Privacy Policy

Crewbase is operated by ‹registered company name›, a company incorporated in Nigeria with registration number ‹RC number› and its registered office at ‹registered address› (“Crewbase”, “we”, “us”). We run the service at crewbase.africa and app.crewbase.africa.

For the personal data described in this policy we are the data controller under the Nigeria Data Protection Act 2023 (the NDPA). Where an operator uses Crewbase to find and contact people, that operator is a separate controller for what it does with the data afterwards — see clause 6.

Our Data Protection Officer is ‹DPO name› and can be reached at privacy@crewbase.africa. Our registration with the Nigeria Data Protection Commission (the NDPC) is ‹NDPC registration number›.

Two kinds of account use Crewbase, and what we hold differs sharply between them:

• Professionals — pilots, engineers, apprentices and aviation office staff who build a dossier and are found by operators. Crewbase is free for professionals.
• Operators — airlines, MROs and ground handlers whose team members search, post work and pay for a subscription.

It also covers visitors to our public pages who have no account at all. It does not cover what an operator does with your details once they have contacted you — at that point the operator is answerable to you directly, and to the NDPC.

A Class 1 or Class 2 aviation medical certificate is a record about your health. Under section 30 of the NDPA that makes it sensitive personal data, which may only be processed on a narrower set of grounds and with heightened protection.

• We ask for your explicit, separate consent before you upload a medical certificate, and we tell you why we need it. You can decline; you simply will not carry a verified medical on your dossier.
• We record only the certificate class, its number, the issuing authority and its issue and expiry dates. We do not record, extract or store any clinical finding, diagnosis, limitation or restriction from the certificate.
• The uploaded document is stored in a private bucket and is readable only by you and by the Crewbase verification staff performing the check. No operator can open it on any plan.
• To operators on paid Pro or Enterprise plans, a verified medical appears as a class and an expiry date — the fact that you are current — and nothing more.
• You may withdraw consent at any time by writing to privacy@crewbase.africa. We will delete the document and the record, and the medical will disappear from your dossier.

We do not knowingly collect any other category of sensitive personal data — race, religion, political opinion, trade union membership, sexual orientation, genetic or biometric data. Please do not put any of it in your bio, your application note, or a document you upload.

Section 25 of the NDPA requires a lawful basis for every processing activity. Ours are set out below, purpose by purpose.

Where we rely on legitimate interests we have weighed those interests against your rights and concluded they do not override them. You can ask us for that assessment, and you can object — see clause 16.

An operator cannot see your email address by browsing. To obtain it, a team member with the right permission must spend a contact reveal from their plan. When they do:

• A record is written server-side identifying the company, the professional, the team member who acted and the time. It cannot be edited or deleted by the operator, and operators cannot write these records themselves.
• You are notified that it happened.
• The operator may use your details only to discuss the work they found you for. Passing them on, or adding you to a marketing list, breaches our Terms and the NDPA.

Your phone number is never released through this route. It is used by us to send AOG alerts you have consented to receive, and is not listed to operators.

The reveal record is kept even if you later close your account — see clause 13. An operator who paid to reach you is entitled to a record that they did, and you are entitled to a record of who reached you.

We contact you on four channels, and you control three of them.

Withdrawing AOG call consent takes effect immediately and is as easy as giving it, as the NDPA requires. Operators also receive an inbox: if you email a company through Crewbase, your name, address and message are stored in that company’s inbox and are readable by its team.

The platform makes three kinds of automated decision about you:

• Search ranking. Results are ordered using your profession, type ratings, hours on type, total hours, availability and base city.
• A profile completeness score. The system computes a 0–100 score from how much of your dossier you have filled in and uses it in ranking. You cannot set it yourself, and neither can anyone else — it is derived.
• AOG matching. When an operator posts a grounded-aircraft request, we select professionals within a radius of the affected airport who are available, hold at least one verified credential, and where relevant hold the right type rating. If nobody responds in time, the alert escalates to a wider group and to SMS.

None of this produces a legal or similarly significant effect on you by itself: it affects the order in which a human being sees you, not whether they engage you. Hiring decisions are made by operators, off the platform. Even so, you may object to this processing, ask us to explain how a ranking was reached, or ask for human review — write to privacy@crewbase.africa. We do not use your data to train machine learning models, and we do not sell or license it for that purpose.

We use the smallest set of cookies that lets the product work. We do not use advertising cookies, and we do not permit third parties to track you across other websites from ours.

Strictly necessary cookies do not require consent. We do not currently run any third-party analytics, advertising or session-recording tool on Crewbase. If that changes, we will ask for your consent first and update this policy before turning anything on.

Our maps are rendered by Mapbox. Loading map tiles means your browser connects to Mapbox and Mapbox sees your IP address and the area of the map you are viewing. Maps appear only inside the operator dashboard.

We do not sell your personal data, and we do not share it for advertising. We use a small number of service providers to run the platform. Each is bound by a written contract that limits them to our instructions, as the NDPA requires.

We also disclose personal data in these situations, and no others:

• To the Nigerian Civil Aviation Authority or another issuing authority, to confirm that a licence or certificate you submitted is genuine and current.
• To an operator, exactly as described in clause 6.
• To our professional advisers — lawyers, auditors, insurers — under a duty of confidence.
• Where the law requires it: a court order, a regulator exercising its powers, or the investigation of a serious offence.
• To protect life. If we believe disclosure is necessary to prevent serious harm, including to flight safety, we will make it and record why.
• To a buyer, if the business is sold or merged. We will tell you before your data moves, and the buyer will be bound by this policy until it lawfully changes it.

Some of the providers above operate outside Nigeria, so your personal data is transferred out of the country. The NDPA permits this only where there is an adequate level of protection or a recognised safeguard.

• We rely on written contracts with each provider containing data protection terms equivalent to the standard contractual clauses recognised by the NDPC, together with the provider’s own security commitments.
• We transfer only what the provider needs to do its job, and no provider is permitted to use your data for its own purposes.
• Your uploaded documents and credential records are held in our database and storage, which sit with a single provider — they are not copied to any other overseas service.
• Payments and AOG SMS stay in Nigeria, with Paystack and Termii respectively.

You can ask us for a copy of the safeguards that apply to any particular transfer by writing to privacy@crewbase.africa.

The GAID requires that where no statute sets a retention period, personal data is deleted within six months of the purpose being fulfilled. Where we hold something longer, the reason is stated.

Records kept after account closure are reduced to the minimum that serves the stated purpose. Where we no longer need to identify you, we anonymise rather than keep.

The NDPA requires appropriate technical and organisational measures. Ours are specific and enforced by the database rather than by convention:

• Row-level security on every table. Access rules live in the database, so a bug in the application cannot widen what a user can read.
• Uploaded documents sit in a private bucket, reachable only through short-lived signed links, restricted to your own folder and to verification staff.
• Credential detail is served through functions that return only the safe columns, so there is no query an operator can write that reveals a document path or a rejection reason.
• Audit records — contact reveals, verification decisions — are written by the server only. Neither operators nor professionals can create or alter them.
• No passwords exist to be stolen. Sign-in is a one-time code or a Google sign-in.
• Payment webhooks are verified by cryptographic signature before anything changes.
• Data is encrypted in transit and at rest by our infrastructure providers.
• Staff access follows least privilege, is limited to those performing verification, support or safety work, and is logged.

No system is perfectly secure, and we do not claim otherwise. What we do claim is that the sensitive parts of Crewbase are protected at the layer that is hardest to get wrong.

If a personal data breach occurs, we will report it to the NDPC within 72 hours of becoming aware of it, as section 40 of the NDPA requires, describing what happened, how many people are affected and what we are doing about it.

Where the breach is likely to result in a high risk to your rights — for example if uploaded licence documents were exposed — we will tell you directly and without undue delay, in plain language, and tell you what to do about it. We will not wait for certainty about scope before warning you.

Under the NDPA you have the following rights over your personal data. They are free to exercise, and using them will never disadvantage your standing on the platform.

• To be informed — this policy, kept accurate.
• Access — a copy of the personal data we hold about you, including which operators revealed your contact details and which hold a shortlist entry for you.
• Rectification — correction of anything inaccurate. Most of your profile you can correct yourself, immediately.
• Erasure — deletion of your data where we no longer have a good reason to hold it. See clause 17.
• Restriction — to have us pause processing while a dispute about accuracy or legitimate interests is resolved.
• Portability — your data in a structured, machine-readable format, or sent directly to another controller where technically feasible.
• Objection — to processing based on legitimate interests, including your appearance in operator search, and to any direct marketing. An objection to marketing is absolute and takes effect at once.
• Withdrawal of consent — for AOG SMS and calls, for your medical certificate, and for optional email. Withdrawal does not undo processing already carried out lawfully.

Write to privacy@crewbase.africa from the address on your account. We will acknowledge within 7 days and respond within 30 days. If a request is unusually complex we may take a further 30 days and will tell you why. We may ask you to confirm your identity, but only as much as is needed to be sure we are not handing your dossier to someone else.

If we refuse a request we will say so plainly, explain why, and tell you how to challenge it.

We would rather tell you this than let you believe otherwise. The delete-account control in the operator settings screen currently signs you out and returns you to the sign-in page. It does not remove anything. Full self-service erasure is being built.

Until it ships, email privacy@crewbase.africa from your account address and ask us to delete your account. We will:

• Remove your profile, dossier, type ratings, logbook figures and applications, so that you disappear from operator search immediately.
• Delete your uploaded documents within 30 days.
• Retain only what clause 13 lists as outliving the account — principally verified credential records, the verification log and contact reveal records — and nothing else.
• Confirm to you in writing when it is done.

If you are an operator team member, closing your own account does not close your company’s workspace or cancel its subscription. A workspace administrator must do that.

Crewbase is for working aviation professionals and the companies that engage them. You must be at least 18 to hold an account. We do not knowingly collect data about children, and if we learn that we have, we will delete it.

When the product changes what it does with data, this page changes with it — it is maintained as part of the codebase, not separately from it.

For material changes — a new category of data, a new recipient, a new purpose, or a transfer to a new country — we will give you at least 14 days’ notice by email before they take effect. If a change requires your consent, we will ask for it rather than assume it. Minor corrections take effect on publication, and the version and date at the top of this page always tell you which version you are reading.

For anything in this policy, or to exercise a right, write to privacy@crewbase.africa, or by post to ‹registered company name›, ‹registered address›, for the attention of the Data Protection Officer.

If you are not satisfied with how we have handled your data or your request, you can complain to the Nigeria Data Protection Commission, No. 5 Gambia Street, Wuse Zone 5, Abuja — info@ndpc.gov.ng — which can investigate and order us to put things right. You do not have to come to us first, though we would like the chance to fix it.

Our Terms of Service govern your use of the platform and should be read alongside this policy.