Alker Aviation
Privacy notice
This notice explains which personal data Alker Aviation processes, why we do it, how long the data is kept and what rights you have. It covers the alkeraviation.com website, the client portal, Alker Drone Academy, and image and video material from drone jobs.
In short
The public site sets no cookies, loads nothing from third parties and stores nothing in your browser. We use no analytics and no advertising networks. That is also why you meet no consent banner: there is nothing to consent to. We only receive data once you send us something yourself — a form, a sign-in or a job.
1. Who is the data controller
The controller for the processing described here is:
- Business
- Alker Aviation AS
- Company registration number
- 938 046 948
- Address
- Bærumsveien 296, 1344 Haslum
- sven@alkeraviation.com
Questions about privacy, access or deletion go to the email address above. We normally reply within one working day, and at the latest within one month as the GDPR requires.
2. The public website
The public pages load resources from our own server, without analytics or marketing tracking. The hosting provider processes technical information necessary to deliver the pages.
The pages also store nothing in your browser — no cookies, no localStorage, no sessionStorage. You pick your language with a link that leads to its own address (/en/ or /de/), not with a setting left behind on your machine.
Server logs
The server keeps an operational log with a partially masked IP address, time, URL path, status code and browser type. Masking reduces detail but does not guarantee anonymity. Access logs omit URL parameters and referrers. Error logs may contain full IP addresses during operational errors. Logs are used for troubleshooting and security and rotated after 14 days. The legal basis is legitimate interests under Article 6(1)(f).
3. The contact form
If you submit the contact form, we process your name, email address, company name if given, the type of job you select and the text you write. We use it to reply to you and to give you a quote.
The legal basis is taking steps at your request prior to entering into a contract, cf. article 6(1)(b). If your message does not concern a job, the basis is our legitimate interest in answering enquiries, cf. (f).
The form opens your email app with a prepared draft. Nothing is sent until you send the email yourself. Web3Forms is not enabled. Email is processed by the providers involved in sending and receiving it; see section 7. You can also write directly to sven@alkeraviation.com.
Enquiries that do not lead to a job are deleted within twelve months. If the enquiry leads to a job, it is kept with the job documentation.
4. The client portal and the academy
The portal requires a sign-in. About account holders we process the username, name, email address if you give one, a cryptographic hash of the password (scrypt — the password is never stored in the clear), the time of registration and of the last sign-in, and the account status.
When a student account is registered we ask for the date of birth. We do so because the courses and the public examinations have age limits, and because a student under 18 does not enter into the agreement alone. If the student is under 18, we also ask for the name and email address of a guardian, so that whoever approves the application knows that the account belongs to a child and who is responsible. Guardian details are stored only for students under 18. For students under 13 we do not create an account through the form at all; please contact us instead. The legal basis is the agreement with the student or the guardian, cf. Article 6(1)(b), and our legitimate interest in contracting with the right party, cf. (f).
For customers we store projects and delivery files. Each download is logged with which account fetched the file and when, and the administration can see this in the portal. The purpose is to be able to answer whether a delivery actually arrived. The log is deleted together with the file when the fourteen days are up. The academy stores progress, answers, submissions and a flight logbook. Personal progress and logbooks belong to the individual account. Teachers and administrators also access class management according to their role. The academy uses browser storage for practice data and synchronisation. Signing out clears the app’s local account data. Always sign out on shared devices.
The legal basis is performance of the contract with you as a client or student, cf. article 6(1)(b).
The portal cookie
The portal sets one cookie, __Host-alker_sid. It keeps you signed in to the portal and academy and contains a random session value. It is marked HttpOnly, SameSite=Lax and Secure, and the __Host- prefix in the name means the browser only accepts it from alkeraviation.com over HTTPS. The server session lasts up to 14 days; signing out removes the cookie and ends the session. The cookie and academy storage needed for the functions you use are not used for analytics or marketing.
Sign-in attempts
We limit login attempts per IP address in server memory. Failed attempts per username are also stored in the database, with attempt counts and lockout times. Successful login removes the counter; the daily cleanup removes obsolete counters once the lockout and attempt window have expired.
5. Deliveries and deletion after 14 days
Files from a job are made ready in the portal and stay available for 14 days. After that they are deleted automatically from the server by a job that runs every night. Download and keep your own copy while they are there.
Original material outside the portal is kept only while needed for the assignment or a specific documentation purpose. Accounting obligations apply to relevant records and do not automatically justify keeping all raw images and videos. You may request deletion; we explain the basis if anything must be retained.
6. Images and video from drone jobs
A drone job is about documenting a building or an installation. Even though it is the building we photograph, people, vehicles, registration plates and neighbouring properties can end up in the frame. Such material can be personal data.
We photograph only what the job requires, fly as low and as narrowly bounded as we can, and avoid pointing the camera at neighbouring properties and private outdoor areas. Material that is not relevant to the job is deleted.
The legal basis is the contract with the client and the legitimate interest we and the client have in documenting the condition of the building, cf. article 6(1)(b) and (f). The material goes to the client only.
Images we use as references on the website are published at low resolution, without identifiable people or registration marks, and all metadata — including the GPS position from the drone — is stripped from the files before they go up. If an image with recognisable people is to be published, we obtain consent first.
If you believe you were filmed without cause, get in touch. We will find the recording, tell you what it is used for and delete it unless we are under a duty to keep it.
7. Who gets to see the data
We do not sell personal data and do not share it for marketing. Data may be processed by suppliers acting on our behalf under a data processing agreement:
| Supplier | Processes | Where |
|---|---|---|
| Web3Forms | Not enabled; receives no form data | Not in use |
| Hostinger (VPS) | Operation of the site and the portal, including storage of deliveries | Frankfurt, Germany (EU/EEA) |
| Hostinger Email | Email correspondence with you | May be stored and processed outside the EU/EEA |
Data may in addition be disclosed to a public authority where we are legally required to do so, for example to the Norwegian Civil Aviation Authority in connection with oversight of drone operations or an occurrence report.
We use Hostinger Email for email communications. Personal data may be stored and processed in countries outside the EU/EEA. Hostinger states that such transfers are supported by valid transfer mechanisms, including the EU Standard Contractual Clauses (SCCs). The specific region for our email service and backups has not been confirmed. The VPS location does not automatically apply to email. Contact us for further information about transfer mechanisms and safeguards.
Hostinger's general privacy policy describes residual copies remaining in backups for a limited period after deletion. We have not confirmed a specific retention period for backups of our email. Email backups are separate from VPS backups and do not guarantee permanent archiving or recovery.
8. How long we keep data
| Data | Retention |
|---|---|
| Server log with masked IP address | 14 days |
| Delivery files in the portal | 14 days from delivery, then deleted automatically |
| Enquiry that did not lead to a job | Up to 12 months |
| Client and student accounts, including date of birth and guardian details | While the relationship and a necessary purpose continue. Retention is reviewed when the relationship ends and on deletion requests. |
| Job documentation and accounting records | Statutory retention for relevant accounting records; other material only as long as necessary |
| Portal action log (who approved, blocked, corrected or deleted an account) | 12 months, then deleted automatically |
| Notification queue (your email address and the text of the message we sent you) | 90 days after sending, then deleted automatically. One-time password links are removed from the stored text as soon as the message is sent. |
9. Your rights
You have the right to access the data we hold about you, to have inaccurate data corrected, to have data erased, to require that processing be restricted, to receive the data you gave us in a machine-readable format, and to object to processing based on legitimate interest.
Send an email to the address at the top and we will reply without undue delay and at the latest within one month. It costs nothing.
If you believe we process data contrary to the rules, you can lodge a complaint with the Norwegian Data Protection Authority, Datatilsynet. We would appreciate hearing about it first, so that we can put it right.
10. Security
All traffic is encrypted over HTTPS. Passwords are stored with scrypt and never in the clear. Delivery files sit outside the area the web server can reach directly, and are handed out only after the sign-in has been checked. Writing requests in the portal require an anti-forgery token. If we block an account, it loses access immediately. Should a personal data breach nonetheless occur that poses a risk to you, we notify the Data Protection Authority within 72 hours and you directly where the rules require it.
11. Changes
If we change how we process personal data, we update this notice and set a new date below. If the change is significant, we tell account holders.
Last updated: 2026-09-18