GroundRoster is staff rostering and day-of-operations software for ground handlers and airports. On Microsoft Marketplace it is listed as "AVIONIQX Ground Operations". This notice says what personal data it involves, who decides about it, and what we do with it.
1. Who we are
TECHNOBYTE SOFTWARE SRL, a company registered in Romania, with its registered office at Intrarea Busuiocului nr. 4A, Chiajna, Ilfov County, Romania, registered with the Trade Register under number J23/655/23.02.2017, tax identification number RO37096072. AVIONIQX is our aviation brand. For anything about personal data, write to contact@technobyte.ai.
2. Two kinds of data, two roles
Data your employer puts into GroundRoster. If you work for an organisation that uses GroundRoster, your employer loads and manages your data there: your name and contact details, your qualifications, your shifts, your leave and attendance. GroundRoster also keeps a record for your employer of who signed in, when, and for password sign-ins from which IP address, and of who changed what; your employer's planners can read the record for their station, and its administrators can download all of it with the copy of the organisation's data. Your employer decides why and how that data is used and is its controller. We run the software for your employer and process the data on its instructions, as its processor. For questions about that data, and to use your rights over it, go to your employer first. If you write to us, we pass your request on to them.
Data we decide about ourselves. For the data in section 3 we are the controller.
3. What we collect ourselves, and why
When your organisation buys GroundRoster on Microsoft Marketplace. The person who buys signs in with their Microsoft work account. We ask Microsoft for that person's name and e-mail address only, and Microsoft tells us which subscription was bought and by which organisation. We use this to set up your organisation in GroundRoster and to make the buyer its first administrator. Before the setup is finished, the buyer accepts the GroundRoster Subscription Agreement for the organisation. We keep:
In the service that handles purchases: Microsoft's identifiers of the buyer's organisation and account, with the subscription (offer, plan, state); and a record of the acceptance, which holds the buyer's name and e-mail address, the name of the organisation, the time, the version of the Agreement and the statements that were accepted. The record is made when the buyer sends the setup form, and it is kept also when the setup is not completed afterwards.
In GroundRoster itself: the buyer's e-mail address and Microsoft identifiers with the subscription, and the buyer's administrator account (e-mail address and name), which from then on is part of the organisation's data.
When you write to us for support. What you send us, to answer you.
To run the service and keep it secure. Technical logs of the application. They carry internal identifiers and counts; an e-mail address is written to them in two cases: a password-reset request that was refused for coming too often, and an e-mail that could not be delivered.
Our legal basis is our legitimate interest in concluding and performing the contract with your organisation, in being able to show what was agreed, in answering you, and in running the service and keeping it and its data secure (Article 6(1)(f) of the GDPR). Where a law obliges us to keep a record, that obligation is the basis (Article 6(1)(c)).
4. What we do not do
We do not sell personal data and do not use it for advertising. GroundRoster has no analytics, no tracking and no advertising cookies, and sends no data to an AI service: rosters are calculated inside the application.
5. Cookies and browser storage
Only what the service needs to work:
On the purchase page: three cookies that hold your sign-in and your purchase while you set up the subscription. They are encrypted and expire after 15 minutes, 60 minutes and 2 minutes.
In GroundRoster: your session is kept in your browser's local storage until you sign out. While you sign in with Microsoft, a session cookie holds the sign-in request; when you connect your Microsoft account for the first time through a link from your administrator, a second cookie is set for up to 10 minutes.
6. Where the data is and who else handles it
The data is stored in the European Union, in Microsoft Azure data centres: the database in France, the application and its technical logs in Germany. Microsoft Ireland Operations Limited hosts the service for us and signs users in (Microsoft Entra ID), under Microsoft's data protection addendum, which includes the European Commission's standard contractual clauses for any transfer of personal data outside the European Economic Area. No other company receives the data.
7. How long we keep it
Your employer's data: for as long as your employer's subscription runs. After the subscription ends it is kept for 30 days, in which an administrator of your employer can still download a complete copy of it, and is then deleted. It is kept longer only while your employer is still owed a copy of it, or while the law, a court or an authority requires us to keep it.
The record of the purchase and of the acceptance of the Agreement: for as long as the subscription runs and for five years after it ends, or for five years after the acceptance where no subscription followed it, and longer only while a dispute about the contract is open.
Technical logs: 30 days.
Backups: 35 days.
8. Your rights
You can ask for access to your data, for its correction or deletion, for its processing to be restricted, to receive it in a portable form, and you can object to processing based on legitimate interests. For data your employer manages, ask your employer. For the data in section 3, write to contact@technobyte.ai. You can also complain to a data protection authority: in Romania the ANSPDCP, or the authority of the country where you live or work.
9. Rosters and automated decisions
GroundRoster proposes rosters and task assignments by calculation. A planner at your employer reviews, changes and publishes them, and each assignment carries the reason for it. We take no decisions about you.
10. Changes
We will post changes to this notice here, with the date.