Privacy Policy

1. Who we are

Air Talent Management MT, Ltd. (“we”, “us”) is a Maltese company that employs aeronautical and automotive mechanics and deploys them as posted workers on projects across Europe. We operate the employee portal at portal.airtalentmanagement.com to manage timesheets, documents and payroll-related communications with our employees.

Contact for data-protection requests: privacy@airtalentmanagement.com.

2. What data we process

• Identity data: full name, ATM employee number, email address, start date, country of work.
• Authentication data: hashed password (bcrypt), session tokens, login timestamps, IP addresses and browser information at the time of login.
• Working time data: daily hours, breaks, vacation, sick leave and unpaid leave entries you submit through the timesheet.
• Audit log of admin and security-relevant actions.

3. Why we process it

• Performance of your employment contract (Art. 6(1)(b) GDPR): recording working time, calculating overtime, generating payroll reports for our payroll provider (CLA Malta).
• Compliance with legal obligations (Art. 6(1)(c) GDPR): record- keeping required by labour and posted-worker regulations.
• Legitimate interests (Art. 6(1)(f) GDPR): securing the portal, detecting unauthorised access, maintaining audit logs.

4. How long we keep it

Timesheets and payroll data are retained for the period required by Maltese labour and tax law (currently up to 10 years). Login audit logs are retained for up to 24 months. Inactive accounts are soft-deleted; their data is purged on request unless we are required to retain it.

5. Who we share it with

• CLA Malta (our external payroll provider) — receives a monthly consolidated report of approved working time per employee.
• Hosting and infrastructure providers (Railway in the EU, Cloudflare R2 in the EU for documents) under appropriate data- processing agreements.
• Email delivery provider (Resend) for transactional messages such as the welcome email and password resets.

Your data is processed in the European Economic Area. We do not sell your data and we do not share it with advertisers.

6. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict processing, port your data and object to processing. To exercise any of these rights, email privacy@airtalentmanagement.com. You also have the right to lodge a complaint with the Maltese Information and Data Protection Commissioner (idpc.org.mt).

7. Cookies

The portal sets a single cookie (the session cookie issued at login) which is strictly necessary to keep you signed in. We do not use analytics or advertising cookies and therefore no consent banner is displayed.

8. Security

All connections to the portal use HTTPS. Passwords are stored using bcrypt. Sessions expire after 8 hours. Access to admin functionality is restricted by role and audit-logged. We will notify affected users without undue delay in the event of a personal data breach as required by Art. 33–34 GDPR.