Privacy Policy (crewtax.eu)
Controller
Aerlon OÜ (trading as crewtax)
Harju maakond, Tallinn, Kesklinna linnaosa, Tartu mnt 67/1-13b, 10115, Estonia
E-mail: office@crewtax.eu
Scope
This policy explains how we process personal data when you visit crewtax.eu, contact us, or engage us to deliver administrative services (e.g., preparing and submitting requests/filings in your name to reclaim Austrian wage tax).
1) What we do (summary)
We provide administrative services only. We do not provide tax or legal advice and do not prepare annual tax returns. We prepare and submit the required paperwork in your name, coordinate with the competent authority, and manage follow-ups until payout.
2) Categories of personal data we process
Depending on your interaction with us:
Identity & contact data: name, date of birth, nationality, postal address, e-mail, phone.
Regulatory identifiers: (if applicable) Austrian tax number, Austrian social security number, foreign tax ID.
Employment & case data: airline/employer, position/role, bases used, workday breakdown (AT vs abroad), start dates, mandate history.
Financial data: IBAN/BIC for refunds, invoice/payment records.
Evidence/attachments you provide: payslips, year-end statements, tax returns/assessments, employer confirmations (e.g., workdays/Section 8), residency certificates, correspondence with authorities.
Technical data (site): server logs (IP address, timestamp, URL, user agent), strictly for security and operations.
We do not intentionally collect special categories of data (Art. 9 GDPR). If such data appears incidentally in documents you supply, we handle it only as necessary to execute your mandate and protect your rights.
3) Sources of data
You (or your authorised representative/advisor)
Your employer (e.g., workday confirmation) — only with your mandate
Public authorities (queries/replies in your case)
Our service providers (operational metadata only, e.g., mail/fax delivery status)
4) Purposes & legal bases (GDPR Art. 6)
Delivering our administrative service and client onboardingLegal basis: performance of a contract or steps prior to entering into a contract (Art. 6(1)(b) GDPR).
Submitting your filings/requests and handling correspondence with authoritiesLegal basis: performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) in effective case management.
Billing, accounting, audits, statutory dutiesLegal basis: legal obligation (Art. 6(1)(c)) under accounting/tax laws (Estonia).
Security, fraud prevention, dispute handling, and record-keepingLegal basis: legitimate interests (Art. 6(1)(f)).
Direct communications about your caseLegal basis: performance of a contract (Art. 6(1)(b)).
Optional updates/marketing (only if you opt-in)Legal basis: consent (Art. 6(1)(a)); you may withdraw at any time.
5) Recipients & disclosures
We disclose data only as needed to deliver the service or comply with law:
Tax authorities and other competent authorities, postal services, and—where used—an EU-based online fax provider for submitting filings.
Your employer (workday/base confirmations), your appointed advisor, and postal/courier services for registered mail.
Infrastructure providers (processors): EU web hosting/e-mail, document storage, accounting. All under contracts that meet GDPR Art. 28.
Professional advisers (only if necessary and under confidentiality).
Where legally required (court or authority orders).
We do not sell or trade your personal data.
6) International transfers
We aim to keep processing within the EEA. If a transfer outside the EEA becomes necessary, we will rely on adequacy decisions or Standard Contractual Clauses plus supplementary safeguards as required by GDPR Chapter V.
7) Retention
Client/matter files & related documents: generally kept for up to 7 years after the end of the financial year in which the relevant transaction/record occurred or the mandate closed, to meet Estonian Accounting Actobligations and to preserve evidence for legal claims.
Accounting records/invoices: 7 years from the end of the relevant financial year (Estonian Accounting Act §12).
Server logs/security: typically 90 days unless needed longer for incident investigation.
Consent-based data: until you withdraw consent or earlier if not needed.
Where longer retention is required by law or necessary for the establishment, exercise, or defence of legal claims, we may retain specific records beyond the periods above, limited to that purpose.
8) Your rights (GDPR)
You have the right to access, rectify, erase, restrict, object (where processing is based on Art. 6(1)(e)/(f)), and data portability, and to withdraw consent at any time (where processing relies on consent). To exercise these rights, contact office@crewtax.eu.
You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): Tatari 39, 10134 Tallinn, Estonia; info@aki.ee; +372 627 4135.
9) Security
We apply technical and organisational measures appropriate to the risk, including access controls (data accessible to Aerlon employees only on a need-to-know basis), encryption in transit, secure storage, logging, and processor due-diligence. No method is 100% secure, but we continuously improve our safeguards.
10) Website, cookies & logs
We use no analytics or tracking cookies. Only essential, functional cookies (if any) required by the CMS/theme may be set.
Standard server logs (IP/time/URL/user agent) are processed for security and operations (Art. 6(1)(f)).
If we later add optional tools (e.g., analytics, forms, reCAPTCHA), we will update this policy and—where required—request consent.
11) How we communicate & submit on your behalf
With your mandate, we may send documents via registered mail or EU-based online fax to the competent authority and receive replies the same way. We keep proof of submission and receipt as part of your case file. Any originals you provide can be returned on request (subject to legal retention requirements).
12) Children
Our services are intended for adults working in aviation. We do not knowingly engage minors.
13) Changes to this policy
We may update this policy from time to time. Material changes will be noted on this page with a new “Last updated” date.
Last updated: 8 October 2025