Privacy
How we handle personal data. This summary sits alongside the data processing agreement, which is available on request.
Controller and processor
For the personal data a school holds about its students and staff, the school is the data controller and FlyerOS is the processor. We process that data on the school’s documented instructions to provide the service, and for nothing else.
What we process
Account and contact details, the operational and training records a school enters, and technical logs needed to run and secure the service. We do not sell personal data and we do not use school data to train external models.
Our own access
FlyerOS staff may access a school’s data to support and operate the service. Every such access is logged and surfaced in that school’s own audit trail. There is no hidden access.
Retention and deletion
Records are retained for as long as the school’s account is active and thereafter as the school directs, reconciled with the regulatory retention a training organisation is subject to. On request we delete or return data in line with the DPA.
Your rights
Data subjects can exercise their rights (access, correction, erasure and portability) through the controlling school; we support the school in meeting those requests.
International transfers
Where data is processed outside the UK/EEA, appropriate safeguards are applied. Data residency options are described on the security page.
Privacy questions or a data request route: privacy@flyeros.co.uk.