CofA Training

Who we are

This platform, training.cofa.aero, is operated by CofA BV, Nieuwpoortsesteenweg 943, 8400 Ostend, Belgium, VAT BE 1028.511.982 ("CofA", "we"). For anything related to your personal data, contact info@cofa.aero.

What we store

• Account details: your name, e-mail address, preferred language and any optional profile fields you fill in yourself.
• Training records: enrolments, progress, attempts and scores on tests and exercises, course completions, and issued certificates (your name, the course, the date and a unique verification code).
• Technical logs: activity log entries with IP address and timestamps, kept for security and for evidencing training activity.

The platform uses only the functional cookies needed to keep you signed in. There are no tracking, analytics or marketing cookies.

What we use it for

• to give you access to the training that you or your employer arranged (performance of a contract);
• to issue certificates and keep the training records that you or your employer may need to demonstrate compliance to aviation authorities under EASA regulations (legitimate interest and, for your employer, legal obligations);
• to keep the platform secure and prevent abuse (legitimate interest).
• to remind you by e-mail when one of your certificates is about to expire, so that you can arrange recurrent training before it lapses. Such a reminder names the follow-up course that renews the qualification (legitimate interest).

We do not sell your data and we make no automated decisions about you. The only e-mails we send concern your account, your courses and expiring certificates — we send no newsletters or advertising.

Who can see your data

• CofA staff who deliver the trainings and administer the platform;
• if your employer booked the training: the designated contact at your employer, who sees the progress, results and certificates of the employer's own staff only;
• aviation authorities receive training records via your employer during audits, or from us when we are legally required to provide them.

There are no other recipients.

When your employer arranges your training

Where your employer has concluded a data processing agreement with us, your employer decides on your training record (enrolments, progress, results and certificates) and we keep it on your employer's behalf. We remain responsible for your account, the security of the platform and its technical logs.

Where your data is kept, and how it is protected

All data is stored on servers within the European Union (hosted by Hetzner in Finland). Connections are encrypted (TLS). Our administrative tools are reachable only through a private network, and our internal partner portal only after sign-in with a one-time code. Backups are made daily to a secured CofA system in Belgium and rotate automatically: no backup copy is older than about five weeks.

Access from outside the EU

Your data is stored inside the European Union, but three of our providers may access or process it from outside:

• Zoho, which provides our mailboxes, may allow its group companies in India to access data for support and debugging. This is set out in our data processing agreement with Zoho Corporation B.V. (Netherlands).
• Brevo, which sends the platform's e-mails, may use group companies outside the EU, notably in the United States and India, for support and maintenance.
• Cloudflare, Inc. (United States), which provides the sign-in and the secure connection for our internal partner portal, where CofA staff follow training progress and results, may process that data outside the EU.

These transfers take place under the safeguards in each provider's data processing terms, such as the European Commission's standard contractual clauses.

Service providers

We use a small number of providers that process data on our behalf, under EU data processing terms: Hetzner Online GmbH (hosting, Germany/Finland), Brevo — Sendinblue SAS (platform e-mail such as account and course notifications, France), Zoho Corporation (our mailboxes when you e-mail us, EU datacentres) and Cloudflare, Inc. (DNS and hosting of cofa.aero, and the sign-in and secure connection for our internal partner portal).

How long we keep it

• Training records and certificates: five years after course completion — the audit trail that aviation regulation expects. Longer only where your employer's contract requires it.
• Account details: for as long as your account is active; removed on request (see below).
• Backups: rotate automatically; the oldest copy is about five weeks old.

Your rights

Under the GDPR you can request access to (and an export of) your data, have it corrected, object to or restrict processing, and ask for erasure. You can do this from your profile on this platform (Privacy and policies → Data requests) or by e-mailing info@cofa.aero. Training records and certificates that form part of the regulatory audit trail may need to be retained for the period above even if you ask for erasure. You can also lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be) or the supervisory authority of your own EU country.

Changes to this notice

When this notice changes, a new version is published on the platform and you will be asked to agree again at your next sign-in. Version: 4 October 2026.