Privacy Policy

Effective Date: August 18, 2026

This policy explains how CrewBuddy collects, uses, and protects personal information when you use the CrewBuddy mobile application.

1. Data Controller

CrewBuddy (Eenmanszaak), Kennemerpoort 12, 2152 EC Nieuw-Vennep, The Netherlands. Contact: +31 6 5775 4680 or privacy@crewbuddy.nl.

CrewBuddy is an independent application developed for airline crew members. It is not officially affiliated with or endorsed by KLM Royal Dutch Airlines, Transavia, or any other airline. As a small business, we are not required to appoint a Data Protection Officer under GDPR.

2. Information We Collect

• Account Information: Email, name, optional phone number, employee ID.
• Profile Information: Visibility settings, schedule sharing preferences, notification preferences.
• Flight & Schedule Data: Rosters, duty periods, layover information, routes.
• Location Information: Current location, destinations, airport/hotel locations.
• Communication Data: Chat messages, activity posts, comments, friend requests.
• Device & Technical Information: Device identifiers, IP address, analytics, crash reports.
• eSIM Data: Order information, activation status, data usage, ICCID.
• Schedule Integration: Airline credentials (stored locally only), authentication tokens.

3. How We Use Your Information

Data is processed for service provision (authentication, schedules, communication), personalization, safety, legal compliance, and service improvement including analytics and feature development.

4. Legal Basis for Processing

Processing occurs under GDPR Article 6 via:

• Contractual necessity for core services.
• Legitimate interests (functionality improvement, security, anonymized analytics with opt-out options).
• Consent for location and notifications.
• Legal obligations.

5. Provision of Personal Data

Email and name are required for account creation. Optional data like phone number and location may be declined. Not providing required data prevents account creation and core feature access.

6. Automated Decision-Making

CrewBuddy does not use automated decision-making producing legal effects. Personalization based on preferences does not constitute GDPR Article 22 automated decision-making.

7. Data Retention

Data is retained while your account is active. Upon deletion request, data is scheduled for removal after a 30-day grace period. Anonymized aggregated data may be retained for analytics.

8. Data Sharing and Third Parties

Data is shared with:

• AWS (cloud infrastructure, authentication, messaging, analytics)
• Schedule import services
• eSIM providers
• Service providers
• When legally required by authorities

Authentication credentials remain stored locally only.

Commuting (XCM/XFA listing)

If you list yourself on a flight as a commuter, your name, crew role and base are shown to the crew rostered to operate that flight. They are not shown to anyone else: all other users see only the number of crew listed on a flight.

• You are asked for your agreement once, before your first listing.
• You can delist at any time up to departure, which removes your name immediately.
• A listing expires automatically once the flight has departed.
• Listing in CrewBuddy is not a KLM listing. It creates no booking, reserves no seat and does not check you in.
• Commute flights you keep on your home screen are stored on your device only. They are not written to your roster, and are therefore not used in duty time, flight time limitations, statistics or logbook exports.

Crew Lockers

To add a locker you forward the locker email from your company mailbox to CrewBuddy. We read the locker number, validity dates, location, any link the email contains, and the address you sent it from.

• The sending address is used to match the locker to your account. If it does not match a CrewBuddy account, we reply to explain why the locker could not be added, and the message is retained only so the problem can be investigated.
• Locker details are visible to you alone and are never shown to other crew.
• Removing a locker in CrewBuddy does not cancel the locker itself and does not revoke a share.

9. International Data Transfers

Data transfers outside the EEA occur via Standard Contractual Clauses and adequacy decisions, particularly to US-based infrastructure providers.

10. Your Rights Under GDPR

You may exercise your rights to:

• Access your data (Article 15)
• Rectify inaccurate data (Article 16)
• Erase your data (Article 17)
• Restrict processing (Article 18)
• Data portability (Article 20)
• Object to processing (Article 21)
• Withdraw consent (Article 7)

You may lodge complaints with the Autoriteit Persoonsgegevens (Dutch DPA). Contact privacy@crewbuddy.nl for requests; a 30-day response window applies.

11. Data Security

Technical measures include encryption, secure authentication, monitoring, and cloud infrastructure security. Organizational measures include access controls and assessments. Credentials stored locally use biometric authentication where available. Breaches are reported to authorities within 72 hours and to users if high-risk.

12. Children's Privacy

The app is for airline crew members aged 18+. Personal data from children under 16 without consent is promptly deleted. Report such collection to privacy@crewbuddy.nl.

13. Cookies and Tracking

Local storage handles authentication, preferences, and security. Analytics use anonymized data. Users control tracking through device settings; disabling may affect functionality.

14. Disclaimer of Warranties

The app is provided "as is" without warranties regarding merchantability, fitness, accuracy, or uninterrupted operation.

15. Flight Data Disclaimer

Flight schedules are for personal planning only, not operational decisions. You must always verify flight information through official channels before making decisions. The developers accept no responsibility for missed flights or operational consequences.

16. Limitation of Liability

CrewBuddy excludes liability for indirect, consequential, or punitive damages including lost profits, data loss, or missed flights. Liability is capped at amounts paid in the prior 12 months. Exceptions apply to death, personal injury from negligence, or fraud under Dutch law.

17. Indemnification

Users indemnify CrewBuddy against claims from app misuse, policy violations, third-party rights violations, content submission, or credential misuse.

18. Third-Party Services

Integration includes AWS, Schiphol APIs, weather providers, and eSIM providers. CrewBuddy is not responsible for their availability or accuracy. Schedule data is imported from personal calendars or entered manually, not from airline operational systems.

19. eSIM Data Plans

Third-party network aggregators provide eSIM plans; CrewBuddy acts as reseller, not telecommunications provider. Network coverage and quality are not guaranteed. Purchases are final and non-refundable post-delivery. Pricing may change due to market conditions. Data validity begins upon activation. Users ensure device compatibility, enable roaming, and bear responsibility for primary SIM charges. Liability caps at plan purchase price.

20. Governing Law and Jurisdiction

Dutch law governs this policy. Disputes fall under Amsterdam courts' exclusive jurisdiction.

21. Changes to This Policy

Updates are notified via the app with new effective dates. Continued use implies acceptance.

22. Contact Information

CrewBuddy can be reached at privacy@crewbuddy.nl or +31 6 5775 4680. Dutch users may contact the Autoriteit Persoonsgegevens; EU users may contact their local data protection authority.