Privacy policy of hangarfield

Last updated: 19.10.2026 (Entwurf A0d vom 18.10.2026)

1. Controller. Enrico Bicheler, sole proprietorship "Great Circle Track", c/o IP-Management #11185, Ludwig-Erhard-Str. 18, 20459 Hamburg, Germany · kontakt@hangarfield.com. We have not appointed a data protection officer because there is no legal obligation to do so.

2. In short. hangarfield is a market overview of used aircraft in Europe. Listings come from (1) dealers and private sellers who post them with us, (2) dealers who expressly authorise us or send a data feed, and (3) listings dealers publish on their own websites, which we show with basic data and a link to the dealer's page. We use no analytics or advertising cookies and no tracking services.

3. Visiting our website. Our hosting provider processes technically necessary data (IP address, time, URL, browser and operating system, referrer) to deliver the site, detect attacks and fix errors — Art. 6(1)(f) GDPR; retention according to the provider. Cookie-free audience measurement: we count page views per page type and country using a non-reversible daily hash of IP address, user agent and a daily random value; the hash and the random value are deleted after 24 hours, only totals remain. Nothing is stored on or read from your device. Art. 6(1)(f) GDPR.

4. Data sources and crawler — information under Art. 14 GDPR. Our program "HangarfieldBot" retrieves publicly accessible listing pages of aircraft dealers in Europe. It obeys robots.txt, does not bypass technical barriers, creates no accounts, and requests at most one page per second. The list of websites is at hangarfield.com/en/crawler/sources. Data: company name, company address, general company contact (e.g. info@), and per listing manufacturer, model, variant, year, hours, price with date and price basis, location as region or airfield, listing URL and URLs of up to three thumbnails. We do not copy or display descriptions, employee names or extensions, registration marks, serial numbers or documents. Registration marks and serial numbers are turned into a non-reversible keyed hash solely to detect the same aircraft at several dealers; the clear text is never stored or shown, the hash is deleted 7 days after the listing disappears. We do not know the owners behind a registration mark and therefore do not inform them individually; this notice replaces that (Art. 14(5)(b) GDPR). Purpose: a market overview in which publicly offered aircraft can be found and every listing leads to its seller. Legal basis: Art. 6(1)(f) GDPR — dealers published this data themselves to sell, we show only basic data and forward every visit to the dealer, and dealers can object with one click. Source: the dealer's website, named on each listing ("via {dealer}"). Objection: at hangarfield.com/quelle/{id} each dealer sees which listings we show, can have them corrected or object; an objection takes effect within 5 minutes and is confirmed in writing within 48 hours; an e-mail to kontakt@hangarfield.com is sufficient. Dealers receive this information individually no later than 30 days after the first retrieval and no later than the day of first display.

5. Images from the dealer's server. For listings from dealer websites we show up to three thumbnails that your browser loads directly from the dealer's server; we do not copy them. The dealer's server receives your IP address, time, user agent and the fact that you came from hangarfield (domain only). The dealer is responsible for that processing; we trigger it because you want to see that dealer's listing — Art. 6(1)(f) GDPR. If the image server is outside the EU/EEA in a country without an adequacy decision, the image loads only after your click.

6. Accounts and listings. For an account (dealer, private seller, hangarfield Plus) we process e-mail, name, for dealers company and address, your listings including photos, and login times — Art. 6(1)(b) GDPR. Login is by e-mail link, no password. Dealers choosing "show everything" make a declaration about their image rights, which we keep as evidence (Art. 6(1)(b) and (f)). Contact requests via our form pass your name, e-mail, optional phone and message to the seller (Art. 6(1)(b)); we do not store the message after delivery. Price alerts without an account require confirmation by link (double opt-in) — consent, Art. 6(1)(a); withdraw any time via the link in every e-mail. Paid services are processed by Stripe Payments Europe Ltd., Dublin, Ireland, as an independent controller; we receive no card data. For invoicing and accounting we process name, address, e-mail and VAT ID if applicable (Art. 6(1)(b) and (c) GDPR with Section 147 German Fiscal Code, Section 257 German Commercial Code).

7. Messages and reports. E-mails and reports via "Report content" are processed to answer and handle them (Art. 6(1)(b), (c), (f) GDPR; for reports under the Digital Services Act Art. 6(1)(c) with Art. 16 and 17 of Regulation (EU) 2022/2065).

8. Recipients. Processors under Art. 28 GDPR: Supabase Inc. (database in Frankfurt; EU Standard Contractual Clauses for access from the US) · Vercel Inc. (hosting via Frankfurt and a global network; EU-U.S. Data Privacy Framework) · Resend (Plus Five Five, Inc.; e-mails sent via Ireland, logs in the US; EU-U.S. Data Privacy Framework) · Squarespace, Inc. with Mailgun Technologies, Inc. (forwarding of our contact addresses) and Google (Gmail mailbox in which we read and answer your messages) — EU-U.S. Data Privacy Framework (Squarespace, Mailgun) · Hetzner Online GmbH, Germany (servers). No other disclosure; in particular, no API access to dealer data for third parties.

9. Retention. Dealer-website listings: as long as available on the dealer's site, then 7 days as "no longer available"; then image URLs, page URL, hashes and the link to the dealer are deleted, and for up to 14 months only manufacturer, model, year, hours, price, country and date remain for market statistics, thereafter only as averages of at least five listings. Dealer objection: technically within 5 minutes, confirmation within 48 hours; the domain stays on our block list (domain, date, reason only). Own listings: until deleted or expired, then 30 days. Accounts: 30 days after termination. Price alerts: until unsubscribed; unconfirmed sign-ups after 7 days. Evidence (dealer consents, contact history, collection log, DSA reports): 3 years from the end of the calendar year. Invoices and accounting records: 8 years; business letters 6 years. Backups: deleted data disappears from backups within 7 days.

10. Your rights. Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), withdrawal of consent (7(3)). Right to object (Art. 21): where we rely on legitimate interests (Art. 6(1)(f)), in particular for collecting dealer listings, you may object at any time on grounds relating to your particular situation. Dealers may object without giving reasons at hangarfield.com/quelle/{id} or by e-mail; we always comply.

11. Complaints. You may lodge a complaint with a supervisory authority; ours is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Stuttgart, Germany.

12. Cookies and local storage. Only what is strictly necessary for the service you request: a login cookie when you log in, and — only if you choose it — your setting "load images on click" or your day/night mode choice in your browser's local storage (Section 25(2) no. 2 German TDDDG). No consent banner is needed.

13. Automated decisions. None with legal effect (Art. 22 GDPR). Programs help structure listings and flag suspicious ones for review; a listing is blocked only after human review.

14. Obligation to provide data. None for browsing and search; e-mail for an account; name and billing address for paid services.