Controller and contact
ENAIRE, E.P.E. is the controller for the personal data processed under its responsibility through this SATMA website. Its address and identification are set out in the legal notice.
For privacy enquiries and rights requests, contact ENAIRE’s Data Protection Officer at ucpd@enaire.es. This notice covers this portal; ENAIRE’s corporate privacy policy explains its wider data-protection framework.
Reading the public website
No visitor registration is required. Delivering pages and files involves processing connection information such as your IP address, the requested resource, the time of the request and browser or device information. Hosting and security services use technical information to serve requests, detect abuse and investigate faults.
The portal does not include advertising or audience-tracking analytics configured by SATMA. Library search terms and filters are processed in your browser and are not submitted by the search interface to a search-log service. The traffic figures in Power BI concern the aviation corridor, rather than measurements of your visits to this website.
Email enquiries
If you choose to email SATMA, ENAIRE receives your address, message and any information or attachments you send. These are used to handle and answer your enquiry. Please include only information needed for that purpose and avoid sending passwords or sensitive operational or personal material.
You may withdraw consent for a voluntary enquiry by contacting SATMA or the Data Protection Officer. Withdrawal does not affect processing already lawfully carried out or any records that must be retained under an applicable legal duty. Where an enquiry becomes a formal administrative procedure, that procedure’s specific notice and legal basis apply.
Administration and security
Administrator sign-in uses the authorised account’s email, a password verification process and a protected session identifier. The service also keeps security information to limit login attempts and records publication actions, timestamps and the responsible administrator identifier. Uploaded files and their filenames, descriptions and publication details are stored so the administrator can manage them.
Public visitors cannot upload or edit content. Passwords submitted at sign-in are not stored as plain text. Administrator session cookies and their duration are described in the cookie policy.
Documents and personal information in publications
Historical publications may include the professional names, organisations or contact details present in the original public documents. Newly published documents and videos may also contain personal information supplied by their authors. Publication does not permit unrelated reuse of that information. Contact SATMA or the Data Protection Officer if you believe material should be corrected or removed.
This professional information service is not directed at children and does not offer public account creation, newsletters or public submission forms.
Purposes and legal bases
Processing necessary for ENAIRE’s air-navigation and international operational-coordination functions is grounded in the public interest under Article 6(1)(e) of the General Data Protection Regulation (GDPR), within the competences in Article 18(2) of Law 18/2014 and Article 5 of ENAIRE’s Statute. This ground is limited to processing necessary for those functions.
Necessary service-security records support applicable security obligations under Article 6(1)(c) and Article 32 GDPR, the first additional provision of Organic Law 3/2018 and Article 24 of Royal Decree 311/2022. These grounds do not make optional tracking necessary.
Voluntary enquiries and the activation of optional external content rely on your choice and consent under Article 6(1)(a), where consent is the relevant basis. You can refuse optional content without losing access to public pages or documents. Any separate procedure or Microsoft account has its own applicable privacy information.
The applicable framework includes the GDPR and Spain’s Organic Law 3/2018. ENAIRE’s Data Protection Officer can identify the processing activity and legal basis applicable to a particular request.
Service providers and external content
The portal is hosted through OpenAI Sites with Cloudflare infrastructure for website delivery, security, database and file storage. These services handle the technical information needed to operate the website. Authorised ENAIRE staff and service providers involved in operating the service may access data within their respective responsibilities; competent authorities may receive it where the law requires.
Microsoft Power BI and externally hosted video content receive connection information when you enable and load them. Microsoft controls its own authentication and service policies; SATMA does not receive your Microsoft password. External websites you visit through a link apply their own privacy information.
Cloud services may process data outside the European Economic Area. Provider information is available in the OpenAI privacy policy, Cloudflare privacy policy and Microsoft privacy statement. Contact ENAIRE’s Data Protection Officer for the arrangements and any transfer safeguards applicable to the specific processing of your data.
How long information is kept
Browser preference choices expire after 180 days. Administrator sessions expire after eight hours; signing out revokes the current session. The login-attempt limit uses a 15-minute window. These access periods are not automatic deletion deadlines for all server records: expired session and login-limit records are cleaned during subsequent authentication activity.
Published and archived material, uploaded files and administrative activity records remain stored until they are removed under the applicable records-management decision. Hiding or archiving a publication does not delete its file. Enquiry records and infrastructure logs follow the retention criteria applicable to their purpose, security needs and any legal recordkeeping duties. The Data Protection Officer can provide the retention information applicable to a specific record or request.
Your rights and choices
You may request access, rectification, erasure, restriction, objection and, where applicable, portability of your personal data. You may withdraw consent where processing relies on it. Contact ucpd@enaire.es or use ENAIRE’s official Exercise GDPR rights procedure. ENAIRE may need proportionate information to verify your identity and locate the relevant records.
You may lodge a complaint with the Spanish Data Protection Agency (AEPD). For external-content preferences, use Cookie settings. The SATMA application does not make automated decisions with legal or similarly significant effects about public visitors.