DRAFT for legal review – not in force until reviewed and approved. Details in [ ] are filled in by SPU.

Svenska

Personal data in SPUTNIK

SPUTNIK is SPU's test portal for theory tests in flight training. This notice explains what personal data the portal processes, why, for how long and what your rights are.

Controller

Svensk Pilotutbildning [company name and registration number], [address]. Data protection contact: [email address].

What data

• Account: name, email address, role (student, instructor, administrator), class, language and sign-in details. Passwords are stored only as an encrypted hash.
• Tests: which tests you were assigned, which questions you got and in which order, your answers, time per question, when you started and submitted, your score and whether you passed.
• Integrity during tests: browser events (for example leaving the test window, copying, pasting, right-clicking, pressing Print Screen or having a second screen), network address (IP), a random device id in a cookie, whether the test is opened from another device or outside SPU's network, and whether it is resumed after a break. A flag can be created from such events.
• Review: flags, the instructor's decision and reason, and notes.
• Audit log: who changed what and when (for example questions, tests, results and permissions).

SPUTNIK uses no camera and records no image or sound. If webcam monitoring is introduced later, you will be told in advance, and an impact assessment is made first.

Why, and on what legal basis

• Running and marking tests and documenting your training – to perform the training agreement with you and SPU's duty as an approved training organisation (ATO) to keep training records. [Legal basis to confirm: contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c).]
• Making sure tests are taken fairly – legitimate interest, Art. 6(1)(f). [To confirm.]
• Security and traceability (audit log) – legitimate interest and legal obligation. [To confirm.]

No automated decisions

The system never fails anyone and never changes a score because of a flag. An instructor reviews every flag and makes the decision. You can see your own flags and the decision together with your result.

Who sees the data

You see your own tests and, once the instructor releases them, your results. Instructors see students in their own classes. SPU administrators see everything in the portal. We share the data only with the processors below.

Processors

• Supabase – database, sign-in and files. Data is stored in Stockholm (EU, eu-north-1).
• Cloudflare – hosting of the website.

Both are US companies. Data processing agreements and the basis for any transfer outside the EU (EU–US Data Privacy Framework or standard contractual clauses) [to confirm and state].

How long

• Account, tests and results: as long as SPU must keep training records [state period per SPU's rules].
• Events during tests (integrity events): deleted automatically after 12 months.
• Flags and decisions: kept with the test result.
• Audit log: [state period, at least 6 months].
• Backups: Supabase takes daily backups that are overwritten according to their routine [state days].

Cookies

SPUTNIK uses only necessary cookies: a sign-in cookie while you are signed in and a device cookie (a random id) that shows whether a running test is opened from another computer. No analytics or marketing cookies.

Your rights

You have the right to know what data we hold about you, to have errors corrected, and in some cases to have data deleted or restricted or to object to the processing. Contact [email address]. If you are not satisfied, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Last changed: [date]