This privacy policy explains how Cosmos Solutions GmbH (“Cosmos“, “we“) processes personal data when you visit our websites, use our public directory, hold an account with us, or use our products and services. It applies to everything we offer unless a separate agreement with you, such as a data processing agreement, provides otherwise.
1. Controller and contact
Cosmos Solutions GmbH, Brunnenstraße 19–21, 10119 Berlin, Germany, is the controller under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Full company details are in our imprint. For any privacy request, write to privacy@usecosmos.com.
2. When we act on behalf of a customer
Where a customer uses our platform to manage its own operations and service providers, the customer is the controller of the data it and its users enter, and we process that data on the customer’s instructions under a data processing agreement. That agreement, not this policy, governs such processing. This policy covers the processing for which we decide the purposes ourselves: our websites, the directory, accounts, billing, support and marketing.
3. What we process, why, and on what legal basis
a) Visiting our websites. Our servers and the content delivery networks we use record technical data such as your IP address, browser and device information, the pages requested and the time of the request. We use it to deliver the pages, keep the sites secure and detect abuse. Legal basis: our legitimate interest in operating secure websites (Art. 6(1)(f) GDPR). Some content is loaded from third parties directly by your browser, for example company logos, map tiles and embedded videos; those providers receive your IP address when the content is loaded.
b) Contact, demo requests and support. When you contact us, book a demo or use our support chat, we process the details you provide and the content of the conversation to respond and follow up. Legal basis: pre-contractual measures and contract performance (Art. 6(1)(b) GDPR) or our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
c) Accounts. To create an account you sign in with your business email address, by a sign-in link we send to it or through your company’s single sign-on. We store your email address, the name, job title and phone number you choose to enter, the companies you represent, your settings, and content you save such as bookmarks. Legal basis: contract performance (Art. 6(1)(b) GDPR).
d) The directory. We publish business information about companies in the aviation industry, such as company names, addresses, websites, services, certifications and locations. It comes from public sources such as company registers and websites, from the companies themselves, and from users who suggest corrections. It may include business contact details of individuals, such as a name, role and work email address, provided by the company or by a representative who confirmed they may publish them. We show contact details of individuals to signed-in users only. Legal basis: our legitimate interest, and that of the industry, in an accurate and accessible directory of business partners (Art. 6(1)(f) GDPR). You can ask us to correct or remove information about you or your company at any time (see section 8).
e) Claiming and editing a listing. If you claim a company listing or edit one, we record who made the change, the evidence you provide to show that you represent the company, and the content you submit, including uploaded logos. This keeps the directory accountable and lets us verify authority. Legal basis: contract performance (Art. 6(1)(b) GDPR) and our legitimate interest in the integrity of the directory (Art. 6(1)(f) GDPR).
f) Payments and billing. If you buy a paid service, we process your billing details, order history, invoices and payment status. Card and bank details are entered directly with our payment service provider, which processes them on our behalf; we receive confirmation of payment and limited details such as the last digits of a card. Legal basis: contract performance (Art. 6(1)(b) GDPR) and our legal obligations under tax and commercial law (Art. 6(1)(c) GDPR).
g) Marketing. We send product news and offers to existing customers by email; you can opt out at any time via the link in each email. Otherwise we send marketing only with your consent. Legal basis: consent (Art. 6(1)(a) GDPR) or our legitimate interest in informing existing customers (Art. 6(1)(f) GDPR, § 7(3) UWG).
h) Security, legal claims and compliance. We process data as needed to prevent fraud and abuse, to establish or defend legal claims, and to meet legal obligations. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) and legal obligation (Art. 6(1)(c) GDPR).
You are not obliged to provide personal data, but without the data marked as required we cannot provide the respective service. We do not make decisions based solely on automated processing that have legal effects on you.
4. Cookies and similar technologies
We use cookies and browser storage that are necessary to operate our sites: to keep you signed in, to remember your cookie choices, and to count in your browser the free directory views you have used. Analytics, marketing and embedded-media cookies are set only with your consent, which you can give or withdraw at any time via the “Cookie Preferences“ button in the footer of the site that uses them. Storing information on your device is based on § 25 TDDDG together with Art. 6(1)(a) or (f) GDPR.
5. Recipients
We share personal data with service providers who process it on our behalf under contracts pursuant to Art. 28 GDPR: hosting, database and content delivery providers, email delivery, error monitoring, customer support and communication tools, identity providers, payment service providers, and analytics providers where you have consented. The current list of our subprocessors is published in our Trust Center. We disclose data to authorities or other third parties only where the law requires it or to enforce our rights. The directory itself is public: information published there is available to anyone, including search engines.
6. International transfers
Some providers are located outside the European Economic Area, notably in the United States. Where that is the case, transfers rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or on the EU standard contractual clauses with additional safeguards where needed.
7. Retention
We keep personal data only as long as needed for the purpose it was collected for. Account data is kept until you delete your account and is then deleted without undue delay, except where we must keep it. Contract, billing and correspondence records are kept for the periods required by commercial and tax law, up to ten years. General correspondence is kept for twelve months unless statutory periods apply. Server logs are kept for a short period for security purposes. We may delete an account that has not been used for two years. Directory information stays published as long as it is accurate and relevant, and is removed on justified request.
8. Your rights
Under the GDPR you may request access to your data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. To exercise your rights, email privacy@usecosmos.com; we may ask you to verify your identity. You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, mailbox@datenschutz-berlin.de.
9. Right to object
Where we process your personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. Where we process your data for direct marketing, you may object at any time without giving reasons, and we will stop that processing.
10. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls and monitoring. Our information security management system is certified under ISO/IEC 27001; details are in our Trust Center.
11. Changes
We update this policy when our services or the law change. The current version is always published here with its date. Where changes affect processing based on your consent, we will ask for your consent again where required.
