• Facebook
  • Instagram
  • LinkedIn

CAT3C Ltd GDPR Privacy Notice

The General Data Protection Regulation (GDPR) is a unified framework of data privacy rules, brought into force by the European Parliament, compliance with which is necessary for all EU member states and those states entering into certain contractual business with the EU and/or its member states. The GDPR imposes strict regulations on how organizations operating in the EU collect, store and manage personal information.

GDPR requires all businesses collecting personal information to publish a ‘Privacy Notice’ which covers the following points:

  • Who is collecting the data?

  • What data is being collected?

  • What is the legal basis for processing the data?

  • Will the data be shared with any third parties?

  • How will the information be used?

  • How long will the data be stored?

  • What rights does the data subject have?

  • How can the data subject raise a complaint?


Articles 12, 13 and 14 of the GDPR outline the requirements on giving privacy information to data subjects. The GDPR says that the information you provide must be:

  • Concise, transparent, intelligible and easily accessible;

  • Written in clear and plain language, particularly if addressed to a child; and

  • Free of charge.


The following pages contain the answers to the above questions.

Who is collecting the data?

CAT3C LTD (Company Number: 10671761)
Registered office: 11 Wheatstone Court, Davy Way, Waterwells Business Park, Quedgeley, Gloucester, England, GL2 2AQ.
Operational Address: Aviation House (Hangar SE2A), Gloucestershire Airport, Cheltenham, GL51 6SR.

What data is being collected?

Photographic ID Document(s) Examination Report(s)
Flight Crew Licence(s) Progress Test Report(s)
Medical Certificate(s) Course Attendance Record(s)
Radio Telephony Licence(s) Correspondence (Post and email)
Pilot Logbook(s) Photographs and video recordings

Who are we collecting the data on behalf of?

In order to avoid unnecessary duplication of resources and to reduce the risk of loss and/or theft of your personal information, CAT3C LTD (CAT3C) will collect and processing data on behalf of CAT3C and the following companies, which are all directly concerned with regulated and non-regulated aviation training activities undertaken by CAT3C:

  • Commercial Aviation Training Services Limited (Company No: 10556918)

  • Aviation Career Enablers Ltd (Company No: 09111237)

  • Learning Enablers Limited (Company No: 07674410)

What is the legal basis for processing the data?

As an Approved Training Organisation (ATO), CAT3C is required to process certain personal information, in order to comply with aviation regulations, and in order to ensure that you are entitled to undertake a course of study for the EASA ATPL theoretical knowledge examinations: EC Regulation 1178/2011 (The Aircrew Regulation), and associated Part FCL, Part MED, Part ORA, Part ARA and their applicable Acceptable Means of Compliance and Guidance Material, and the Air Navigation Order 2016.

All legislative requirements are subject to amendment as applicable.

We may also be required to contact you periodically to keep you advised of regulatory information, and to ensure that your course of study is being undertaken in accordance with applicable regulations, best practices and to your best advantage.

Will the data be shared with any third parties?

Your personal information may be shared with third-party service providers, but only so far as to provide our services to you, for example:

  • European Aviation Safety Agency (EASA)

  • National aviation authorities, as applicable, e.g. UK Civil Aviation Authority (CAA)

  • Aviation training services providers

  • Contract theoretical knowledge instructors

  • Postal services providers, e.g. Post Office Limited, Royal Mail, etc.

  • Administrative service providers

How will the information be used?

Your personal information will be held and processed for the purpose of ensuring that both you and CAT3C complies with applicable regulations.

How long will the data be stored for?

We are required to keep your personal information on record for a period of three calendar years, following completion of your studies, i.e. the date you passed your final examination.  On completion of the statutory period, your records will be permanently disposed of by means of on-site, secured, cross-cut, shredding.

How do we store your data?

We store your data within physical documents and electronic storage and retrieval systems, held and/or managed by CAT3C.

Student Registration Form

When you register with CAT3C you complete a Student Registration Form (SRF), which is kept in paper form in a locked cabinet within the locked CAT3C offices. No person other than those postholders listed below have access to these records:

  • Accountable Manager

  • Administration Manager

  • Head of Training

  • Training Coordinator

  • Chief Theoretical Knowledge Instructor

  • Compliance & Safety Manager



Electronic Records Storage

CAT3C Administration System electronic records are stored locally on computer, to which only the above-specified postholders have access; and on a cloud-based secure Microsoft Office 365 OneDrive server, managed by Microsoft. Details on how Microsoft OneDrive safeguards data can be obtained at:




Your name and email address have been recorded on the Padpilot internet Management & Reporting System (iMRS), held on servers under the management of Webnetism/Continental Ltd, Herrick Way, Staverton Technology Park, Cheltenham, GL51 6TQ, contracted by Padpilot for the storage of their management system data.

Details of personal data held on these servers can be obtained directly from Padpilot, Unit 19 The Glenmore Centre, Jessops Court, Waterwells Business Park, Quedgeley, Gloucester, GL2 2AP, or via CAT3C.


CAT3C does not hold any personal financial information, other than name, address and contact details for invoicing. This data is stored on Quick Books Online, Intuit Inc, 1 Cathedral Piazza, London, SW1E 5BP.


Details of Intuit Inc’s privacy statement can be read at https://quickbooks.intuit.com/uk/privacy-policy/?bc=OBI-LL2

Any sales via the www.cat3c.com website will be processed by the website’s Stripe financial system, which does not record the card number or the purchaser’s personal details. If any details are inadvertently recorded and thereafter discovered on CAT3C’s systems, the person to whom that information refers will be informed immediately of its discovery and all measures will be undertaken to remove the details as soon as possible.

United Kingdom Civil Aviation Authority (CAA) TASMAN e-examinations System

Your personal details will have been, or will be at some future time, recorded on the CAA’s TASMAN e-examinations System and other data storage systems concerned with flight crew licensing and medical records. These are managed by the CAA and CAT3C has no control over their management or the data stored on them.

Details of any personal data held on TASMAN can be obtained directly from the CAA, Aviation House, Gatwick Airport South, West Sussex, RH6 0YR.

Security of Data

Security is of the highest priority when it comes to your personal information. We are committed to protecting your personal data and have appropriate technical and organisational measures in place to make sure that happens.

These include, as appropriate;

  • Conducting Data Protection Impact Assessments (DPIA)

  • Appointing a Data Protection Officer (DPO), responsible for;

    • Ensuring compliance with the GDPR and data protection legislation, as applicable

    • Data protection awareness and training

    • Monitoring policy, practices and procedures


To reduce risks, so far as is practicable, of theft, loss, misuse, unauthorised access, disclosure and alteration of your personal information, we minimise access to personal information to those persons only, for whom access is absolutely necessary. We also use firewalls and data encryption where practicable. Physical access to our data sources is restricted, and information access authorisation controls.

What rights does the data subject have?

The GDPR provides the following rights for individuals:

  1. The right to be informed

  2. The right of access

  3. The right to rectification

  4. The right to erasure

  5. The right to restrict processing

  6. The right to data portability

  7. The right to object

  8. Rights in relation to automated decision-making and profiling.

Detailed guidance can be obtained from: ICO – Your Rights, but in summary:

You have the right to know that we hold information about you and to receive a copy of any information we hold about you.

You have the right to request that we amend any information we hold about you which you believe to be incorrect and you have the right to require us to delete any information we hold about you.

You also have the right to object to any activities involving the processing of your personal data. You have the right to instruct us not to process any information we hold about you and you also have the right to obtain and reuse your personal data for your own purposes.

You have rights in relation to automated individual decision-making (making a decision solely by automated means without any human involvement); and profiling (automated processing of personal data to evaluate certain things about an individual). CAT3C does not carry out either activity and does not have any control over any data that may be held by the CAA or EASA that may be subject to such automated decision-making or profiling.

How can the data subject raise a complaint?

If you have any complaints about the manner in which we hold or process your personal data you are requested, in the first instance to write to us at:

Data Protection Officer, CAT3C, Aviation House (Hangar SE2A), Gloucestershire Airport, Cheltenham, Gloucester, GL51 6SR, or via email to admin@cat3c.com .

We will reply to your enquiry in writing within fourteen days.

If your enquiry is of an urgent nature, please contact us by telephone on +44 (0)1452 238012 and we shall endeavour to take immediate action to rectify any problem.

If you are not satisfied with our response, you can report the matter directly to the Information Commissioner’s Officer by telephone on 0303 123 1113 or by visiting the ICO website at https://ico.org.uk.

Contacting you

We may be required to contact you periodically, to keep you advised on any matters which may concern private or professional flight crew licensing; or to keep you advised, or check, on the continued progress of your training with us, to ensure that you are completing your training in accordance with EU regulations and to your best advantage.

Your consent?

We are not permitted to store this data without your consent, we are not permitted to contact you without your consent and we are not permitted to supply that data to any third party without your written consent.

Whilst we have no intention to deliberately or mistakenly supply your data to any third party, the GDPR requires that we obtain your written consent to process any personal data, relating to yourself.

What is the cost to you?

There is no cost to you for the storage or processing of your personal information; and there is no cost to you for us to supply you with copies of your personal information.

What is required of you now?

We are unable to assume your permission to any of the above; and we are required to obtain your consent to process your data and to hold that consent on record.

It would be appreciated if you would ensure you have read these notes thoroughly and thereafter, provided that you are satisfied that we will manage your data securely, and that we will only process it as is absolutely necessary for the completion of your ATPL theoretical knowledge studies, it would be appreciated if you would sign the form provided and return it to us at:

Data Protection Officer, CAT3C, Aviation House (Hangar SE2A), Gloucestershire Airport, Cheltenham, Gloucester, GL51 6SR, or via email to office@cat3c.com .