Privacy Policy

Last updated: 11 October 2026

1. Website operator and contact

FlyWithMe is operated by Volando GmbH, represented by Patrick Ockens, Raunerweg 9b, 82211 Herrsching am Ammersee, Germany. For questions about this notice or your assessment data, email assessment@volando.aero or call +49 (0) 8152 9148080.

2. Assessment commissioned by a candidate

If you commission Volando directly to conduct an assessment before applying to an airline, Volando is the controller for that service. We process the data necessary to provide your assessment under Article 6(1)(b) GDPR. Providing your name and responses is necessary to conduct the questionnaire; without them we cannot provide this part of the assessment.

We retain the assessment confidentially for use in subsequent applications during the agreed 24-month service period. A candidate-commissioned report is not released to an airline solely because the airline requests it.

3. Assessment commissioned by an airline

If an airline commissions the assessment and Volando acts as its processor, the airline is the controller. Volando processes the data under the airline’s documented instructions and the applicable data processing agreement. Before participation, the commissioning airline must provide its identity, privacy contact, recruitment privacy notice and the legal basis applicable to your recruitment process. The contractual basis for a direct candidate commission does not automatically apply to an airline commission.

4. Questionnaire information and purposes

The ADM questionnaire collects your full name and responses to ten situations. An individual access code selects the test variant: Captain or First Officer, and Airline or Business Aviation. Volando stores the variant, responses, completion time, calculated scores and an internal participant reference. Access-code and session credentials are stored as hashes.

These data are used to administer the assessment, evaluate aeronautical decision making and prepare a report for recruitment purposes. The five attitude categories are Anti-authority, Macho, Resignation, Impulsivity and Invulnerability. An airline report includes the percentage distribution across these five categories. The ADM questionnaire is one assessment instrument; its scores do not themselves constitute an automated hiring decision.

5. Candidate authorisation and recipients

Individual questionnaire responses and detailed test records are accessible to authorised Volando personnel. The airline receives the assessment report, including the percentage distribution of the five categories, rather than the individual questionnaire answers.

For a candidate-commissioned assessment, Volando releases the report only following your express, documented authorisation naming the recipient airline. Authorisation may be recorded through an available release form, an explicit release setting in an applicant portal, a declaration in an applicant management system, or email. Merely selecting an airline without an explicit release declaration does not constitute authorisation. A portal-based release procedure applies only where that feature is actually available; the ADM questionnaire itself does not currently provide it.

Where disclosure is based on consent under Article 6(1)(a) GDPR, you may withdraw your consent by contacting assessment@volando.aero. Withdrawal does not affect the lawfulness of an earlier disclosure. It does not automatically require the airline to erase data it has a separate lawful basis to retain. For an airline-commissioned assessment, Volando follows the controller’s documented disclosure instructions and the airline’s recruitment notice.

6. International report transfers

The recipient airline and destination country will be identified before release. Transfers to Switzerland may rely on the European Commission’s adequacy decision under Article 45 GDPR.

Singapore does not currently have an EU adequacy decision. No report will be transferred to an airline in Singapore unless an applicable GDPR transfer mechanism and the necessary safeguards have first been established. Where EU Standard Contractual Clauses are used, this includes assessment of the recipient-country protection and any necessary supplementary measures. Candidate authorisation does not by itself replace the international-transfer requirements. Information about the applicable safeguards and how to obtain a copy is available from assessment@volando.aero.

7. Retention and deletion

In the FlyWithMe ADM database, completed questionnaire records are scheduled for permanent deletion 24 calendar months after submission. Uncompleted records, including unused codes and internal references, are scheduled for deletion 24 calendar months after creation. Deletion removes the entire record, including the name, responses, scores, reference and credential hashes. Under an airline commission, this retention arrangement must correspond to the controller’s documented instructions.

Automatic cleanup is performed in batches through hourly WordPress scheduled tasks and on visits to the ADM administration page. WordPress task execution depends on website requests or a configured server scheduler, so physical deletion may occur on the next execution after the deadline. Records whose retention deadline has passed are excluded from the results list and new CSV exports while deletion is pending.

The 24-month period supports subsequent application use. The EASA AMC reference to assessment recency before commencing line flying is not itself a statutory data-deletion requirement or a blanket validity guarantee for this questionnaire.

The plugin cannot delete reports or CSV exports already downloaded or sent outside the website. Those copies are subject to a separate retention and deletion process. The airline’s retention of a received report is governed by its own privacy notice. Earlier erasure requests are considered in accordance with the applicable legal conditions. Information required for separate statutory obligations or justified legal claims is handled under the relevant basis and limited to what is necessary.

8. Hosting, security logs and backups

The website uses United-domains Hosting for WordPress Pro. Technical hosting providers process website and database information to operate and secure the service; this is distinct from reviewing assessment results. The hosting data processing documentation states that commissioned processing takes place within the European Union and identifies service-dependent subprocessors, including NorthC, IONOS, Open-Xchange and Akamai for the respective services described in that documentation.

Requests to the website necessarily involve technical connection data, such as an IP address. Hosting documentation states that some logs are pseudonymised by shortening IP addresses or deleted after seven days. This does not establish a uniform seven-day period for every log. Log-specific processing and retention information can be requested through assessment@volando.aero. Technical operation and security of the website are pursued on the basis of Article 6(1)(f) GDPR, with the legitimate interest of providing and protecting the service.

Volando does not currently create its own website backups. The provider’s documentation describes internal backup measures, while its support information distinguishes the absence of integrated customer backups. The availability and retention of internal provider copies are being clarified. Deletion from the active ADM database does not mean simultaneous removal from any internal provider backup.

The ADM service uses a temporary, hashed IP-based identifier to limit repeated access attempts. This expires after 15 minutes. Questionnaire session credentials expire after two hours. Session and access controls are used to protect the service.

9. Website tools and email

The website is built with WordPress and Elementor and uses hosting, administration and accessibility-related plugins. Plugin installation alone does not establish that a visitor analytics or external accessibility service is in use. Elementor’s Google Fonts loading has been disabled. No general statement that all external requests or cookies are absent is made here. Any non-essential tracking must be assessed and, where required, enabled only after consent, with corresponding information before use.

If you contact Volando by email, we process your email address and message to respond. Processing related to your assessment contract or your requested pre-contractual steps is based on Article 6(1)(b) GDPR; other enquiries are handled on the basis of Article 6(1)(f) GDPR, with the legitimate interest of responding to business enquiries. Correspondence is retained for as long as required for the enquiry or service and any applicable statutory obligations or justified legal claims.

10. Participant interface and your rights

Assessment results are not displayed in the participant portal or automatically provided to candidates. Statutory data protection rights, including the right of access under Article 15 GDPR, remain unaffected. Requests relating to an assessment are handled separately by the relevant controller. Where Volando is a processor, it assists the commissioning airline with such requests.

Subject to the applicable conditions, you may request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it. You may lodge a complaint with a supervisory authority, including the Bavarian State Office for Data Protection Supervision (BayLDA), www.lda.bayern.de.

The ADM plugin calculates scores but does not automatically accept or reject a candidate. The airline is responsible for its recruitment decision and the information it provides about its decision-making process.