Privacy policy

Draft of 30 October 2026. This version has not yet been legally reviewed and may change before final publication. This English version is provided for convenience; the German version is authoritative.

1. General information

This privacy policy explains how personal data is processed when you use the website skua.blue and the SKUA platform offered there for organising and running gliding competitions.

Personal data is any information relating to an identified or identifiable natural person.

2. Controller and privacy contact

Holzmann Softwareentwicklung
Achim Holzmann
Kocheler Str. 39
82418 Murnau am Staffelsee
Germany

Email: info@skua.blue
Phone: +49 170 1240376

Please send privacy requests to: info@skua.blue

3. Who is responsible for what?

SKUA distinguishes between data belonging to your platform-wide account and data created when you take part in a particular competition.

We, the operator, are the controller for:

• your user account, sign-in and the security of the platform
• your profile (for example name, contact details, address, date of birth, gender, club, licence numbers, profile picture)
• the emergency contact stored in your profile
• your aircraft, which you create once and use in several competitions
• your documents that you reuse for several competitions (for example licence or medical)
• your profile consents (for example to the public participant list)
• technical logs

The organizer of a competition is the controller for the data created when you take part in their competition, in particular:

• your registration and its history, including the profile details copied into the registration
• the release of your documents for their competition
• declarations you make when registering
• invoices and payments for the competition
• daily operations, start lists, outlandings, retrieves, flight data (IGC) and results
• messages and announcements within the competition
• pictures in the competition gallery
• access to your emergency contact during the competition

For this data we act as the organizer's processor under Art. 28 GDPR. The organizer's contact details are shown on the competition page. You can send requests about this data to the organizer or to us; we will forward them.

4. Data processed

Depending on how you use the platform, we process in particular:

• Account data: email address, password if used (stored only as a hash), roles and permissions, session data
• Profile data: first and last name, title, mobile and phone number, address, country, date of birth, gender, club, association, IGC ID, FAI licence number, profile picture, tracking link
• Emergency contact: name, phone number and email address of a person you nominate. This is data of a third party; please let that person know.
• Aircraft data: registration, type, competition ID, FLARM ID
• Competition data: class, registration status, crew and helpers, start list, rankings and results
• Flight data: IGC files with the recorded flight path (positions and times) and the details in the file header (for example pilot name and aircraft)
• Location data: the position given in an outlanding report (latitude, longitude, accuracy)
• Documents: uploaded evidence such as licence, medical certificate, insurance certificate, copy of an ID document, under-18 consent form or anti-doping certificate, as required by the organizer
• Declarations: your acceptance of the organizer's declarations when registering, with time, text version, language and IP address (as evidence)
• Communication: chat messages within a competition, notifications, emails sent, briefing attendance
• Payment data: invoices, amounts, payment status, the organizer's bank statement imports
• Pictures: photos uploaded by you or others to a competition gallery
• Technical data: times of sign-in and sign-out, change log entries (without IP address), temporarily hashed IP addresses and email addresses for abuse protection, server logs

Health data (medical certificate)

Organizers may require a medical certificate (aviation medical). This document contains health data and therefore special categories of personal data under Art. 9 GDPR. It is visible only to you and to the organizer's staff who are authorised to check documents.

Anti-doping certificate and ID copy

The document type "anti-doping certificate / athlete agreement" is intended as evidence of completed training or a signed agreement and, for that purpose, contains no health data. Please do not upload medical exemptions or findings.

Minors

People under 18 may take part in competitions. If a participant is under 18 on the first scoring day, SKUA requires a consent form (U18), provided a date of birth is stored. A minimum age or parental consent when creating an account is currently not provided for.

5. Purposes and legal bases

5.1 User account and sign-in

We process data to create and manage your account, to sign you in and to secure the platform. The legal basis is Art. 6(1)(b) GDPR. Measures against abuse (for example limiting sign-in attempts) are based on Art. 6(1)(f) GDPR; our legitimate interest is the security of the platform.

You sign in with a link sent to your email address or with a password. Sign-in via Google, Apple or SeeYou (Naviter) is technically prepared but currently not enabled on skua.blue.

5.2 Profile, aircraft and documents

We store your profile, your aircraft and reusable documents so that you can use them for several competitions. The legal basis is Art. 6(1)(b) GDPR; for health data see section 4.

5.3 Taking part in competitions

When you register for a competition, we process the data on behalf of the organizer to organise and run the competition. The organizer determines the purposes and legal bases, usually Art. 6(1)(b) GDPR. On registration, SKUA copies your profile details into the registration so that the state at the time of registration remains traceable.

5.4 Emergency contact

The organizer's staff with a special permission see your emergency contact only in an emergency, for example if you are overdue after a flight. Every access is logged. After the period set by the organizer following the competition, access is no longer possible (see section 10).

5.5 Outlandings and location

When you report an outlanding, your browser asks for your location. If you agree, SKUA sends the position to the competition management and the retrieve crew. The position is stored with the report. Without your agreement you can enter the position manually. For retrieves, SKUA shows links to Google Maps; Google only receives data when you open such a link.

5.6 Public pages: participant list, results, gallery, tasks

• Participant list: name, club, country, aircraft type, competition ID, registration and optionally your profile picture appear only with your consent (Art. 6(1)(a) GDPR). Without consent you are only counted as "anonymous". The list is excluded from search engines. You can withdraw your consent in your profile at any time; it takes effect immediately.
• Results: results including pilot names are taken from Soaring Spot and shown publicly.
• Gallery: pictures appear publicly only once released, with the photographer's credit and without metadata (EXIF). The gallery is excluded from search engines.
• Tasks: the daily task of a competition is publicly available.

Publicly available information can be stored and redistributed by third parties. We have no influence on such copies.

5.7 Invoices and payments

SKUA creates invoices for entry fees in the name of, and with the invoice details of, the organizer. Online payment is currently not enabled on skua.blue; you pay by bank transfer directly to the organizer. The legal bases are Art. 6(1)(b) GDPR and, for retention obligations, Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 14b of the German VAT Act (UStG).

5.8 Emails and notifications

We send messages about your account, registration, security, competition and payments. The legal basis is Art. 6(1)(b) GDPR; we send the organizer's announcements on their behalf. Emails sent are logged. We do not send marketing emails.

5.9 Push notifications

SKUA can send notifications as push messages to your device if you allow this in your browser. This feature is currently not enabled on skua.blue. Once enabled: we store your device's push address and a device label. The message (title, text, link; depending on the occasion also names, competition IDs or an outlanding position) is delivered encrypted via your browser vendor's push service (for example Google, Apple, Mozilla or Microsoft).

5.10 Technical security and logs

We log write operations (who, when, what) in an immutable change log, without IP address. For sign-in events it contains the email address. To protect against abuse we briefly store hashed identifiers of IP addresses and email addresses. The legal basis is Art. 6(1)(f) GDPR.

6. Recipients and service providers

6.1 In use

• Hosting and file storage: Hetzner Online GmbH, Gunzenhausen, Germany. Servers and object storage in the Helsinki data centre, Finland (EU). Processor.
• Email delivery: Brevo (Sendinblue SAS), Paris, France. Processes email address, content and delivery information. Processor.
• Maps: on the public task page and for outlandings, your browser loads map tiles directly from OpenFreeMap (openfreemap.org). The service receives your IP address and the map area shown.
• Soaring Spot (Naviter d.o.o., Slovenia): if a competition is connected to Soaring Spot, SKUA reads the competition, classes, tasks and results (including pilot names) from Soaring Spot using the organizer's credentials. During setup SKUA also reads the public competition page. A function to forward IGC files to Soaring Spot exists but is currently not enabled on skua.blue.
• Open Glider Network: SKUA downloads the public list of FLARM IDs. No data about you is transmitted.

6.2 Currently not in use

Technically prepared but not enabled on skua.blue: online payment via Stripe, sign-in via Google, Apple or SeeYou, push notifications, error monitoring (Sentry-compatible service), forwarding of IGC files to Soaring Spot. This policy will be updated before any of these is enabled.

7. Transfers to third countries

The service providers in use process data within the EU. We cannot currently state the processing location of OpenFreeMap conclusively. If Stripe, push services or sign-in services are enabled later, data may be transferred to third countries, in particular the USA; such transfers will only take place in accordance with Art. 44 et seq. GDPR.

8. Cookies and storage on your device

SKUA only uses storage technologies that are strictly necessary for the service you request (Section 25(2) no. 2 of the German TDDDG). We do not use analytics or advertising cookies and therefore do not show a consent banner.

• Cookies: session (authjs.session-token, 30 days, readable only by the server), language, colour scheme, view and workspace, field mode, onboarding step (30 minutes) and a short-lived cookie for sign-in with Apple (currently not enabled).
• Offline storage: so that the pilot view and the field tablet work without a network, a service worker stores selected pages on your device, and reports made without a network wait in a local database (IndexedDB) for up to two days to be sent. Field pages may contain the mobile numbers of the day's pilots and retrieve crews. When you sign out, offline storage and pages are deleted; reports not yet sent only after confirmation.
• Local storage: interface settings (for example column widths, push hint) and, during onboarding, temporarily your form input.

9. Automated decisions

SKUA makes no decisions based solely on an evaluation of you as a person. Depending on the organizer's settings, deadlines can take effect automatically: if an assured entry fee is not paid on time, the place may lapse and the next person on the waiting list may move up.

10. Retention and deletion

We store data only as long as necessary for its purpose or as required by law.

Account and profile: until you delete your account. On deletion we remove your profile, documents, pictures, profile consents, sessions and push addresses. Registrations already submitted, messages and email logs are pseudonymised. Invoices and payment records, declarations made on registration including the IP address (as evidence), the change log and tow records remain unchanged. Deletion is not possible while a registration is active or invoices or refunds are open.

After a competition (from the last scoring day, adjustable by the organizer between 1 and 730 days):

Further periods:

Without a defined deletion period the following are currently stored: registrations and their copies of profile details, IGC files and results (as scoring evidence), public gallery pictures (until withdrawn by the photographer), declarations made on registration including the IP address, email logs, chat messages, outlanding positions, notifications, push addresses, the change log, and invoices and payment records (statutory retention under Section 147 AO and Section 14b UStG; deletion after expiry is not yet implemented).

11. Your rights

Subject to the legal requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and to withdraw consent with effect for the future (Art. 7(3)).

• Rectification: you can change your profile details yourself. Changing your email address is currently only possible on request.
• Erasure: you can delete your account yourself, and individual documents as well.
• Withdrawal: you withdraw your consent to the public participant list and to your profile picture there in your profile.
• Access and portability: please contact info@skua.blue. A self-service export is currently not available.

For data of a specific competition the organizer is responsible; we support them.

12. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
https://www.lda.bayern.de

13. Obligation to provide data

An email address is required for an account; registering for a competition requires the details the organizer asks for. Without these details the respective function cannot be used. Voluntary details are marked as such.

14. Changes

We update this privacy policy when the processing, the services used or the legal requirements change. The current version is available on skua.blue.