Privacy notice

Savanna Avia Ltd is a company registered in Kenya, based in Nairobi, Kenya. We build and operate WingsPath, an aviation management platform used by aircraft operators, maintenance organisations and flight training schools.

For the account and usage data described below, we are the data controller. For the records your organisation uploads into the platform, your organisation is the data controller and we act as its data processor, under the terms of your agreement with us.

Account and identity data, which we collect directly from you or your employer:

• Name, work email address and the organisation you belong to.
• Your role, permissions and which aircraft you have been granted access to.
• A password stored as an irreversible hash, and — if you enable it — the secret that backs your authenticator app.
• Sign-in events, failed sign-in attempts and account lock events.

Operational data, which arrives when people use the platform:

• An audit entry for every change made to a record, naming the person who made it.
• Crew and pilot records: licences, ratings, medical certificate expiry dates, duty and flight time, and logbook entries.
• Training records for flight students, including instructor debriefs and the signatures that close them.
• Documents your organisation uploads. These are aircraft records, but they often name people — engineers, pilots, inspectors and signatories.
• Questions asked of the Neema assistant, kept so we can improve the answers.

We do not buy personal data, and we do not build profiles of you for advertising.

Flight training schools enrol students who are under 18. Where a student's date of birth shows they are a minor, the platform will not accept the enrolment without a recorded guardian consent — this is enforced in the database, not left to a checkbox on a screen.

A student's record can include a medical certificate, which is data about their health. We treat it as sensitive personal data, restrict it to the people in the school whose duties require it, and never use it for anything other than the school's own training and compliance obligations.

• To provide the service under our contract with your organisation — accounts, access, records, reports.
• To meet legal obligations. Aviation records must be kept, and must be attributable to a named person. Our audit log exists for this reason.
• For our legitimate interests in running a secure service: preventing unauthorised access, investigating incidents, and keeping the platform working.
• With consent, where consent is the right basis — for example a guardian's consent to enrol a minor. Consent given can be withdrawn.

We do not sell personal data and we do not share it with other customers. We use a small number of service providers, each bound to process data only on our instructions:

• A hosting provider, which runs the servers the platform sits on.
• An enterprise AI service, which processes the text of a question and the records needed to answer it. Its terms do not permit your data to be used to train models.
• An email delivery service, used to send alerts, invitations and password resets.

We will disclose data to a regulator, a court or a law-enforcement body where we are legally required to. Where we are permitted to tell you that this has happened, we will.

The platform runs on servers outside Kenya, and the AI service we use may process a request outside Kenya. Where personal data leaves the country, we rely on contractual protections with the provider concerned. We will tell you exactly which providers and which locations apply to your organisation if you ask.

Aircraft and training records are kept for as long as aviation law requires, which is frequently much longer than the working life of the account that created them — some airworthiness records must survive for the life of the aircraft. Your organisation sets the retention period for its own records.

Account data is kept while the account is active. Audit entries are retained even after the record they describe is deleted, because an audit trail with gaps in it is not an audit trail.

We use cookies only to run the service: one to keep you signed in, and one to remember which aircraft you were last looking at. We do not use advertising cookies, and we do not run third-party analytics or tracking scripts on our website or in the application.

Under the Data Protection Act, 2019, you may ask us to:

• Tell you what personal data we hold about you, and give you a copy.
• Correct data that is wrong or incomplete.
• Delete data, where no legal or aviation-record obligation requires us to keep it.
• Stop or restrict a particular use of your data, or object to it.
• Transfer your data to another provider.

Where your employer is the controller, we will pass your request to them and help them answer it. Some aviation records cannot be deleted on request; where that applies we will say so and explain which obligation prevents it.

You also have the right to complain to the Office of the Data Protection Commissioner in Kenya. We would prefer you raised it with us first, but this right does not depend on that.

For transparency: our registration with the Office of the Data Protection Commissioner is in progress and not yet complete.

When we change this notice we update the date at the top of the page. If a change materially affects how we use your data, we will tell the administrators of your organisation directly rather than rely on you noticing.

For privacy questions and data requests, use the contact form at savannaavia.co.ke. We answer within 7 working days.