Privacy Policy

This policy explains how Rumbo handles your personal information when you join the waitlist at flyrumbo.com.

1. Who controls your data

The controller of your personal data is:

Alvaro Paolini, acting as a sole trader under the trading name FlyRumbo.

Address: 77 Camden Street Lower, Dublin 2, D02 XE80, Ireland.

For any question about your personal data, write to privacy@flyrumbo.com.

2. What data we collect

While Rumbo is in pre-launch, we collect a single piece of data when you join the waitlist:

• Your email address.

Nothing else. We do not ask for your name, location, phone number, or any other personal information. We do not collect data about you automatically through tracking cookies, third-party analytics, or advertising pixels.

flyrumbo.com may use cookies that are strictly necessary for the technical operation of the site and for security. We do not use tracking, analytics, or advertising cookies. There is no cookie banner because there is nothing to consent to beyond what is strictly necessary.

3. How we use your email and our legal basis

We use your email for one purpose only: to notify you when Rumbo is available.

The legal basis for this processing is your explicit consent, under Article 6(1)(a) of the General Data Protection Regulation (GDPR). When you enter your email and click “Notify me”, you give that consent through a clear, affirmative action.

We will not use your email for anything else. We do not share it with third parties for marketing. We will not send you newsletters, promotional content, or surveys while you are on the waitlist. One single notification: when Rumbo is ready to use.

We do not carry out profiling, nor do we make automated decisions that produce legal or significant effects on you based solely on the automated processing of your data.

4. Who else processes your data

For the waitlist to work, your email is stored and processed with the help of technical service providers. These are our current data processors:

• Supabase — database storage. Servers located in Ireland, within the European Union.
• Resend — sending the launch notification email. Company based in the United States. The international transfer of data is covered by the Standard Contractual Clauses approved by the European Commission.
• Vercel — hosting of flyrumbo.com. Company based in the United States, covered by the same Standard Contractual Clauses.
• Cloudflare — DNS management and email routing. Company based in the United States, covered by the same Standard Contractual Clauses.

Each of these providers has signed a Data Processing Agreement (DPA) that meets GDPR requirements. None of them uses your data for their own purposes.

We do not sell your data. We do not transfer it for advertising. We do not share it with social networks or advertisers.

5. How long we keep your email

We keep your email while you are on the waitlist, until the first of these two events occurs:

• 12 months after the public launch of Rumbo, or
• the moment you ask us to delete it.

After either event, your email is permanently removed from our databases.

6. Your rights

The GDPR grants you specific rights over your personal data. You can exercise any of them by writing to privacy@flyrumbo.com. We will respond within 30 days of your request.

You have the right to:

• Access the personal data we hold about you.
• Rectify incorrect or outdated data.
• Erase your data (also known as the “right to be forgotten”).
• Receive your data in a structured, portable format so you can take it to another service.
• Object to the processing or restrict it.
• Withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, but it stops any further processing. Functionally, it is the same as asking to be removed from the waitlist.
• Lodge a complaint with a data protection authority. The competent authority for Rumbo, given our address in Ireland, is the Irish Data Protection Commission (dataprotection.ie). If you live in another country in the European Economic Area, you may also contact the authority of your country of residence.

7. Security

Your email is stored in databases protected with encryption in transit (TLS) and at rest. Access is limited to the technical providers listed in section 4 and to Alvaro Paolini as controller. No other employees or third parties have access to this data.

No system is invulnerable. In the event of a security breach affecting your personal data, we will notify you without undue delay, in line with GDPR requirements.

8. Children

Rumbo is aimed at student pilots. The minimum age to begin private pilot training is generally 17. We do not knowingly collect personal data from children under 16. If you are under 16, please do not join the waitlist. If we discover that we have collected data from a minor by mistake, we will delete it without delay.

9. Changes to this policy

If we update this policy, we will change the “Last updated” date at the top of the document and, when changes materially affect how we handle your data, we will notify you by email before those changes take effect. Previous versions can be requested at privacy@flyrumbo.com.

10. Contact

Questions, exercise of rights, deletion requests?

privacy@flyrumbo.com

Alvaro Paolini
77 Camden Street Lower, Dublin 2, D02 XE80
Ireland