Last updated: 8 October 2026
This Policy applies to the personal data that the Club processes through the website volavela.com (the “Website”), in in-person purchases at its premises, and in enquiries sent to it by email.
When an outreach flight, a gift voucher or an introductory course (pack of 10 flights) is purchased, whether through volavela.com or in person at the Club’s premises, and on the day of the activity, we process the following data for the purposes indicated:
| Data | Purpose | Legal basis |
|---|---|---|
| Data of the person making the purchase: first name, surname, email and telephone number (mandatory). | Manage the purchase, issue the receipt or invoice, and make contact to confirm, change or cancel the flight date. | Performance of a contract (art. 6.1.b GDPR). |
| Data of the person who will fly: first name and surname (mandatory), provided by the person making the purchase. | Identify the person on the voucher and organise the flight. | Performance of a contract (art. 6.1.b GDPR) and, where the person flying is not the purchaser, the Club’s legitimate interest in providing the contracted service for that person’s benefit and ensuring their safety (art. 6.1.f GDPR). |
| Order data: flight date and time and type of service (individual flight or pack). | Manage the booking and provide the service. | Performance of a contract (art. 6.1.b GDPR). |
| Tax invoicing data, only if the Customer requests an invoice with tax details | Comply with tax and accounting obligations | Legal obligation (art. 6.1.c GDPR) |
| Physical data of the person who will fly (weight and height), mandatory at purchase and included on the voucher, which are used for flight operations and, once the flight has taken place, to deal with incidents or claims, and not to assess the person’s state of health. | Choose the right glider for the person who will fly and carry out the load, balance, capacity or operational safety calculations and checks needed to provide the service. Automatically check that they are within the safety limits shown on the purchase form. Once the flight has taken place, keep them on the voucher record, which only authorised Club staff can access, to deal with incidents or claims. | Performance of the contract (art. 6.1.b GDPR), provided the data is objectively necessary to provide the service. That automatic check is necessary for entering into the contract (art. 22.2.a GDPR). Once the flight has taken place, their retention is based on the Club’s legitimate interest in dealing with incidents and claims (art. 6.1.f GDPR). |
| Information and risk acceptance document signed on the day of the activity (name, signature and date; if the person flying is a minor, also the details and signature of their parent or legal guardian). | Prove that the person has been informed of the conditions of participation and the risks of the activity and accepts them, and be able to defend claims. | Performance of the contract (art. 6.1.b GDPR) and the Club’s legitimate interest in proving that the person has been informed and has accepted the conditions and risks, and in defending claims (art. 6.1.f GDPR). |
| Flight log: date, aircraft, pilot and name of the person flying. | Keep a record of the Club’s activity and deal with incidents or claims. | The Club’s legitimate interest in keeping a record of its activity and dealing with incidents or claims (art. 6.1.f GDPR). |
| Connection and security data (IP address, user agent, date and time of access, server and audit logs). | Ensure the security of the Website, prevent fraud and abuse, and resolve incidents. | The Club’s legitimate interest in the security of the Website and the prevention of fraud and abuse (art. 6.1.f GDPR). |
| Enquiries sent by email or contact form. | Deal with the enquiry. | Performance of a contract or pre-contractual measures (art. 6.1.b GDPR) or, failing that, the Club’s legitimate interest in dealing with the enquiries it receives (art. 6.1.f GDPR). |
| IP address and technical browser data processed by the contact form’s anti-spam provider (Cloudflare Turnstile) when an enquiry is sent. | Protect the contact form against automated submissions and abuse. | The Club’s legitimate interest in the security of the contact form and the prevention of abuse (art. 6.1.f GDPR). |
| Data arising from the use of the website and cookies, depending on their category. | Allow the website to function securely and, with prior authorisation where required, carry out usage measurement or analysis. | Strictly necessary technical cookies: consent is not required under art. 22.2 LSSI. Non-essential cookies: user’s consent (art. 6.1.a GDPR and art. 22.2 LSSI), in accordance with the Cookie Policy. |
The mandatory data in the purchase form are: first name, surname, email and telephone number of the person making the purchase; first name, surname, weight and height of the person who will fly; and the flight date and time and the type of service (individual flight or pack). Without them, the purchase cannot be completed.
The purchase form automatically checks that the weight and height of the person who will fly are within the safety limits shown on the form itself. If they are not, the purchase cannot be completed online. The rule is the same for everyone and no profiling is carried out. If you believe your case deserves a review, you can ask for a person at the Club to intervene, express your point of view and challenge the decision by writing to info@volavela.com. Apart from this check, no decisions are made based solely on automated processing.
Source of the data. The data of the person who will fly is provided by the person making the purchase. That person receives the information on how their data is processed on the voucher, which the purchaser undertakes to hand over to them, and on the day of the activity.
We do not store, and do not have access to, the full details of payment cards. Payments are processed through our payment service provider. We may receive from that provider the information needed to manage the transaction, such as its status, amount or transaction identifier. The processing of payment data by the provider will also be governed by its own terms and privacy policy.
Personal data will be kept for the time necessary for the purposes for which they were collected. Once the relationship has ended, the data may be kept duly blocked for the limitation periods of the applicable legal obligations and liabilities.
Tax and accounting documentation will be kept for the periods required by the applicable rules, which may vary depending on the nature of the documentation and of the corresponding obligation.
Weight and height will be kept only for the time necessary to manage and carry out the activity. Once the activity has taken place, weight and height are kept on the voucher record, which only authorised Club staff can access, solely to deal with incidents or claims or at the request of the authorities, for the limitation periods of any potential liabilities.
Flight logs are kept, blocked, for the limitation periods of any potential liabilities.
Users may exercise at any time their rights of access, rectification, erasure, objection, restriction of processing and portability of their data, and may withdraw their consent where processing is based on it, by writing to info@volavela.com and stating the right they wish to exercise.
Where there are reasonable doubts about the identity of the person making the request, the Club may ask for the additional information strictly necessary to verify their identity.
Right to object. Where the processing is based on the Club’s legitimate interest, the data subject may object at any time, on grounds relating to their particular situation, by writing to info@volavela.com. The Club will stop processing the data unless it demonstrates compelling legitimate grounds or needs the data for the defence of claims.
Users also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if they consider that the processing of their data does not comply with the applicable rules.
The Club has adopted and maintains appropriate technical and organisational measures to ensure a level of security appropriate to the risks of the processing, taking into account the nature of the data processed and the circumstances of the processing, in accordance with article 32 of the GDPR.
These measures are reviewed and updated when necessary and are applied according to the nature of the data and the risks of the processing.
The Website is not aimed at minors, and purchases must be made by persons aged 18 or over. If the person who will fly is a minor, their parent or legal guardian must be present on the day of the activity and sign the corresponding document, and will give any consents required (if the minor is 14 or older, the minor will also sign).
The Club may update this Privacy Policy to adapt it to legislative changes, criteria of the supervisory authorities, or changes in the processing carried out. Where the changes are substantial or legally required, data subjects will be informed by appropriate means. The version published on the Website will state the date of its last update.