1. Data Controller
The controller responsible for the processing of personal data in connection with this website and our services is:
LEGAL
Privacy Policy
Last updated: 21 August 2026
This Privacy Policy explains how next-level.aero collects, processes and protects your personal data when you visit our website or use our services.
2. Personal Data We Process
Depending on how you use our website and services, we may process the following categories of personal data.
Contact and booking data
When you book an examination or training session, we may process:
- your name;
- email address;
- billing address;
- telephone number, where provided;
- selected service;
- appointment date and time; and
- booking and order information.
Payment and transaction data
When you make a payment, we may process:
- payment method;
- payment status;
- transaction information;
- order information; and
- billing information.
Payment credentials such as complete credit or debit card details are processed by the respective payment service providers and are not directly accessible to us where they are processed exclusively through the payment provider.
Language Proficiency Examination data
When you take an ICAO Language Proficiency Examination with us, we additionally process data required to conduct, assess and document the examination. This may include:
- full name;
- date of birth;
- pilot licence number;
- licensing authority and/or state of licence issue;
- examination date;
- examination documentation;
- assessment results;
- ICAO Language Proficiency Level; and
- an audio recording of the examination.
Communication data
If you contact us, we process the information you provide in your communication, including your name, email address and the content of your message.
Technical data
When you use our website, certain technical information may automatically be processed, including:
- IP address;
- browser and device information;
- date and time of access;
- technical log information; and
- cookie and consent preferences.
3. Purposes and Legal Bases of Processing
We process personal data only where permitted under applicable data protection law.
Booking and provision of our services
We process personal data in order to process bookings, arrange examination and training appointments, process payments, communicate with you regarding your booking, provide training sessions, conduct Language Proficiency Examinations, assess your language proficiency and provide examination results and related documentation.
The legal basis for this processing is Art. 6(1)(b) GDPR, insofar as processing is necessary to perform a contract with you or to take steps at your request prior to entering into a contract.
Examination documentation and regulatory requirements
Language Proficiency Examinations are subject to aviation regulatory and examination requirements.
We therefore process examination-related personal data for the purpose of conducting, documenting, assessing and verifying the examination and complying with applicable examination and aviation regulatory requirements.
Depending on the respective processing activity, the legal basis is Art. 6(1)(b) GDPR for the performance of the examination contract, Art. 6(1)(c) GDPR where processing is necessary to comply with a legal obligation applicable to us, and/or Art. 6(1)(f) GDPR where processing is necessary for our legitimate interest in properly administering, documenting and demonstrating the conduct of examinations.
4. Audio Recording of Language Proficiency Examinations
ICAO Language Proficiency Examinations conducted through next-level.aero are audio recorded using a separate audio recording device.
The recording contains the spoken communication forming part of the examination and is created for the purposes of assessment, secondary assessment, quality assurance, examination documentation and regulatory compliance.
Following the examination, the audio recording and relevant examination documentation are transferred to LTB112, an Austro Control-certified Language Testing Body, for secondary assessment, quality assurance and the regulatory storage of examination records.
Examination data may also be made available to Austro Control GmbH or other competent aviation authorities where required for regulatory, supervisory or verification purposes.
The examination recording is not used for advertising, marketing, artificial intelligence training or purposes unrelated to the administration, assessment, quality assurance or regulatory documentation of the examination.
Further information regarding the responsible Language Testing Body and the applicable examination procedure can be obtained from Austro Control GmbH.
5. Online Examinations and Training via Zoom
Online Language Proficiency Examinations and training sessions are conducted using Zoom.
When participating in a Zoom meeting, personal data may be processed in connection with the provision of the online communication service. Depending on the circumstances, this may include your display name, meeting metadata, IP address and device information, and audio and video transmitted during the meeting.
The official examination recording is not created using Zoom's recording functionality. The examination is recorded separately as described in Section 4.
We use Zoom to provide the online communication infrastructure necessary to conduct examinations and training sessions.
Where personal data is transferred outside the European Economic Area, such transfers are subject to the applicable requirements for international data transfers.
6. Appointment Booking – Easy Appointment Booking
We use Easy Appointment Booking to schedule and administer examination and training appointments.
When you make a booking, personal data may be processed through this service, including your name, email address, selected service, appointment date and time and associated booking information.
This processing is necessary to arrange and administer the service you have booked. The legal basis is Art. 6(1)(b) GDPR.
7. Shopify
Our website, online store and checkout are operated using Shopify.
In connection with your use of our website and the purchase of our services, Shopify may process personal data including contact information, billing information, order and transaction information, IP address, browser and device information and information regarding your interaction with our website.
Where Shopify processes customer personal data on our behalf, we act as the controller and Shopify acts as the processor in accordance with Shopify's Data Processing Addendum. Shopify may also process certain information as an independent controller where this applies to specific Shopify services.
Shopify may process personal data internationally. International transfers may occur in connection with the operation of its services.
Further information is available in Shopify's Privacy Policy.
8. Payments
Payments are processed using Shopify Payments and the payment methods made available through the Shopify checkout.
Depending on the payment method selected, Shopify and the respective payment or financial service provider may process information including name and billing information, payment information, selected payment method, transaction amount, transaction identifiers and information required for payment processing and fraud prevention.
We do not receive complete payment credentials such as your full credit card details where these are processed directly by the respective payment service provider.
The processing of payment information is necessary to process your payment and perform the contract with you pursuant to Art. 6(1)(b) GDPR.
9. Email Communication
We use services provided by IONOS for our business email communication.
If you contact us by email, or if we communicate with you in connection with a booking, examination or training session, personal data contained in the correspondence is processed for the purpose of handling the communication.
Where the communication relates to a booking, prospective booking or contractual relationship, processing is based on Art. 6(1)(b) GDPR.
For other business communications, processing may be based on our legitimate interest in efficiently responding to and administering enquiries pursuant to Art. 6(1)(f) GDPR.
10. Contact Form
If you contact us using the contact form on our website, we process the information you provide. Depending on the form and your enquiry, this may include your name, email address, selected topic, booking reference where provided and your message.
If your enquiry relates to an existing or prospective booking, processing is based on Art. 6(1)(b) GDPR.
For general enquiries, processing is based on our legitimate interest in responding to communications pursuant to Art. 6(1)(f) GDPR.
11. Cookies and Similar Technologies
Our website uses cookies and similar technologies required for the operation, security and functionality of the website and checkout.
We use Shopify's Customer Privacy functionality to manage cookie and consent preferences.
Where cookies or similar technologies are not strictly necessary for the operation of the website, they are used only where permitted under applicable law and, where required, after obtaining your consent.
You can manage or withdraw your choices through the cookie settings available on our website.
We currently do not use Google Analytics, Meta Pixel or comparable third-party advertising tracking technologies.
Further information about cookies used in connection with Shopify is available in Shopify's Cookie Policy.
12. Marketing Communications
We currently do not operate an email newsletter and do not use your contact information to send unsolicited promotional newsletters.
Emails necessary for administering your booking, examination, training, payment or customer service request are transactional communications and may be sent where necessary to provide the requested service.
If we introduce optional marketing communications in the future, we will update this Privacy Policy and obtain any consent required by applicable law.
13. Recipients of Personal Data
Where necessary for the purposes described in this Privacy Policy, personal data may be disclosed to or processed by the following recipients or categories of recipients:
- Shopify and service providers involved in operating our website, online store and checkout;
- Easy Appointment Booking for appointment scheduling;
- Zoom for online examinations and training sessions;
- IONOS for email communication;
- payment and financial service providers involved in processing payments;
- Language Proficiency Examiners involved in conducting an examination;
- LTB112, an Austro Control-certified Language Testing Body, for secondary assessment, quality assurance and examination record storage;
- Austro Control GmbH and other competent aviation authorities where required; and
- public authorities, courts, professional advisers or other recipients where disclosure is required or permitted by law.
Personal data is disclosed only where this is necessary and permitted under applicable data protection law.
14. International Data Transfers
Some of the service providers we use operate internationally. Personal data may therefore in certain circumstances be processed outside Germany or the European Economic Area.
Where personal data is transferred to a country outside the EEA, the transfer takes place in accordance with Chapter V GDPR.
Depending on the recipient and destination country, this may include an adequacy decision by the European Commission, appropriate safeguards such as Standard Contractual Clauses, Binding Corporate Rules or another transfer mechanism permitted under applicable data protection law.
15. Data Retention
We retain personal data only for as long as necessary for the respective processing purpose or as required by applicable legal, tax, contractual or regulatory retention obligations.
Examination documentation
Audio recordings and relevant examination documentation are transferred to the responsible Language Testing Body, LTB112, and retained in accordance with the applicable aviation regulatory and examination requirements.
next-level.aero retains examination-related personal data only for as long as necessary to conduct and administer the examination and to comply with applicable legal or regulatory obligations.
Booking and transaction records
Booking, payment and transaction records are retained for as long as required to perform the contract and subsequently in accordance with applicable statutory, accounting and tax retention requirements.
Communications
General enquiries and correspondence are retained only for as long as reasonably necessary to process and document the respective enquiry, unless a longer retention period is required by law or the communication forms part of contractual or regulatory documentation.
After the applicable retention period expires, personal data is deleted or anonymised unless continued storage is legally required or otherwise permitted.
16. Data Security
We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
We also use service providers that maintain technical and organisational security measures appropriate to the services they provide.
Nevertheless, no method of electronic transmission or storage can guarantee absolute security.
17. Your Rights Under the GDPR
Subject to the requirements and limitations provided by applicable law, you have the right to:
Access
Art. 15 GDPR
Rectification
Art. 16 GDPR
Erasure
Art. 17 GDPR
Restriction
Art. 18 GDPR
Data portability
Art. 20 GDPR
Object
Art. 21 GDPR
Withdraw consent
Art. 7(3) GDPR
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Please note that these rights are subject to statutory limitations. In particular, we may be unable to delete information where we or the responsible Language Testing Body are required to retain examination documentation, transaction records or other information pursuant to legal or regulatory requirements.
To exercise your rights, please contact:
info@next-level.aero
18. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR or other applicable data protection law.
The supervisory authority responsible for our place of establishment is:
You may also contact another competent data protection supervisory authority, particularly in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement.
19. External Links
Our website may contain links to websites or online services operated by third parties.
Once you leave our website, the processing of personal data by those third parties is governed by their respective privacy policies and practices.
We are not responsible for the data processing practices or content of independent third-party websites.
20. Changes to This Privacy Policy
We may update this Privacy Policy where necessary, for example due to changes in our services, service providers, technical infrastructure or applicable legal requirements.
The current version will be made available on our website. The date of the latest revision is displayed at the beginning of this Privacy Policy.
21. Contact
For questions regarding this Privacy Policy or the processing of your personal data, or to exercise your data protection rights, please contact: