Privacy Policy

1. Data Controller

CrewBuddy is the data controller responsible for the processing of your personal data in connection with this App. This is an independent application developed for KLM crew members and is not officially affiliated with or endorsed by KLM Royal Dutch Airlines.

As a small business (eenmanszaak), we are not required to appoint a Data Protection Officer (DPO) under GDPR Article 37. For all privacy matters, please contact us directly at the above details.

2. Information We Collect

We collect the following types of personal information:

• Email address (for authentication)
• First and last name
• Phone number (optional)
• Employee ID (for KLM crew verification)

• Profile preferences (visibility settings)
• Schedule sharing preferences
• Notification preferences

• Flight schedules and roster information
• Duty periods and layover information
• Flight routes and destinations

• Current location (when you use location-based features)
• Destination locations for activity suggestions
• Airport and hotel locations

• Messages sent through the crew chat feature
• Activity posts and comments
• Friend requests and connections

• Device identifiers and operating system
• IP address and network information
• App usage analytics and crash reports
• Push notification tokens

• eSIM order and purchase information
• eSIM activation status and data usage statistics
• ICCID (SIM card identifier) for active eSIM plans

• Airline system credentials (stored locally on your device only)
• Authentication tokens for schedule import services

3. How We Use Your Information

We process your personal data for the following purposes:

• Authenticate your access to the App
• Display your flight schedules and roster
• Enable crew communication and social features
• Provide location-based activity suggestions

• Send push notifications about flights and activities
• Facilitate crew-to-crew messaging
• Share activity updates and suggestions

• Customize your App experience based on preferences
• Show relevant destinations and layover activities
• Connect you with crew members on shared flights

• Ensure the security and integrity of the App
• Prevent unauthorized access and fraud

• Meet applicable regulatory requirements
• Respond to legal requests and investigations

• Analyze App usage to improve functionality
• Debug technical issues and crashes
• Develop new features and services

4. Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal grounds:

• Processing required to provide App services
• Managing your crew account and authentication
• Displaying flight schedules and roster information

We have conducted a balancing test and determined our legitimate interests do not override your rights because:

• Improving App functionality benefits all users
• Security measures protect your data
• Analytics use anonymized data where possible
• You can opt out of non-essential processing

Our legitimate interests include:

• Improving App functionality and user experience
• Ensuring security and preventing fraud
• Analytics for service optimization (using anonymized data)

• Location services and activity suggestions
• Push notifications and marketing communications
• Optional features like crew social networking

• Compliance with applicable Dutch and EU regulations
• Record-keeping for security purposes
• Responding to lawful requests from authorities

You may withdraw your consent at any time through the App settings, though this may affect certain functionalities.

5. Provision of Personal Data

The following data is required to use the App:

• Email address (for account creation and authentication)
• First and last name (for crew identification)

If you do not provide required data, you will not be able to create an account or use the App's core features. Optional data (phone number, location, etc.) can be declined without affecting basic functionality.

Providing your email and name is a contractual requirement necessary to deliver our services. It is not a statutory requirement.

6. Automated Decision-Making

We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Any personalization (such as activity suggestions or flight notifications) is based on your preferences and does not constitute automated decision-making under GDPR Article 22.

7. Data Retention

We retain your personal information for as long as your account is active.

When you request account deletion, we schedule your data for permanent removal after a 30-day grace period, during which you can cancel the deletion request.

After this period, your personal data will be permanently deleted from our systems. Some anonymized, aggregated data may be retained for analytics purposes.

8. Data Sharing and Third Parties

We share your personal data with the following parties:

• Authentication and user management
• Cloud messaging for push notifications
• Analytics and crash reporting
• Cloud storage for app data

• Integration with airline systems for flight schedule data
• Authentication credentials stored locally on your device only

• When purchasing or managing an eSIM, your email address and device information are shared with our third-party eSIM provider to fulfill your order
• Usage data (data consumed, activation status, remaining balance) is retrieved from the provider to display in the App
• The eSIM provider processes this data under their own privacy policy

• Cloud hosting and infrastructure providers
• Technical support and maintenance services
• Security and fraud prevention services

• Aviation authorities and regulators when legally required
• Law enforcement when legally required
• Courts and legal proceedings

• Other crew members (with your consent and privacy settings)
• Shared flight information with assigned crew

We require all third parties to maintain appropriate security measures and use data only for specified purposes.

9. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including:

• Google Firebase services (protected by Google's Data Processing Terms)
• Cloud infrastructure providers

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions for countries with adequate protection
• Additional technical and organizational measures

All international transfers comply with GDPR requirements and include appropriate safeguards to protect your personal data.

10. Your Rights Under GDPR

As a data subject, you have the following rights:

Right of Access (Article 15): You can request a copy of your personal data we hold.

Right to Rectification (Article 16): You can correct inaccurate or incomplete personal data.

Right to Erasure (Article 17): You can request deletion of your personal data in certain circumstances.

Right to Restrict Processing (Article 18): You can limit how we process your personal data.

Right to Data Portability (Article 20): You can receive your data in a structured, machine-readable format.

Right to Object (Article 21): You can object to processing based on legitimate interests.

Right to Withdraw Consent (Article 7): You can withdraw consent for processing at any time.

Right to Lodge a Complaint: You can file a complaint with your local data protection authority (Autoriteit Persoonsgegevens in the Netherlands).

To exercise these rights, contact us at privacy@crewbuddy.nl or +31 6 5775 4680. We will respond within 30 days.

11. Data Security

• Encryption in transit and at rest
• Secure authentication and access controls
• Regular security monitoring and updates
• Secure cloud infrastructure

• Staff training on data protection
• Access controls and need-to-know basis
• Regular security assessments
• Incident response procedures

• Airline system credentials are stored securely on your device only
• Biometric authentication where available
• Automatic logout after inactivity

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Autoriteit Persoonsgegevens within 72 hours
• Notify you directly if the breach poses a high risk to you
• Document all breaches in our internal records

While we strive to protect your data, no method of transmission or storage is 100% secure. Please contact us immediately if you suspect any security breach.

12. Children's Privacy

This App is intended for KLM crew members who are at least 18 years old. We do not knowingly collect personal information from children under 16.

If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete such information promptly.

If you believe we have collected information from a child under 16, please contact us immediately at privacy@crewbuddy.nl.

13. Cookies and Tracking

The App uses local storage and tracking technologies for:

• Authentication and session management
• App preferences and settings
• Security and fraud prevention

• App usage statistics (anonymized)
• Performance monitoring
• Crash reporting and debugging

• Google Firebase Analytics
• Google Firebase Performance Monitoring

You can control tracking through your device settings and app preferences. Disabling certain tracking may affect app functionality.

14. Disclaimer of Warranties

The App is provided "AS IS" and "AS AVAILABLE" without warranties of any kind, whether express, implied, or statutory, including but not limited to:

• Implied warranties of merchantability
• Fitness for a particular purpose
• Non-infringement
• Accuracy or completeness of information

We do not warrant that the App will be uninterrupted, error-free, or free of viruses or other harmful components.

15. Flight Data Disclaimer

• May not reflect real-time or actual flight operations
• Should NOT be used for operational flight decisions
• May differ from official airline or aviation authority data
• Is subject to change without notice

You must always verify flight information through official channels before making any decisions based on flight data. The developer accepts no responsibility for any consequences arising from reliance on flight information displayed in this App, including but not limited to missed flights, incorrect scheduling, or any operational decisions.

16. Limitation of Liability

To the maximum extent permitted by applicable Dutch and European Union law:

We shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to:

• Loss of profits or income
• Loss of data
• Loss of business opportunities
• Personal injury or emotional distress (except where required by law)
• Missed flights or travel arrangements
• Any damages arising from reliance on App information

Our total cumulative liability for any claims arising from your use of the App shall not exceed the total amount you have paid for the App in the twelve (12) months preceding the claim.

You acknowledge that this App is provided free of charge and that the limitations of liability reflect the free nature of the service.

Nothing in these terms shall exclude or limit liability for death or personal injury caused by negligence, fraud, or any other liability that cannot be excluded under Dutch law (Article 6:233 Burgerlijk Wetboek).

17. Indemnification

You agree to indemnify, defend, and hold harmless CrewBuddy, and any affiliates, from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising from:

• Your use of the App
• Your violation of these terms
• Your violation of any third-party rights
• Any content you submit through the App
• Your misuse of credentials or third-party services accessed through the App

18. Third-Party Services

This App integrates with third-party services including:

• Google Firebase (authentication, storage, messaging)
• Schiphol Airport APIs
• Weather data providers
• Third-party eSIM connectivity provider (for mobile data plans)

We are not responsible for the availability, accuracy, or functionality of these third-party services. Any issues with these services are governed by their respective terms and privacy policies.

Schedule data is imported from your personal calendar or entered manually. We do not directly access airline operational systems.

19. eSIM Data Plans

CrewBuddy offers mobile data plans (eSIMs) through the App via a third-party eSIM connectivity provider. By purchasing or using an eSIM through the App, you agree to the following terms:

eSIM data plans are provided and fulfilled by a third-party network aggregator. CrewBuddy acts as an authorized reseller and is not a telecommunications provider or mobile network operator.

We do not guarantee network quality, coverage, capacity, connection availability, or uninterrupted connectivity. Network performance depends on the local mobile network operator at your destination and is outside our control.

• All eSIM purchases are final and non-refundable once the eSIM profile has been delivered or installed
• Prices are displayed in the currency shown at the time of purchase and may change due to market conditions, exchange rates, or operational costs
• Data plan validity begins upon activation (connection to a supported network), not at the time of purchase, unless otherwise specified

• Data plans are subject to the fair use policies of the underlying network provider
• Usage statistics displayed in the App are approximate and may not reflect real-time consumption
• Once your data allowance is depleted or your plan expires, connectivity will cease until you purchase additional data

• Ensure your device supports eSIM technology before purchasing
• Follow the installation instructions provided in the App
• Enable data roaming on your device for the eSIM to function abroad
• You are solely responsible for any charges incurred on your primary SIM while using the eSIM

CrewBuddy shall not be liable for any loss, damage, or inconvenience arising from the use of or inability to use an eSIM plan, including but not limited to network outages, connectivity issues, or incorrect usage data. Our total liability for eSIM-related claims shall not exceed the purchase price of the affected eSIM plan.

When you purchase an eSIM, your email address and order details are shared with our eSIM provider to fulfill the transaction. Usage data is retrieved from the provider to display your remaining balance and consumption in the App. Please refer to Sections 2 and 8 for details on data collection and sharing.

20. Governing Law and Jurisdiction

This Privacy Policy and any disputes arising from it shall be governed by and construed in accordance with the laws of the Netherlands, without regard to conflict of law principles.

Any disputes shall be submitted to the exclusive jurisdiction of the competent courts in Amsterdam, the Netherlands.

If any provision of this policy is found to be unenforceable, the remaining provisions shall continue in full force and effect.

21. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.

• We will notify you of significant changes through the App
• Updated policies will be posted with a new effective date
• Continued use constitutes acceptance of changes

We recommend reviewing this policy periodically to stay informed about how we protect your information.

22. Contact Information

For questions about this Privacy Policy or our data practices, contact:

Dutch Data Protection Authority:
If you are in the Netherlands and have concerns, you may contact:
Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl

EU Data Protection Authorities:
If you are in another EU country, you may contact your local data protection authority.

We are committed to resolving any privacy concerns promptly and transparently.