Privacy policy

Draft, version 0.1 of 7 November 2026. To be reviewed before publication.

1. Who we are

Vlindair B.V. (“Vlindair”, “we”) is the controller of the personal data described in this policy. Nassaupark 9, 1405 HN Bussum, the Netherlands. Dutch Chamber of Commerce registration 42111040. For any question about your data, email contact@vlindair.eu. We have not appointed a data protection officer; the founders answer privacy questions personally.

2. What we collect, and why

We only collect personal data that you type into one of the forms on this site. Nothing is collected in the background: no tracking cookies, no analytics, no advertising identifiers.

The Let’s Fly Electric Pledge. First name, email address, the route you would fly (two airports) and, if you choose to add them, your home airport or postcode, whether you mostly travel for business or leisure, and how often you would fly the route. We also record the page you pledged from, the time of your consent and the time you confirmed your email address. Purpose: to count demand for electric flights per route, to keep you informed about that route, and to show airports, aircraft manufacturers and investors that people want to fly electric. Legal basis: your consent (GDPR article 6(1)(a)), given when you submit the form and confirmed when you click the link in our email.

Future Access Agreement interest (organisations). Company, contact name, role, email address, number of employees, number of short-haul business trips per year, the routes you travel most and whether you report under the CSRD. Purpose: to contact you about a Future Access Agreement and to understand organisational demand per route. Legal basis: steps taken at your request before entering into a contract (article 6(1)(b)) and our legitimate interest in developing the airline (article 6(1)(f)).

Contact form, partnership enquiries and data room requests. Name, email address, organisation, role, subject and your message; for data room requests also the type of investor you are and what you bring beyond capital. Purpose: to answer you. Legal basis: our legitimate interest in responding to people who contact us (article 6(1)(f)), and for data room requests the steps taken at your request before any agreement (article 6(1)(b)).

Press list. Name, outlet or organisation and email address, with the times of sign-up and confirmation. Purpose: to send you our press releases, including embargoed ones. Legal basis: your consent (article 6(1)(a)), confirmed by email.

Future roles (careers). Name, email address, your field, optionally a LinkedIn profile and a message. Purpose: to let you know when roles in your field open. Legal basis: your consent (article 6(1)(a)).

Technical data. To protect the forms against abuse, your IP address is used in hashed form for a few minutes to limit the number of submissions from one connection. It is not stored with your data. The web server keeps standard access logs for security for a short period.

3. How we use pledge data, and what we share

Your pledge is used in two ways. First, as a number: we add it to the demand for your route. What we show airports, aircraft manufacturers, regional authorities and investors is aggregated, for example “412 people have pledged Rotterdam – London City”, together with anonymous breakdowns such as the share of business travellers or the distribution of home regions. We never pass on your name, email address or any other data that identifies you to any of these parties without asking you first and getting your explicit consent.

Second, to keep you posted: we email you about the route you pledged, a few times a year at most, and only about that route unless you tell us otherwise. Every email has a link to withdraw your pledge.

4. Who processes data on our behalf

We use a small number of service providers (processors) who act on our instructions under a data processing agreement: our web hosting provider in the Netherlands, which stores the website and its database, and our email service, which delivers the confirmation and update emails. [To complete: provider names.] We do not sell personal data and we do not share it with advertisers.

5. Where your data is stored

Our website, its database and our email are hosted in the European Union. If a provider ever processes data outside the EU or EEA, we only allow it under the European Commission’s standard contractual clauses or an adequacy decision.

6. How long we keep your data

• Pledges: until you withdraw. Pledges that are not confirmed by email are deleted automatically after 30 days. When you withdraw, your name, email address and other identifying details are removed after 30 days; the route and the dates stay as anonymous statistics.
• Future Access Agreement interest: until you ask us to remove it, or 24 months after our last contact.
• Contact, partnership and data room messages: 24 months after the conversation ends, unless an agreement follows.
• Press list: until you leave the list. Sign-ups that are not confirmed are deleted after 30 days.
• Future roles: until you ask us to remove you, or 24 months after sign-up.
• Server access logs: at most 30 days.

7. Cookies

This site sets no tracking or analytics cookies. The only cookies are the technical ones WordPress needs when someone logs in to manage the site; visitors never receive them. We do not use embedded third-party content that sets cookies.

8. Your rights

Under the GDPR you can ask us at any time for access to the personal data we hold about you, for correction, for erasure, for restriction of processing, for a copy in a portable format, and you can object to processing based on our legitimate interests. Where processing is based on your consent (the pledge, the press list, future roles), you can withdraw that consent at any time: use the link in any of our emails, or email contact@vlindair.eu. Withdrawing does not affect what happened before.

We answer within one month. If you think we handle your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

9. How we protect your data

The site is served over HTTPS only. Form submissions are checked against abuse, personal data is stored in a database that only administrators can reach, exports are limited to administrators, and access to the site is protected with two-factor authentication. Files belonging to unpublished news items are not reachable from the web.

10. Children

Our services are meant for adults. We do not knowingly collect data from children under 16; if you believe a child has pledged, email us and we will remove the pledge.

11. Changes to this policy

We update this policy when our processing changes, and we put the date of the latest version at the top. For substantial changes that affect your pledge, we tell you by email.