Privacy Policy

OMS Crew and EFB Suite apps for iOS and Android · Effective date: 06 October 2026

This policy covers two apps published by Pan Aero LLC for operators who use the OMS operations management system:

OMS Crew – the crew app: roster, flights, duties, expenses, passenger checks, training records and safety reports.
EFB Suite – the electronic flight bag: document library, flight documents, journey log, loadsheet, training, FSTD logs and safety reports.

Where something applies to only one app, it is marked OMS Crew or EFB Suite. Everything else applies to both.

In short

Both apps are work tools. You sign in with an account your operator gave you.
The apps only exchange data with your operator's OMS server, plus Apple or Google to deliver push notifications.
Your operator decides what data is processed and why. It is the data controller. Pan Aero publishes the apps and provides the OMS software, but does not itself collect any personal data through the apps.
There is no advertising, no tracking, no analytics, no location tracking, and no data is sold.
Data on the device is kept in the app's private storage and is not included in backups.

1. Who is responsible

Your operator (data controller). Both apps show and record data in the OMS system of the airline, operator or training organisation you work for. That organisation created your account (for EFB Suite this may be an account of the tablet rather than of a person). It decides which data is processed, for what purposes and for how long, and is the controller of the personal data under the EU General Data Protection Regulation (GDPR). Its own privacy notice for employees, crew and students also applies.

Pan Aero LLC (publisher and software provider). The apps are published by Pan Aero LLC, Kolodvorska 17, 42230 Ludbreg, Croatia (“Pan Aero”, “we”). Pan Aero develops the apps and the OMS software. Pan Aero does not collect, receive or use personal data from the apps for its own purposes. The apps have no connection to any Pan Aero server of their own: they communicate only with the OMS server of your operator. Where Pan Aero hosts or supports an operator's OMS system, it processes personal data on behalf of and on the instructions of that operator, as a processor under a data processing agreement.

OMS Crew If you are signed in to the OMS systems of several operators (More > Add account), each operator is responsible for the data of its own account. The accounts are kept completely separate in the app.

2. What data the apps process

Depending on the app and the features your operator has switched on, the following data is processed.

Category	Examples	App
Account and profile	Name, username, crew ID, e-mail address, phone number, function or rank, operator name	Both
Sign-in and security	Password, two-factor authentication codes, session token or device registration, failed sign-in attempts	Both
Device information	Installation or device registration ID, platform, device model, operating system and app version, device name. On devices managed by your operator's mobile device management (MDM): device serial number and MDM device name	Both
Operational data	Roster, duties and duty times, flights and bookings, routes, aircraft, crew lists and crew contact details, handling contacts, notes, notifications, monthly roster bids	OMS Crew
Passenger data	Passenger lists of your flights, which may include names, photos and travel document details, for passenger checks	OMS Crew
Expenses	Expense reports with amounts, remarks and invoice photos	OMS Crew
Training and flight records	Your training records and expiry dates, pilot logbook entries from closed journey logs	OMS Crew
Documents	Operator manuals and library documents, flight documents and attachments (for example operational flight plans), which may contain names of crew and passengers; your comments on library documents	EFB Suite
Journey log and loadsheet	Flight times, fuel, crew of the flight, passenger numbers and weights, defects and remarks, pre- and post-flight signatures of the crew	EFB Suite
Training (instructors)	Lesson sheets and training records filled in by an instructor, including the names and on-screen signatures of instructors and students; FSTD (simulator) session logs	EFB Suite
Safety and occurrence reports	Reports with their photos, videos (with sound) or files	Both (videos: EFB Suite)
Confirmations and checks	Confirmations of flights and bookings, passenger check ticks and remarks	OMS Crew
Push notification token	Identifier issued by Apple or Google that lets the server send notifications to your device	Both

Photos sent from OMS Crew are re-encoded by the server, which removes embedded metadata such as location (EXIF/GPS).

3. What the apps do not collect

No location or GPS data
No contacts, calendars or browsing history
No advertising identifiers, no advertising and no tracking across apps or websites
No analytics, usage statistics or crash-reporting services from third parties
No biometric data: Face ID / Touch ID is checked by the device itself, and the app only learns whether it succeeded
No sale or rental of personal data

4. Device permissions

Camera / photos: only when you choose to take or attach a photo (an invoice for an expense OMS Crew, or a photo for a safety report).
Microphone EFB Suite: only when you record a video with sound to attach to a safety report.
Files: only the files you pick yourself in the system file picker.
Face ID / Touch ID EFB Suite: optional, to sign a journey log or loadsheet or to log in to the Training tab with the credentials stored for the tablet's account.
Notifications: to tell you about changes that concern you, for example schedule changes and expiring training records OMS Crew, or new and changed documents and flights EFB Suite. You can turn notifications off at any time in your device settings.

5. Purposes and legal basis

The data is processed only to provide the apps' functions:

showing rosters, flights, duties, documents and other operational information, including offline;
preparing and recording flights (journey log, mass and balance / loadsheet) EFB Suite;
recording training and simulator sessions;
letting you confirm assignments and submit expenses, bids, requests, passenger checks, document comments and safety reports to your operator;
notifying you of changes that concern you (for example your schedule, training records, documents or flights);
keeping accounts and the operator's data secure.

The legal basis is determined by your operator. It is typically the performance of your employment, service or training contract (Art. 6(1)(b) GDPR), compliance with legal obligations of the operator, for example aviation safety, flight documentation, mass and balance, flight time limitation, training, occurrence reporting and record-keeping rules (Art. 6(1)(c)), and the operator's legitimate interest in running safe and efficient flight operations (Art. 6(1)(f)).

6. Data stored on the device

OMS Crew

Downloaded data is stored encrypted (AES-256) in the app's private storage. The key is kept in the iOS Keychain or Android Keystore and never leaves the device.
Your password is never stored. Only a session token is kept, in the Keychain or Keystore.
The app has no share, export, print or “open in” functions, and text cannot be copied out of the app. On Android, screenshots and screen recording are blocked unless your operator allows them. On iOS, the content is hidden while the screen is recorded or mirrored and in the app switcher.
Downloaded data is only shown offline for the period your operator sets (3 days by default) after the last successful synchronisation. After that it is deleted.

EFB Suite

The document library, flight documents, journey log and loadsheet data are stored in the app's private storage so they can be used in flight without a connection.
The account password and device registration set in Settings are stored in the app's private storage on the tablet, so the app can work without a login screen. Journey log and Training logins of individual crew members and instructors are kept in memory only.
Documents can be printed, and opened in or shared with other apps on the device, where your operator's procedures need this. A copy shared outside the app is no longer protected by the app.

Both apps

App data is excluded from iCloud, iTunes/Finder and Android backups and from device-to-device transfers.

7. Push notifications

Notifications are delivered by the Apple Push Notification service (iOS) or Google Firebase Cloud Messaging (Android). Your operator's OMS server sends Apple or Google the push token of your device together with the notification text. By default the lock-screen text is neutral (for example “Your schedule changed – open OMS Crew to confirm.”), and details such as dates and routes are only included if your operator has enabled this. Apple and Google process this data under their own terms and privacy policies, and may do so outside the European Economic Area under the safeguards required by the GDPR.

Your operator, through its OMS system, and the people your operator authorises (for example crew control, flight operations, training, safety and finance departments).
Pan Aero, only as the operator's processor where it hosts or supports the OMS system, and only as needed for that service.
Apple and Google, only for the delivery of push notifications as described above. As publisher, Pan Aero may also receive from Apple and Google anonymous aggregated statistics (for example the number of installations) and, only if you have agreed to share diagnostics with app developers in your device settings, anonymous crash reports. These do not identify you.
Authorities, only where your operator is legally required to provide data (for example aviation authorities or accident investigation bodies).

Data is only ever sent to the OMS server of the operator the account belongs to. Operators cannot see each other's data.

9. How long data is kept

On the device OMS Crew: for the offline period set by your operator after the last synchronisation, or until you log out, whichever comes first. Items waiting to be sent (expenses, reports, confirmations) are kept until they are sent or deleted.
On the device EFB Suite: documents until the operator replaces or withdraws them or the app is removed; journey log, loadsheet and report data until it has been sent to the OMS server.
On the operator's OMS server: according to your operator's retention policy and the legal retention periods that apply to it.

10. Security

All communication uses encrypted HTTPS connections. Two-factor authentication is supported, devices have to be registered, repeated failed sign-ins are limited, and updates of the apps' own files delivered by the server are verified before they are installed (in OMS Crew they must be digitally signed by Pan Aero). Your operator can end sessions or reset device registrations remotely, for example if a device is lost.

11. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to data portability, within the limits set by law. Because your operator is the data controller, please send such requests to your operator, for example its data protection officer or HR, crew or training department. If you contact Pan Aero, we will forward your request to the operator concerned and assist it in responding.

You also have the right to lodge a complaint with a data protection supervisory authority. This is usually the authority in the country where you live or work, or where your operator is established. In Croatia it is the Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, azop.hr).

12. Logging out and deleting data

OMS Crew Log out (More > Log out) removes the account, its encryption key and all its data from the device and ends the session on the server.
EFB Suite Removing the account from Settings stops the app from using it; your operator can also reset the tablet's registration.
Uninstalling either app removes all its data from the device.
Accounts are created and managed by your operator, not in the apps. To have your account or server-side data deleted, contact your operator.

13. Children

OMS Crew and EFB Suite are professional tools for aviation personnel and are not intended for children.

14. Changes to this policy

We may update this policy when the apps or legal requirements change. The current version is always available at this address, with its effective date at the top. Significant changes will be announced in the apps or through your operator.

15. Contact

For questions about your data, please contact your operator first. For questions about the apps or this policy:

Pan Aero LLC
Kolodvorska 17
42230 Ludbreg, Croatia
E-mail: privacy@pan.aero