Privacy notice

Who is responsible for your data

The data controller for this website is:

• RMX Drift AS, organisation number 931 140 574
• Trading through its registered business unit NorthSky Aviation Consultancy, business unit number 931 140 701
• Wergelands vei 2, 3117 Tønsberg, Norway
• Privacy enquiries: booking@northsky.no

Both registrations can be verified in the Norwegian Central Coordinating Register for Legal Entities at brreg.no. NorthSky has not appointed a data protection officer; that is not required for an organisation of this size and processing profile.

What this notice covers

This notice applies to the NorthSky tools site and to the processing described below: using the airfield risk assessment tool and choosing to send a result, booking a discussion, email correspondence that follows from either, and the technical operation of the site itself. It does not cover separate contractual arrangements for consultancy engagements, which are governed by the agreement made in each case.

Using the airfield risk assessment tool

The airfield risk assessment is scored entirely in your browser. While you answer the questions, nothing is transmitted to NorthSky and nothing is written to your device: your answers exist only in the open page and are gone when you close or reload it. The tool sets no cookies and does not use browser storage. You can complete it, read your result and print it without sending anything.

If you choose to use Send for expert review at the end, that submission is the only point at which data reaches NorthSky.

• Data collected: your name, email address, organisation, the airfield or operating context you provide, your role and your description of what you would like from a review if you fill those in, together with your answers to the seventeen questions, the resulting priority score, the advisory band, any attention flags, the section scores, the version of the scoring model and the time you completed it.
• Purpose: to read your result before replying, so that the reply addresses what your answers actually raised rather than being generic, and to tell you what a full assessment of your site would involve. Submissions are also reviewed in aggregate to improve the question set and the weighting.
• Lawful basis: your consent, GDPR article 6(1)(a), given by ticking the confirmation box before you send. You can withdraw it at any time by emailing us, and we will delete the submission. Withdrawal does not affect a reply already sent. Where a submission leads to a discussion about an engagement, the correspondence that follows rests on article 6(1)(b), steps taken at your request prior to entering a contract.
• Where it is stored: in the website database on NorthSky’s Hostinger hosting, in a submission log visible only to signed-in NorthSky administrators. A notification is also sent to NorthSky’s booking mailbox so that the submission is not missed.
• Retention: up to 24 months, the same period as booking records, or a shorter period on request. Anything kept beyond that for improving the model is stripped of your name, email address and organisation first, so that it can no longer be linked to you.
• Automated decision-making: none. The score is arithmetic applied to the answers you gave, it is shown to you in full, and it does not produce a decision with legal or similar effect. A person reads every submission before replying.

Please do not enter occurrence reports, aircraft registrations, personal safety data, named individuals or confidential operational documents into the tool or the form. Answer at operating-context level. The tool is a screening aid, and material of that kind belongs in a formal engagement with an agreed confidentiality basis.

Booking a discussion

The Request a Discussion page uses Google Calendar appointment booking to schedule meetings. When you submit the booking form:

• Data collected: your name, email address, organisation, the airfield or context you provide, your description of what you would like to discuss, and your preferred meeting language.
• Purpose: to schedule and prepare for the meeting you requested, and to send confirmation, reminders and follow-up messages related to that meeting.
• Lawful basis: steps taken at your request prior to entering a contract, GDPR article 6(1)(b), together with NorthSky’s legitimate interest in responding to service enquiries, article 6(1)(f).
• Processor: Google, through Google Workspace. For customers in the EEA the contracting Google entity is Google Ireland Limited; see Google’s entity list. Processing is governed by the Cloud Data Processing Addendum (Customers), which incorporates the EU Standard Contractual Clauses for any transfer to a country outside the EEA that is not covered by an adequacy decision.
• Retention: booking records are kept in NorthSky’s calendar for up to 24 months, or a shorter period on request. Meetings are not recorded unless agreed in advance.
• Google Meet: each booking creates a Google Meet link. If you join the meeting, Google processes connection data under its own terms as part of delivering the service.

Please do not submit occurrence reports, aircraft registrations, personal safety data, named individuals or confidential operational documents through the booking form. Keep the description at operating-context level. Material of that kind belongs in a formal engagement with an agreed confidentiality basis.

Email correspondence

If you email NorthSky, your message and address are processed to handle your enquiry. The lawful basis is pre-contractual steps or legitimate interest, articles 6(1)(b) and 6(1)(f). Mailboxes are hosted with Hostinger and Google Workspace. Correspondence is kept for as long as it is needed for the enquiry or engagement, and where it forms part of accounting documentation, for the period required by the Norwegian Bookkeeping Act.

Hosting and technical logs

The site is hosted by Hostinger. As part of normal server operation the hosting platform records technical log data, which can include your IP address, the time of the request, the page requested and your browser identification. This is used for security, abuse prevention and fault diagnosis, on the basis of legitimate interest, article 6(1)(f). NorthSky does not use these logs for analysis, profiling or marketing. They are retained by the hosting platform under its own standard log periods.

Cookies and analytics

• NorthSky sets no analytics, advertising, profiling or tracking cookies on this site. There is no Google Analytics, no advertising pixel and no cross-site tracking.
• The site platform may set strictly technical cookies needed for security and page caching, and a session cookie for logged-in administrators. These are necessary to deliver the site and do not require consent.
• The booking calendar on Request a Discussion is embedded from Google. When that element loads, Google may set cookies in your browser and process data under the Google Privacy Policy, which NorthSky does not control. If you prefer not to load it, contact NorthSky by email instead and a meeting can be arranged manually.

Processors and transfers outside the EEA

Processor	Role	Location	Safeguard
Hostinger	Website hosting, email	EU / EEA	Data processing agreement with the provider
Hostinger	Website database holding tool submissions	EU / EEA	Data processing agreement with the provider
Google (Google Ireland Limited for the EEA)	Calendar and booking, email, Google Meet	EU / EEA, with possible support access from third countries	Cloud Data Processing Addendum, incorporating the EU Standard Contractual Clauses

NorthSky does not sell personal data and does not share it with third parties for their own purposes.

Your rights

You have the right to request access to the personal data NorthSky holds about you, to have it corrected or erased, to have processing restricted, to object to processing based on legitimate interest, and to receive your data in a portable format. Where processing rests on consent, you may withdraw it at any time without affecting processing already carried out.

Send requests to booking@northsky.no. NorthSky will respond within one month. If you are not satisfied with the response, you may complain to the Norwegian Data Protection Authority, Datatilsynet.

Changes to this notice

Version 1.1, 25 August 2026: added the section on the airfield risk assessment tool, which stores a submission when a user chooses to send a result, and added the website database to the processor table, which is now readable on narrow screens without scrolling sideways. No change to booking, email or hosting.

This notice is versioned. When NorthSky adds a service that processes personal data in a new way, this page is updated and the version and date above are changed. Material changes will be described here rather than made silently.