Ahlex Privacy Statement

  1. Introduction

    Aviation Hub for Learning & Experience (hereinafter: “Ahlex”) values your privacy and therefore takes the necessary measures to protect your personal data in accordance with (i) the General Data Protection Regulation of 25 May 2018 (hereinafter: “GDPR”) and (ii) the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.Personal data are processed in the context of Ahlex’s operational activities (the website, the LMS platform, the provision of training and a number of commercial activities). The types of personal data that are processed, the purposes for which this data is used, the legal basis for the processing, and the retention periods that apply to this data are explained in this Privacy Statement. 

    Ahlex NV/SA, Business Zone Diegem-Luchthaven 54, 1830 Machelen is the party responsible for the processing of personal data that fall within the scope of this privacy statement, unless otherwise stated.  

    This privacy statement only applies to the processing of personal data by Ahlex. If a third party is involved in the provision of our services as a data controller, this Privacy Statement does not apply to the data processing by that third party, over which Ahlex has no control.  

  2. Processing of personal data when using the website

    Anyone can visit our website without having to identify themselves (a “Visitor”). Identification may be required for the use of our specific online services (“Registered User”).

    3.1 Visitors
    If you visit this website and do not activate or participate in any services, Ahlex will only process a limited amount of personal data. This data is always processed, regardless of whether you are a Visitor or a Registered User.

    • Types of personal data and purposes: 

    Electronic data and information about your browsing habits: This includes the IP address of your electronic device or data that provides insight into how you use the websites of our online services (e.g. browser type and pages visited). This information is collected through cookies or other automatic technologies and is processed to evaluate and improve the website and to provide technical support. 

    Cookies are small data or text files that we install on your device when you visit a website or use a (mobile) application. These cookies ensure that the website or application functions optimally and are not used for other purposes. The full list of cookies used by our website(s) can be found in our Cookie Statement

    • Legal basis for the processing: 

    To the extent that these cookies are necessary for the operation of our website or online services, consent is not required. For non-essential cookies, such as those used for analytical or marketing purposes, we will obtain your prior consent in accordance with Article 6.1(a) GDPR, as set out in our Cookie Policy.

    • Data retention period: 

    Data of visitors to the Ahlex website will be processed during the storage period of the relevant cookie(s), as stated in the Cookie Policy – Ahlex].

    3.2 Registered users

    • Types of personal data and purposes: 

    Ahlex may process the following personal data of Registered Users:

    • Identification data (e.g. your first and last name, gender, language, place of birth)
    • Contact details (e.g. your postal address, e-mail address, telephone number, mobile phone number)
    • Job-related data (start-up date, type of employment, job function)

    Ahlex processes the personal data provided by the data subject or collected by Ahlex through the employer of the data subject for all purposes that are necessary for the proper (technical) functioning of the LMS platform and/or for the creation of an account.

    • Legal basis for the processing: 

    The processing of the above personal data by Ahlex is based on our legitimate interest in accordance with Article 6.1(f) of the GDPR. This data is processed for the proper (technical) functioning of the LMS platform and the creation of an account. 

    • Data retention period: 

    Your account data will be stored for up to 3 years after your last activity on Ahlex, unless you deactivate your account earlier (e.g.: because you are no longer employed by one of the employers to whom we provide services). Once this period has expired, all data will be deleted. 

    3.3 Newsletter

    • Types of personal data and purposes: 

    If you sign up for our newsletters, we ask you to provide personal data. We use this data to keep you informed about our services and activities.

    You can sign up for one of our online newsletters by entering your email address, name (optional) and company (optional). 

    • Legal basis for the processing:

    BAC’s processing of personal data is based on Article 6.1(a) of the GDPR. When registering, you give permission for your email address to be processed and used to send newsletters. 

    • Data retention period

    We will only use your email address to send you our newsletters for which you have consented and for as long as you have consented. You can always unsubscribe from the newsletter(s) via the link at the bottom of each newsletter.

    3.4 Contact

    • Types of personal data and purposes: 

    When you fill in the contact form on the website, you enter the following personal data: 

    • First and last name
    • Email address
    • Telephone number
    • Company
    • Message with question, request or complaint about our services (may include additional personal data about you) 

    We only use this information to respond as adequately as possible to your question or complaint. 

    • Legal basis for the processing: 

    When you fill out our contact form, we process the personal data you provide on the basis of your consent, as required in Article 6(1)(a) of the GDPR. By completing and submitting the form, you give us permission to use your data for the purpose of responding to your questions, providing support, and maintaining further communication about your question or complaint.

    • Data retention period:

    The information you send us via the contact form or as part of questions or complaints will be stored for 5 years.

    • Checking attendance by drawing up lists of participants: art. 6.1(f) GDRP
      • The participant lists, which are used for checking attendance and identity checks during exams, are deleted every six months. 
    • Certificates that are being issued in a personal capacity at the end of the training/examination: art. 6.1 (b)
      • Certificates that are issued after the successful completion of a training course or exam are kept for the entire duration of the certificate. This means that the certificates will remain available until the certificate expires.
    • Registration of participants with the necessary authorities for certification of certain training courses, such as EASA/IATA: art. 6.1(c)
      • Personal data registered with authorities such as EASA/IATA will be kept for as long as necessary for certification and until the end of the validity period of the certificate.

        Processing of personal data in the provision of training

        Ahlex may collect various types of personal data from data subjects to whom it provides training.

        • Types of personal data: 

        We may process different categories of personal data such as:

        • Direct identification data (e.g. your first and last name)
        • Indirect identification data (e.g. your place of birth, date of birth, images during the training)
        • Company details (e.g. company name, address, VAT number)
        • Contact details (e.g. your postal address, e-mail address)
        • Personal characteristics (e.g. your gender, language)

        Ahlex processes personal data of the data subject in order to provide the training courses offered by Ahlex and the related services. This includes services such as training, education, study days, coaching, learning solutions, guidance programs, development paths, e-learning, online training and other forms of education. In addition, Ahlex offers logistical and organizational support via the LMS platform and the provision of training rooms.

        • Legal basis for the processing: 

        The processing of personal data by Ahlex is based on Article 6.1(b) of the GDPR, as this processing is necessary for the performance of an agreement to which the data subject (or their employer) is a party.

        • Data retention period:

        The personal data of the data subject will be kept for as long as necessary for the execution of the contract and for the duration of the cooperation. After the end of the contractual relationship, they will be deleted, unless a longer retention period is required by law.

        Other purposes for collecting and processing your personal data in the context of providing training include:

  4. Processing of personal data for other commercial purposes

    4.2 Digital Training Experience Center

    The Digital Training Experience Center offers an innovative and interactive learning environment where customers and participants can use modern technologies, such as VR, interactive training modules, and high-tech facilities. In the context of this service, personal data of participants and visitors are processed. 

    • Types of personal data and purposes: 

    We may process different categories of personal data such as:

    • Direct identification data (e.g. your first and last name)
    • Indirect identification data (e.g. your place of birth, date of birth, images during training and simulations)
    • Company details (e.g. company name, address, VAT number)
    • Contact details (e.g. your postal address, e-mail address)

    Ahlex processes this personal data to offer the services of the Digital Training Experience Center. This includes organizing trainings, workshops, networking activities, and supporting participants through digital tools and high-tech facilities

    • Legal basis for the processing: 

    The processing of personal data by Ahlex is based on Article 6.1(b) of the GDPR, as the processing is necessary for the performance of a contract to which the data subject (or his employer) is a party.

    • Data retention period: 
    •  Identification and contact details: Will be kept for 5 years after the last participation in a training or activity.
    • Technical data: Kept for 6 months after the end of access to the digital system.
    • Audiovisual data: Will be kept for 1 year, unless otherwise agreed


    4.3 Renting out infrastructure and event organization
    Ahlex may collect various types of personal data from data subjects who use the infrastructure or participate in events organised by Ahlex.

    • Types of personal data and purposes: 
    • Direct identification data (e.g. your first and last name)
    • Contact details (e.g. e-mail address, telephone number)
    • Company details (e.g. company name, position, department, VAT number)
    • Logistical data (e.g. event date, choice of room, specific technical and catering requirements)
    • Financial data (e.g. billing data and payment information)

    Ahlex processes these personal data of data subjects for the purpose of facilitating and managing the rental of infrastructure and the organization of events. This includes:

    • Registration and reservation of infrastructure (meeting rooms, training rooms, event venues)
    • Providing technical support and additional services such as catering
    • Invoicing and payment follow-up
    • Management of attendee lists for events
    • Drafting and sending confirmations and practical information
    • Legal basis for the processing:

    The processing of personal data by Ahlex is based on Article 6.1(b) of the GDPR, as the processing is necessary for the performance of a contract to which the data subject (or his employer) is a party.

    • Data retention period:
    • Identification and contact details: Will be kept for 2 years after the end of the event or the last reservation, unless a longer period is required by law.
    • Financial data: Kept for 10 years in accordance with legal accounting obligations.
    • Attendee lists: Kept for 6 months after the event ends, after which they are deleted.
    • Logistical data: Will be kept for 1 year after the last reservation to facilitate repeat bookings or evaluations.


  5. Sharing personal data in the context of Ahlex’s activities

    The personal data collected in the context of the above activities may be shared with third parties involved in Ahlex’s IT infrastructure and support services. These third parties are contractually obliged to take appropriate measures to protect your data and may only process the data in accordance with Ahlex’s instructions.This Privacy Statement does not prevent Ahlex from communicating your personal data to the competent authorities if they request this or are required by law.

  6. International transfers of personal data

    Ahlex prefers to process personal data within the territory of the European Economic Area (EEA). However, due to the nature of some processes, such as the need for 24/7 support, it may be necessary to transfer personal data to processors outside the EEA in certain cases.Even if the data centers of these processors are located within the EEA, it may happen that the data is accessed from locations outside the EEA, for example in the event of technical problems or for the provision of 24/7 support. Such access is also considered an international data transfer.

    For some processes, processors’ datacenters may be located outside the EEA or access may be granted from countries such as the United States of America. In such cases, Ahlex ensures that an adequate level of protection is guaranteed. Even when the transfer is carried out through an adequacy mechanism, such as the EU-US Data Privacy Framework for transfers to the United States, Ahlex remains alert to compliance with privacy rules by third parties. We set strict requirements for these parties and carry out checks to ensure that they comply with the applicable regulations and adequately protect the data of data subjects.

  7. Your rights regarding the processing of your personal data

    As a data subject, you have a number of rights under the GDPR with regard to the personal data that we process about you. Below is an overview of these rights and how you can exercise them:

    • Right of access

    You have the right to know whether we process personal data about you, and if so, to access that personal data. You can request a copy of the data we hold about you, as well as information about the purpose of the processing, the categories of data processed, the recipients of the data and the retention periods.

    • Right to withdraw your consent

    Where the processing of your personal data is based on your consent, you have the right to withdraw this consent at any time. Withdrawing your consent will not affect the lawfulness of the processing before the withdrawal.

    • Right to rectification

    If you notice that the personal data we process about you is incorrect or incomplete, you have the right to have this data corrected or supplemented. This is essential to ensure that the information we hold about you is accurate and up-to-date.

    • Right to erasure

    In certain circumstances, you have the right to request that we erase your personal data. This right applies if:

    • The data is no longer necessary for the purposes for which it was collected.
    • You object to the processing and there are no compelling legitimate grounds for the processing.
    • The data has been unlawfully processed.
    • The erasure of the data is necessary to comply with a legal obligation.
    • Right to restriction of processing:

    You have the right to restrict the processing of your personal data in the following cases:

    • You dispute the accuracy of the personal data for the period necessary for us to verify the accuracy.
    • The processing is unlawful, and you oppose the erasure of the data and instead request the restriction of its use.
    • You have objected to the processing, and we are waiting for the verification of whether our legitimate grounds outweigh yours.
    • Right to object to the processing of your personal data

    You have the right to object to the processing of your personal data where such processing is based on our legitimate interests. We will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

    If you have any questions about this privacy statement, the processing of your personal data or your rights, you can send a signed written request to Ahlex, by post: Ahlex NV/SA, attn. the Data Protection Officer, Priester Cuypersstraat 3, 1040 Brussels, or by e-mail: privacy@brusselsairport.be . 

    Despite all our efforts to protect your privacy and comply with relevant laws, you may not agree with the way we collect, use and/or process your personal data. In this case, you can also lodge a complaint with the Belgian Data Protection Authority, which you can contact by post: Data Protection Authority/Autorité de protection des données, Drukpersstraat 35, 1000 Brussels or by e-mail: contact@apd-gba.be .

  8.  Updates

    Ahlex may change this Privacy Statement at any time in the future. Such changes will be published here. We therefore recommend that you check this page regularly for updates.

    If Ahlex were to use your personal data in a way that is materially different from that at the time of its collection, we will send you a notice by the means deemed most appropriate, and in any case inform you by posting a notice on our website indicating that the privacy policy has been changed or updated.

    Last updated: 13/01/2025