LEGAL
Privacy notice
How we handle your information when you contact us, sign in or work in Airside Works Manager.
Last updated: 19 September 2026
Who we are and how to contact us
Airside Works Manager (AWM) is provided by Maestranza B.V., registered in the Netherlands under Chamber of Commerce (KvK) number 42113511, VAT number NL869791205B01. In this notice, “we” and “Maestranza” mean that company.
Contact support@airsideworksmanager.com for privacy questions, requests about your personal data, or details of your organisation’s deployment. Please identify the service and organisation concerned, but do not send passwords, authentication codes or unnecessary identity documents.
When this notice applies
This notice covers our public website, enquiries and business communications, AWM accounts and guest access, and the operation and support of AWM. It also explains how personal data can appear in an airport workspace, including in the GIS client, imports, attachments, approvals and audit records.
AWM is a business service for authorised airport staff, contractors and other professional users. It is not intended for children. A customer’s own privacy notice also applies to the way that customer uses AWM and manages its staff and contractors.
Our role and your organisation’s role
Maestranza is a controller when it decides how to handle its own enquiries, customer relationships, billing records and the account administration and security records needed to run its business and protect its service.
For personal data an airport or other customer places in its workspace, and activity records we maintain on that customer’s instructions, the customer is normally the controller and Maestranza is its processor. Where the customer itself acts for another controller, Maestranza may be a subprocessor. The customer determines the purpose, authorised users and applicable retention instructions. Our data-processing agreement governs that work.
These roles depend on the processing concerned, not simply on where a server is located. In a customer-hosted deployment, the customer operates the agreed infrastructure; Maestranza processes information only to the extent required by the agreed delivery or support arrangement.
The information we handle and where it comes from
We obtain information from you, your organisation’s administrators and authorised users, your identity provider, and the systems that deliver and protect the service.
| Category | Information and source |
|---|---|
| Enquiries and communications | Your name, work email, airport or organisation, message, optional product and delivery preferences, and subsequent correspondence. You provide these through the form, email or discussions with us. |
| Accounts and access | Name, email or sign-in identifier, Microsoft directory and user identifiers, organisation, invitation status, assigned roles, permitted airports and access expiry. These come from your identity provider and the administrators who arrange access. |
| Workspace content | Plans, tickets, comments, contacts, source evidence, drawings, photographs, attachments, imports and exports. These may identify authors, reviewers, contractors or people mentioned in uploaded material. The customer and its users supply this content. |
| Activity and diagnostics | Who performed an action, the affected airport or record, timestamps, outcomes and approval history; and, where enabled, session and request identifiers, load times, error details and technical performance measurements. Records can be linked to a user and are not necessarily anonymous. |
| Connection and security data | IP addresses, browser or device information and request details handled by hosting, identity and security services. The enquiry form also uses a hash of the sending IP address to limit repeated submissions. |
| Business administration | Customer and supplier contacts, agreements, invoices, payment status and records needed to manage a business relationship. We receive these from the people and organisations concerned. |
Microsoft sign-in and the first-time permissions screen
Microsoft Entra authenticates AWM users. We receive identity claims and access information needed to recognise you and enforce your permissions. Your Microsoft password and authentication codes are entered with Microsoft or your own identity provider; AWM does not ask you to give them to us.
If you are invited as a guest, Microsoft creates a guest relationship with our directory. Its first-time consent screen explains that the organisation can receive profile information, record activity and use that information. For AWM, this supports account administration, access control, security, troubleshooting and attributable operational records. It does not itself give Maestranza permission to read your personal mailbox, personal files or general browsing history.
A customer administrator may separately approve a directory connection for finding users, inviting guests where supported, and assigning application access. That is an administrator-level integration with its own permissions, separate from an individual’s guest consent. Removing AWM access does not delete your underlying Microsoft or employer account.
Why we use information and our legal bases
The following bases apply where Maestranza is the controller. Where we act as a processor, the customer identifies and communicates its own legal basis; our contract with the customer is not itself a legal basis for processing every employee’s data.
When we rely on legitimate interests, we assess whether the processing is necessary and proportionate and weigh those interests against people’s rights. You may object on grounds relating to your situation.
| Purpose | Legal basis where we are controller |
|---|---|
| Answering a website enquiry | Consent given with the enquiry form. You can withdraw it by contacting us. For email enquiries and ongoing business correspondence, our legitimate interest in responding and managing business relationships applies; pre-contractual steps apply where you personally request a contract with us. |
| Managing business accounts and access | Our legitimate interests in providing a secure professional service, verifying authorised users and maintaining customer relationships. Performance of a contract applies where the individual is personally a contracting party. |
| Protecting and operating the service | Our legitimate interests in preventing abuse, investigating incidents, correcting faults and maintaining service reliability. A specific legal obligation applies where law requires particular processing. |
| Billing and business records | Performance of a contract where applicable, legitimate interests in administering corporate customer relationships, and legal obligations to keep required accounting and tax records. |
| Resolving complaints and disputes | Our legitimate interests in investigating concerns and establishing, exercising or defending legal claims, and compliance with applicable legal obligations. |
Required information and choices
We need the required contact fields to answer a form enquiry and identity and authorisation information to provide an account. Without that information, we may be unable to respond or grant access. Optional enquiry fields are not a condition of contacting us. We do not add an enquirer or user to an advertising mailing list merely because they contact us or sign in.
Only upload personal information needed for the work. Do not include passwords, identity documents, medical information, criminal-record information or other sensitive personal data unless a specific lawful use and suitable safeguards have been agreed with your organisation and Maestranza.
Who can receive information
Access is limited according to the service and the task. Authorised people in your organisation can see information permitted by their roles, including work and approval history. Maestranza personnel and contracted support providers may access information where needed for administration, support, security or agreed service delivery, subject to confidentiality and access controls.
We use service providers for hosting, databases and storage, identity, email and service operation. Our service-provider page names the services identified in the current implementation and distinguishes core providers from optional integrations and direct browser requests. Customer-selected integrations and recipients of an export receive the information that the authorised user chooses to share.
We may disclose information where law requires it, to professional advisers under confidentiality, or where necessary to establish or defend legal claims. If a business transfer affects personal data, we require appropriate confidentiality and protection and provide any notices required by law. We do not sell personal data or share it with advertisers for behavioural advertising.
Locations and international transfers
The public website uses Mijndomein hosting. The current managed AWM implementation uses STACKIT application hosting in Germany and Supabase for managed databases and storage in configured project regions. A customer’s delivery agreement identifies its deployment and data locations. Customer-hosted installations can differ.
European hosting does not mean that every identity, email, support or external content service processes information exclusively in the EEA. Global providers and their subprocessors may process information or access it from other countries. Direct requests to external map services also have their own processing arrangements.
Where Maestranza transfers personal data outside the EEA, applicable data-protection requirements must be met, using an adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses, with assessments and supplementary measures where necessary. Contact us for the safeguards applicable to your data or a copy, subject to protection of confidential information. A hosting-region selection alone is not a transfer safeguard.
How long information is kept
We have not yet adopted a company-wide retention policy or a fixed retention period for enquiries. For customer workspace data, retention, return and deletion arrangements are to be agreed with each customer and recorded in its service agreement or processing schedule. These arrangements depend on the data, the purpose of the service and applicable recordkeeping requirements, and can be revised by agreement within those requirements.
Personal data must be kept only for as long as needed for its purpose or an applicable legal requirement. The table below distinguishes arrangements to be agreed from existing technical defaults. Closing an account or marking a record deleted does not necessarily erase the information or its history. Contact support@airsideworksmanager.com to discuss the arrangements for your organisation or request deletion.
| Records | Retention criteria |
|---|---|
| Enquiries and correspondence | No fixed retention period has been adopted yet. Relevant considerations are handling the enquiry, follow-up you have requested, any resulting business relationship, and specific legal or dispute-related needs. You can contact us to request deletion or withdraw consent; any information that must still be retained requires a separate lawful basis. |
| Identity and access records | While access is authorised, followed by the records needed to evidence provisioning, security decisions or disputes. The customer controls its own directory account. An AWM guest record can require separate removal from the directory. |
| Workspace and approval history | Retention and deletion periods are to be agreed with the customer, taking account of its instructions and applicable operational recordkeeping requirements. Account closure does not automatically erase records authored or approved by that user. Any continued retention of attribution needs a purpose and lawful basis. |
| Diagnostics and performance data | For the configured monitoring window and any specific incident investigation. Standard software defaults are 3 days for traces, 7 days for diagnostic events and raw metrics, 30 days for minute summaries and 90 days for daily summaries. Deployment settings may differ; these are distinct from retained operational audit history. |
| Enquiry abuse prevention | The form evaluates a rolling one-hour submission window. Its temporary files can remain until subsequent use or host cleanup; the one-hour window is not a guarantee that files are erased after one hour. Separate hosting security logs follow the provider’s applicable retention. |
| Backups and business records | Backup retention and expiry must be specified for the deployment with the customer and relevant hosting provider; no single period has been set for all deployments. Required business and tax records remain subject to applicable statutory periods. Return and deletion arrangements must also address recovery copies. |
Security and service diagnostics
AWM uses authenticated access, server-side permission checks, customer and airport access restrictions, encrypted connections and operational logging. The measures and responsibilities for a particular deployment are described in its agreement and data-processing arrangements. No service can guarantee absolute security.
Our application diagnostics are designed to capture bounded technical measurements and selected error information, rather than a recording of your screen, keystrokes or everything you type. Operational audit records can contain the details needed to explain a change. Names, identifiers and error information can still be personal data. Please avoid putting unnecessary personal information in free-text records or support attachments.
We do not use customer workspace content to train general-purpose AI models as part of the standard AWM service. Any additional processing or external AI service would require a defined purpose, appropriate information and a lawful arrangement before customer personal data is used.
Cookies, automated decisions and external sites
The AWM application uses browser storage for sign-in, session continuity and preferences. Microsoft and hosting security services can use their own cookies. The public website and the signed-in application have different storage behaviour; see the cookie notice for the distinction.
AWM applies access rules and automated validation checks, but Maestranza does not use the processing described here to make solely automated decisions about an individual with legal or similarly significant effects. Airport operational decisions and approval responsibilities remain with authorised people. If you believe an access decision is wrong, contact your administrator or us for review.
Links and external integrations do not bring another organisation’s independent processing under this notice. Review its notice where you choose to use its service.
Your rights and how to use them
Depending on the processing and the applicable conditions, you can request access to your personal data, correction, erasure, restriction and portability. You can object to processing based on legitimate interests and withdraw consent at any time. Withdrawal does not affect the lawfulness of earlier processing. Rights such as erasure and portability are subject to legal conditions and do not require deletion of every operational record in every circumstance.
Email support@airsideworksmanager.com. We may ask for proportionate information to verify your identity. We normally respond within one month; if the law permits an extension for a complex or numerous request, we explain the reason within that month. Requests are generally free, subject to the limited exceptions allowed by law.
For customer-controlled workspace information, contact your organisation first. If you contact us, we help route the request and assist the customer under its instructions. You may complain to the Dutch Autoriteit Persoonsgegevens or the competent supervisory authority where you live, work or believe an infringement occurred. You do not have to contact us first to complain.
Changes to this notice
We update this page when the relevant processing changes and show the revision date above. Material changes will be brought to the attention of affected users or customer contacts through an appropriate service or direct communication. A new notice does not retrospectively authorise a new use of data, replace required consent or amend a signed customer agreement.