Padpilot understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of everyone we deal with – including our customers, our training partners (Approved Training Organisations, referred to as “ATOs” or “schools”), and any instructors, staff or students associated with them – and will only collect and use personal data in ways that are described in this Privacy Policy, and in a way that is conistent with our obligations and your rights under the law.
This Privacy Policy was last updated in August 2026 and replaces all previous versions.
1. Information About Us
Padpilot Ltd Limited Company registered in the United Kingdom under company number: 07117732 Registered address: Unit 19 The Glenmore Centre, Waterwells Business Park, Gloucester, Gloucestershire, GL2 2AP Main trading address: Unit 19 The Glenmore Centre, Waterwells Business Park, Gloucester, Gloucestershire, GL2 2AP VAT number: GB992044313
2. What Does This Notice Cover?
This Privacy Policy explains how we use your personal data: how it is collected, how it is held, and how it is processed. It also explains your rights under law relating to your personal data.
It applies whether you are a student, an instructor, a member of staff at one of our partner schools, a representative of a school or ATO we work with, or a visitor to our website.
This Privacy Policy covers all of our products and services, including Padpilot eReader, LMS, PBR, and Padpilot Academy. When you use Padpilot Academy, this Privacy Policy works alongside the short-form notice you are asked to accept when you log in, which summarises how your training data is used.
3. What is Personal Data?
Personal data is defined by the General Data Protection Regulation (EU Regulation 2016/679 and, where applicable, the UK GDPR) (the “GDPR”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.
Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
The personal data that we use is set out in Part 6, below.
4. What Are My Rights?
Under the GDPR, you have the following rights, which we will always work to uphold:
- The right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the details in Part 14.
- The right to access the personal data we hold about you. Part 13 will tell you how to do this.
- The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete.
- The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we have.
- The right to restrict (i.e. prevent) the processing of your personal data.
- The right to object to us using your personal data for a particular purpose or purposes, including direct marketing.
- The right to withdraw consent at any time, where we are relying on your consent to use your personal data — for example, for marketing communications. Withdrawing consent will not affect the lawfulness of anything we did before you withdrew it.
- The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.
For more information about your rights, or to exercise any of them, please contact us using the details in Part 14.
Further information about your rights can also be obtained from the Information Commissioner’s Office (ICO) in the UK, or from your local data protection authority if you are based elsewhere in the EU. If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the relevant authority — see Part 15.
5. Where Do We Get Your Personal Data From?
We collect personal data in one of the following ways:
- Directly from you — for example, when you purchase or register for a Padpilot subscription yourself, contact us via our website or by email, or sign up to receive marketing communications from us.
- From your training organisation (ATO or school) — where your school provides us with your name and email address in order to set up an eReader, LMS, PBR or Padpilot Academy subscription on your behalf, whether you are a student or a member of staff.
Where we receive your personal data from your training organisation rather than from you directly, we only use it for the purpose your training organisation provided it to us — principally, setting up and managing your subscription. Where your training organisation tells you, at the point of your enrolment, that your details will be shared with us for marketing purposes and gives you the opportunity to opt out, we may also send you marketing communications about similar Padpilot products under the “soft opt-in” described in Part 8. Otherwise, we do not use personal data received from your training organisation for marketing purposes unless you have separately given us your consent to do so (see Part 8).
Your training organisation is responsible for telling you that it has shared your details with Padpilot for this purpose. If you have any questions about this, you are welcome to contact us directly using the details in Part 14.
Where your personal data (such as your name, email address, and course enrolment) is provided to us by your training organisation in this way, we treat it as a copy of that organisation’s own enrolment records. We are not responsible for the accuracy of data provided to us in this way; any corrections should be made through your training organisation.
6. What Personal Data Do We Collect?
We may collect some or all of the following personal data (this may vary according to your relationship with us):
- Name
- Email address
- Postal address, where relevant (e.g. for billing purposes)
- Telephone number
- Payment information
- The training organisation (school or ATO) you are registered with or associated with
- Your marketing preferences, where you have told us what these are
Depending on which of our products you use, we may also collect the following:
- Books accessed or read, and time spent reading (Padpilot eReader, Padpilot Academy)
- Course and module enrolment (Padpilot Academy)
- Learning activities, assessments, and examinations attempted or completed, including date and time (Padpilot LMS, Padpilot Academy)
- Scores, results, and number of attempts (Padpilot LMS, Padpilot Academy)
- Time spent on lessons and activities (Padpilot LMS, Padpilot Academy)
- Completion status of CBT/SCORM packages (Padpilot Academy)
- Type of device used (Padpilot eReader, Padpilot Academy)
Automatically collected technical data (across all products):
- Device type, browser type, and operating system
- IP address and session identifiers
- General usage patterns, such as pages or lessons visited and time spent
7. How Do We Use Your Personal Data?
Under the GDPR, we must always have a lawful basis for using personal data. We rely on the following lawful bases, depending on the purpose:
- Performance of a contract — providing and managing your account, and supplying our products and services to you, including the Padpilot eReader, LMS, PBR and Padpilot Academy.
- Legitimate interests — responding to enquiries, maintaining the security of our systems, and sending necessary service communications about products or subscriptions you already hold (for example, renewal notices, access instructions, or notification of a Critical Error or Critical Omission correction). These are operational communications, not marketing, and do not require separate marketing consent. We also rely on legitimate interests to maintain your training and assessment records (such as scores, attempts, and completion data) and to share them with your training organisation, which is required to keep these records and may need to report them to the relevant Civil Aviation Regulators as evidence of your training. Where the “soft opt-in” described in Part 8 applies, we also rely on legitimate interests, rather than consent, as the basis for sending you marketing about similar products.
- Consent — sending you marketing communications, and using tracking technologies within those communications, as described in Part 8.
Information about your account and subscriptions is held on our Customer Relationship Management (CRM) system, hosted by Zoho.
8. Marketing Communications
If you are an existing Padpilot customer — meaning you have purchased or registered for a Padpilot product or service directly with us — we may send you marketing communications about similar Padpilot products and services, unless you tell us you do not want to receive them. This is sometimes known as a “soft opt-in.” You will be given a clear opportunity to opt out when you provide your details to us, and every marketing communication we send includes a simple way to opt out (see below).
If your details were provided to us by your training organisation (ATO or school), the same “soft opt-in” approach applies: we may send you marketing communications about similar Padpilot products and services, unless you tell us you do not want to receive them. Your training organisation is responsible for telling you, at the point of your enrolment, that your details will be shared with us for this purpose, and for giving you the opportunity to opt out at that time. If your training organisation has not done this, we will only send you marketing communications where you have separately given us your consent, either directly to us or via your training organisation acting on our behalf.
For any other marketing communications not covered by the paragraphs above, we will only send them if you have opted in, or if we are otherwise permitted to do so by law.
You can opt in, change your preferences, or opt out of marketing communications completely at any time, by using the unsubscribe link at the bottom of any marketing email, or by contacting us using the details in Part 14. Opting out will not affect any operational communications we need to send you about a subscription or service you hold with us.
Where we send marketing communications by email, we, or agencies acting on our behalf, may use technologies such as open tracking (pixels) and click tracking to understand how our communications are used and to improve them. Where the use of such tracking requires your consent under applicable law (for example, under the ePrivacy Directive or the UK Privacy and Electronic Communications Regulations), we will only use it where you have given that consent, or a specific exemption applies. Up-to-date information about the tracking technologies we use in our marketing emails is available on request by contacting us using the details in Part 14.
9. Cookies and Website Tracking
Our website uses cookies and similar technologies. These are separate from the email tracking technologies described in Part 8, and are governed by our Cookie Policy.
Click here to view our Cookie Policy
10. Who Do We Share Your Data With?
We share all data concerning a student’s training progress — including course activity, assessment scores, attempts, and completion data — with the training organisation (ATO or school) that student is registered with, so that the ATO can meet its own regulatory record-keeping and reporting obligations. Unlike the providers listed below, your training organisation is not acting as our processor: it receives this data as the party responsible for your training record.
We may share your personal data with the following third parties, who process it on our behalf and under our instructions, in order to provide our services to you:
- Zoho — for CRM and marketing communications management
- Hurix — for hosting the Padpilot eReader
- Titus — for hosting the Padpilot LMS
- WooCommerce and our payment processor — for processing payments securely
- Marketing agencies engaged to deliver campaigns on our behalf, currently including Really Helpful Marketing Communications (RHMC)
We have appropriate agreements in place with each of these providers to protect your personal data. We will not share your personal data with any other third parties, except:
- Where we are legally required to do so, including to comply with a court order, a legal obligation, or the instructions of a government body.
- In the event that we sell or buy any business or assets, in which case we may be required to disclose your personal data to the prospective seller or buyer.
- If the company is acquired by a third party, in which case personal data held by the company may be one of the transferred assets.
11. How and Where Do We Store or Transfer Your Data?
We will only store or transfer your personal data in the UK or the EU. This means that it will be fully protected under the GDPR.
12. How Long Will We Keep Your Personal Data?
We will not keep your personal data for any longer than is necessary in light of the reason(s) for which it was collected. In practice, this means:
- Data relating to your subscription or course will generally be kept for the duration of your subscription, plus any period necessary to meet our legal, accounting, or regulatory obligations.
- Where you have opted in to marketing communications, we will keep a record of your preference until you withdraw your consent, or until your other personal data is deleted, whichever is sooner.
- Your personal data may be deleted earlier at your request, at the request of your training organisation (where they provided the data to us), or in accordance with our internal data retention procedures.
When your personal data is no longer required, we will dispose of it in a secure manner.
13. How Can I Access My Personal Data?
If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.
All subject access requests should be made in writing and sent to the email or postal address shown in Part 14.
There is not normally any charge for a subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.
We will respond to your subject access request within one month of receiving it. Normally, we aim to provide a complete response, including a copy of your personal data, within that time. In some cases, particularly if your request is more complex, more time may be required, up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.
14. How Do I Contact You?
To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details for the attention of the Compliance Department:
Email address: support@padpilot.com
Postal Address: Unit 19 The Glenmore Centre, Waterwells Business Park, Gloucester, Gloucestershire, GL2 2AP
15. Complaints
If you have any concerns about our use of your personal data, we would encourage you to contact us in the first instance using the details in Part 14, so that we can try to resolve the issue directly.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) in the UK, or, if you are based in the EU, with your local supervisory authority.
16. Changes to This Privacy Policy
We may change this Privacy Policy from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.
Any changes will be made available online at www.padpilot.com
