LEGAL
Service providers and data export
Where other services are involved, what they receive and how customers can retrieve their information.
Last updated: 19 September 2026
How to read this register
This register describes services identified in the current AWM implementation and website. A customer does not necessarily use every service here. Its agreement and processing schedule must identify the actual deployment, approved subprocessors, contracting entities, regions, enabled integrations and applicable transfer safeguards.
A provider contracted by Maestranza to process customer personal data is a subprocessor for that work. A provider selected and contracted directly by the customer may instead act under the customer’s own arrangements. An external content provider can process connection information for its own purposes. Listing a service is not a claim that every provider is an AWM subprocessor or that all necessary agreements have automatically been executed.
Core website and managed-service providers
These providers support the public website or the current managed AWM implementation. The legal entity and applicable service terms must be matched to the customer’s agreed deployment; a future hosting option is not presented as an already completed migration.
| Provider and service | Information involved | Deployment and location |
|---|---|---|
| Mijndomein — public website and enquiry delivery | Website connection and security information, submitted enquiry fields and delivery metadata. The form runs on the website host and sends a notification to our business inbox. | Public website hosting in the Netherlands. Email delivery and the destination mailbox are separate parts of the processing chain; website hosting does not prove the location of every mail operation. |
| Microsoft — Entra identity and Microsoft 365 business communications | Identity claims, directory identifiers, invitations, access assignments, authentication and security information; business correspondence where handled in Microsoft 365. AWM does not receive the user's Microsoft password. | AWM-managed identities or a customer's own directory, according to the connection. Microsoft's global service, support and processing arrangements apply; EU hosting is not an unconditional guarantee of EEA-only processing. |
| STACKIT — managed application hosting and secrets | Application and API traffic, information processed in the hosted service, infrastructure logs and protected service configuration. | Current managed application deployment uses EU01 / Germany South. Customer-hosted or separately contracted deployments can differ. |
| Supabase — managed PostgreSQL and object storage | Customer workspace and platform records, audit and monitoring records, and attachments where its storage service is configured. Authorised file downloads can connect directly to storage using a temporary link. | Used in the current managed implementation. Each project's region and backup arrangements must be recorded in the deployment schedule. Provider support and subprocessors require a separate international-transfer assessment; the project region alone is not enough. |
External resources and optional integrations
The following connections serve particular features. Direct browser requests reveal the connection information necessary to serve the resource. Server-side requests originate from AWM infrastructure rather than deliberately forwarding the end user's browser session. Integration-specific processing must be assessed before a customer sends restricted data.
| Service | When it is contacted | Information sent |
|---|---|---|
| Esri ArcGIS World Imagery | The application requests imagery when the relevant external imagery layer is used. | Direct browser requests disclose the user's IP address and ordinary request metadata, and the requested tile coordinates. AWM does not deliberately attach its login token or uploaded customer records to these tile requests. |
| MapLibre public map-font endpoint | The current map configuration loads map-label font resources from demotiles.maplibre.org. | Direct browser requests disclose IP address and request metadata, including the requested font and character range. Using open-source map software does not make its hosted resources a local-only service. |
| WeatherAPI | An enabled weather feature requests a forecast through the AWM backend. | The configured airport location, service credentials and server connection metadata. The request does not deliberately send the user's name, Microsoft token or workspace attachments. |
| AeroDataBox via RapidAPI — demo flight schedules | Used only to supply flight-schedule data for demonstrations when the demo flight panel is enabled. This integration is not used in the production AWM service. | The selected airport ICAO code, schedule query parameters, API credentials and server connection metadata. Requests originate from the AWM backend and do not deliberately include the user's identity, Microsoft token or customer workspace content. |
| ADSB.fi | An enabled live-traffic feature requests public aircraft data through the AWM backend. | The geographic query and server connection information. Aircraft data returned by the feed is external operational information and can be incomplete or delayed. |
| Facilis FAIVA | Only where external validation is enabled, credentials are configured and an authorised operator requests validation. | The selected AIXM export, validation selections and service connection information. The export can contain operationally sensitive data and any personal details present in its fields. This is a transmission of customer content to an external validator. |
| Customer-selected feeds, identity and recipients | Only as configured or directed for the customer's service. | The information necessary for the selected integration or export. The customer must identify the recipient, authority, licence and applicable data-protection arrangement before activation. |
Changes and international access
For customer personal data, the agreed DPA governs authorisation and notice of subprocessor changes. We notify the designated customer contact of proposed changes under that process; editing this page alone does not replace the notice. Ask support@airsideworksmanager.com for the provider chain and safeguards applicable to your deployment.
The current managed application infrastructure is in Germany; database and storage jurisdiction depends on the selected project region, while the website uses Netherlands hosting. Providers can also be subject to laws in their countries of establishment. European storage is not immunity from international access requests.
Our contractual approach is to restrict processing to authorised purposes, require suitable confidentiality and access controls, assess transfer arrangements, review binding disclosure requests, challenge them where there are reasonable legal grounds, and disclose only what is lawfully required. Customer-specific measures and evidence must be recorded in the processing and security schedule, including any necessary transfer clauses and supplementary measures.
Requesting an export or a switch
An authorised customer contact can email support@airsideworksmanager.com to request retrieval, a switch to another provider or its own infrastructure, or deletion. Identify the customer, airports, desired data scope and destination. We verify authority and agree a secure delivery method; do not send credentials or unprotected datasets in the request.
AWM's existing feature exports and attachment downloads cover specific records. A complete exit can also require an assisted extract of workspace, identity-mapping and history records. There is no claim that a single self-service button currently exports an entire customer environment. The scope below is the export register for the standard data categories; additional contracted features must be added to the customer's schedule.
| Exportable category | Format or delivery method | Scope and limitations |
|---|---|---|
| Aeronautical datasets and publication outputs | AIXM XML and the applicable generated output files. | Export follows the selected version, time and feature scope. Preserve the relevant schema/version information. AIXM does not contain all work tickets, attachments or account administration. |
| Workspace records and history | Assisted structured extract using JSON, CSV or an agreed database format, with a description of identifiers, relationships and time fields. | Customer work items, changes, approvals, comments, configuration and relevant retained history. The actual extraction and relationship mapping must be planned for the deployment; this is not a promise of an existing complete self-service export endpoint. |
| Uploaded files and associated metadata | Original available file formats plus a structured metadata manifest. | Includes customer attachments and their available record associations. Rights in externally licensed source material remain subject to its licence. Expired or already lawfully deleted files cannot be recovered by an export request. |
| Customer access configuration and retained activity | Assisted structured extract of relevant identifiers, roles, airport grants and retained customer-specific activity. | Excludes Microsoft passwords and private authentication keys. Identity-provider settings owned by the customer must also be retrieved from that provider. Records no longer retained cannot be recreated. |
Export boundaries and continuity
Export does not transfer AWM software ownership, private infrastructure credentials, another customer's information, or Maestranza's internal source code, proprietary service implementation and non-customer-specific security configuration. These internal categories are excluded to protect security and intellectual property, not to withhold customer inputs, outputs, relevant metadata or other exportable data required by law.
Destination software may use different models, identifiers, time handling and validation rules. Customers and destination providers must cooperate on mapping and verification. Maestranza provides the assistance and continuity required by the agreement and applicable law; it does not promise identical functionality in an unrelated destination product. Known migration limits, any permitted charges, the retrieval period and the final deletion schedule must be communicated before the transition is agreed.