
• Device and security information; and
• Fraud-prevention information.

Stripe may act as a processor or an independent controller for certain processing activities, depending on the nature of the service and applicable law.

8.5 SendFox

SendFox is used to manage newsletter subscriptions and email-marketing communications. SendFox may process names, email addresses, subscription records, marketing preferences, delivery data and email-engagement information.

8.6 Google Analytics

With your consent, Google Analytics may process cookie identifiers, device information, IP-derived information, website interactions and analytics events. Google may process some information as an independent controller according to its own terms and privacy documentation.

8.7 Meta Pixel

With your consent, Meta may receive information about website visits and selected events, together with technical identifiers and device or browser information. Meta may use this information in accordance with its own privacy documentation and the applicable arrangements governing Meta business tools.

8.8 Zoho Mail

Zoho Mail is used to receive, store and respond to email communications. Zoho may process contact details, message content, attachments and email metadata.

8.9 Professional advisers and authorities

We may also disclose information when reasonably necessary to:

• Accountants;
• Tax advisers;
• Lawyers;
• Insurers;

• Auditors;
• Banks or payment-related institutions;
• Courts;
• Law-enforcement bodies;
• Tax authorities;
• Consumer-protection authorities; or
• Other competent public authorities.

Such disclosure will be limited to what is necessary and must have an appropriate legal basis.

8.10 Business changes

If Aero Leadership is reorganized, sold, merged or transferred, personal data may be disclosed to professional advisers and potential or actual successors where legally permitted and subject to appropriate confidentiality and data-protection safeguards.

9. International data transfers

Some of our service providers or their subprocessors may be located outside Spain or the European Economic Area, or may process personal data from countries outside the European Economic Area. Where personal data are transferred internationally, we will take reasonable steps to ensure that a lawful transfer mechanism and appropriate safeguards are used. Depending on the recipient and destination, these safeguards may include:

• An adequacy decision adopted by the European Commission;
• Participation in an approved data-transfer framework;
• European Commission Standard Contractual Clauses;
• Contractual, organizational and technical protections;
• Supplementary security measures; or
• Another transfer mechanism permitted under the GDPR.

No international transfer method can eliminate every risk. However, we expect our service providers to use safeguards appropriate to the nature of the information and the applicable legal requirements. You may contact hello@aeroleadership.com for more information about the safeguards used for a relevant transfer.

10. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including legal, accounting, tax, security and dispute- resolution requirements. The following general periods apply.

10.1 Account information

Account and course information will generally be retained while the account remains active. An account may remain in place until the user requests deletion, subject to:

• Legally required retention periods;
• Payment and accounting records;
• Fraud-prevention needs;
• Unresolved disputes;
• Legal claims; and
• Information that must be retained to record an opt-out or prior transaction.

Course access may expire under the applicable purchase terms even when limited account records remain stored.

10.2 Purchase and billing records

Invoices, transaction records and other business documentation may be retained for at least six years, or longer where another legal obligation, audit, dispute or legal claim requires it. Payment providers may apply their own legally required retention periods.

10.3 Course-progress information

Course-progress information may be retained while the account exists and for a reasonable period afterwards where necessary to:

• Confirm completion;
• Restore an account;
• Resolve an access dispute;
• Maintain organizational training records; or
• Establish, exercise or defend a legal claim.

Where an account is deleted and no lawful retention reason remains, course-progress information will be deleted or anonymized.

10.4 Analytics information

Analytics information will generally be retained for between 14 and 26 months, depending on the configuration of the analytics service. Aggregated or anonymized statistics that can no longer reasonably identify a person may be retained for longer.

10.5 Marketing information

Newsletter information will normally be retained until you unsubscribe or withdraw consent. After an unsubscribe request, we may retain limited information, such as the email address and opt-out date, on a suppression list to ensure that we respect the request.

10.6 Communications

Customer-support and ordinary business communications may be retained for as long as necessary to respond to the enquiry and for a reasonable period afterwards. Communications connected with a transaction, complaint or legal claim may be retained for the applicable legal limitation period.

10.7 Cookie-consent records

Records of cookie or marketing consent may be retained for as long as reasonably necessary to demonstrate compliance and manage your preferences.

11. Account deletion

You may request deletion of your Aero Leadership account by contacting hello@aeroleadership.com. Deleting an account may result in the permanent loss of:

• Course access;
• Course progress;
• Completion records;
• Saved preferences; and
• Other account-related information.

Account deletion does not necessarily require the deletion of information that Aero Leadership must retain for legal, accounting, fraud-prevention, dispute-resolution or legal- claims purposes. Where information must be retained, it will be restricted to the relevant purpose and deleted or anonymized when that reason no longer applies.

12. Your data-protection rights

Subject to applicable conditions and exceptions, you may have the following rights.

12.1 Right of access

You may ask whether we process your personal data and request a copy of that data.

12.2 Right to rectification

You may ask us to correct inaccurate personal data or complete incomplete information.

12.3 Right to erasure

You may ask us to delete personal data where there is no longer a lawful reason to retain it. This right is not absolute. We may retain information where necessary to comply with a legal obligation or establish, exercise or defend legal claims.

12.4 Right to restriction

You may ask us to restrict processing in certain circumstances, including while the accuracy or lawfulness of processing is being assessed.

12.5 Right to data portability

Where processing is based on consent or a contract and is performed by automated means, you may request relevant personal data in a structured, commonly used and machine-readable format. Where technically feasible, you may also request that it be transferred directly to another controller.

12.6 Right to object

You may object to processing based on legitimate interests. We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is necessary for legal claims. You may object to direct marketing at any time. Where you object to direct marketing, we will stop using your personal data for that purpose.

12.7 Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

12.8 Rights relating to automated decisions

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, except where permitted by applicable law and subject to appropriate safeguards. Aero Leadership does not currently use personal data to make solely automated decisions that produce legal or similarly significant effects concerning users. Analytics, advertising measurement and course-progress tracking do not themselves determine a person’s legal rights.

12.9 Right to lodge a complaint

You have the right to lodge a complaint with a competent data-protection supervisory authority. In Spain, the relevant authority is the Agencia Española de Protección de Datos, or AEPD. You may also be entitled to complain to the supervisory authority in the European Union or European Economic Area country where you live, work or believe an infringement occurred.

13. How to exercise your rights

To exercise a data-protection right, contact: Email: hello@aeroleadership.com Please clearly describe:

• Which right you wish to exercise;
• The account or email address involved;
• The information or processing concerned; and
• Any details that will help us identify the relevant records.

We may request reasonable information to verify your identity before responding. This protects personal data from unauthorized access or deletion. We will respond within the period required by applicable law. Under the GDPR, this will ordinarily be within one month, although the period may be extended where a request is complex or multiple requests have been made. Exercising your rights is normally free of charge. A reasonable fee may be charged, or a request may be refused, where a request is manifestly unfounded or excessive, as permitted by law.

14. Newsletter and marketing choices

Subscription to the Aero Leadership newsletter is voluntary. You may unsubscribe at any time by:

• Selecting the unsubscribe link in a marketing email; or
• Contacting hello@aeroleadership.com.

Unsubscribing from marketing does not prevent us from sending non-promotional communications necessary to administer:

• Your account;
• A purchase;
• Course access;
• Security;
• Changes affecting the service; or
• A customer-support request.

15. Security

We use reasonable technical and organizational measures intended to protect personal data against:

• Unauthorized access;
• Unlawful processing;
• Accidental loss;
• Destruction;
• Alteration;
• Unauthorized disclosure; and
• Misuse.

These measures may include:

• Access controls;
• Password protection;
• Encryption in transit;
• Secure third-party payment processing;
• Restricted administrative access;
• Service-provider agreements;
• Backups;
• Software and infrastructure security controls; and
• Procedures for responding to security incidents.

No website, transmission method or storage system can be guaranteed to be completely secure. Users are responsible for protecting their account credentials and should not share passwords with others. Please contact hello@aeroleadership.com if you believe your account or personal data may have been compromised.

16. Personal-data breaches

Where a personal-data breach occurs, we will assess the incident and take appropriate steps to contain and investigate it. Where required by applicable law, we will notify the competent supervisory authority and affected individuals within the legally applicable period.

17. Children and minimum age

The Aero Leadership website, courses and services are intended only for people aged 16 or older. We do not knowingly collect personal data from children under 16. A person under 16 must not:

• Create an account;
• Purchase a course;
• Subscribe to the newsletter; or
• Submit personal data through our services.

If we learn that personal data have been collected from a person under 16 without an appropriate lawful basis or required authorization, we will take reasonable steps to delete the information. A parent or legal guardian who believes that a child under 16 has provided personal data may contact hello@aeroleadership.com.

18. Third-party links and services

Our website or courses may contain links to third-party websites, services or resources. Selecting a third-party link may allow that third party to collect or process information. Aero Leadership does not control independent third-party websites and is not responsible for their privacy practices. You should review the privacy information provided by a third party before submitting personal data to it.

19. Organizational and multi-seat accounts

Where a company, non-profit organization or other entity purchases multiple course seats, the organization may provide limited information about authorized participants, such as:

• Name;
• Business email address;
• Role;
• Seat allocation; and
• Licence status.

Depending on the arrangement, the organization and Aero Leadership may each have separate responsibilities for the personal data they process. The purchasing organization is responsible for having an appropriate lawful basis for providing participant information to Aero Leadership. We may provide the organization with limited licence-administration information, such as:

• Seats allocated;
• Invitations sent;
• Account activation;
• Access status; and
• Course completion or progress information, where this has been clearly disclosed and is legally permitted.

The precise information available to an organizational purchaser should be described during the licence-purchase or onboarding process.

20. Course feedback and program improvement

We may invite users to provide feedback, complete surveys or suggest improvements. Feedback may be used to:

• Improve the course;
• Clarify lessons;
• Correct errors;
• Update examples;
• Improve user support;
• Develop new content; and
• Evaluate the effectiveness of the program.

Where possible, internal analysis will use aggregated or de-identified information.

We will not publicly attribute a testimonial, review or identifiable comment to you without an appropriate legal basis, such as your consent.

21. No sale of personal data

Aero Leadership does not sell or rent personal data. We use personal data only for the purposes described in this Privacy Policy or another purpose that is compatible with the original purpose and permitted by law. Our use of hosting, payment, email, analytics and course-platform providers is not considered a sale of personal data. These disclosures are necessary to operate the services or occur with consent where required.

22. Changes to this Privacy Policy

We may update this Privacy Policy when:

• Our services change;
• We introduce or remove a provider;
• Our data-processing activities change;
• Applicable laws or regulatory guidance change; or
• We need to clarify how personal data are handled.

The latest version will be posted on the Aero Leadership website with an updated “Last updated” date. Where a change materially affects how we process personal data, we may provide additional notice by email, account notification, website notice or another appropriate method. Where required, we will request new consent before carrying out materially different consent-based processing.

23. Language

This Privacy Policy may be made available in more than one language. Where translations differ, the version identified as legally controlling in the Aero Leadership Terms of Service will apply, to the extent permitted by law. Nothing in this section limits mandatory consumer or data-protection rights.

24. Contact us

For questions about this Privacy Policy, the processing of personal data or the exercise of your rights, contact:

Aero Leadership Carrer de Gertrude Stein 1, 2-2B 07004 Palma, Spain Email: hello@aeroleadership.com