How Helion Aerospace ehf. handles personal data when you use the platform, contact us, or attend an event with us. Effective 1 January 2026.
Helion Aerospace ehf., registered in Iceland with the office at Sundlaugavegur 32, 105 Reykjavík, is the data controller for the personal data described in this policy. We are the controller for data about people who hold accounts, use the platform, contact us or correspond with us. We are not the controller for the spacecraft telemetry that customers send us: that is processed on our customer's behalf under their instructions, and the applicable terms are their agreement with us rather than this policy.
This policy applies to the helionhq.link website, the Helion platform and its APIs, our support and sales correspondence, and our commercial relationships with research institutions and operators. It does not apply to third-party sites we link to, and it does not govern the processing of customer telemetry, which is described in the relevant customer agreement and the data processing addendum.
We process the following categories, and only the following categories:
Under the EU General Data Protection Regulation and the Icelandic Personal Data Processing Act, we rely on the following bases:
Telemetry data you send us is processed as a processor on your behalf. We process it only on your documented instructions, only to provide the services you have contracted for, and we do not use it to train models, to build aggregate products for third parties, or to make commercial decisions about the operator.
We publish network-wide aggregate statistics, such as the telemetry baselines series. These are computed per spacecraft before aggregation, are stripped of anything that could identify an operator, and no individual spacecraft's figures are published without that operator's written consent. This distinction is deliberate and we will not blur it for convenience.
The website uses a minimal set of cookies. We do not use advertising cookies, we do not run cross-site tracking, and we do not use third-party analytics that set their own cookies.
| Name | Purpose | Type | Retention |
|---|---|---|---|
| helion_session | Maintains the session for signed-in users of the platform | Strictly necessary | Session |
| helion_csrf | Protects form submissions against cross-site request forgery | Strictly necessary | Session |
| helion_consent | Records your choice on the cookie notice so it is not shown again | Strictly necessary | 12 months |
The platform's own web interface sets one further cookie for the duration of a session to support the console's state. Since the console is an authenticated application rather than a public website, this cookie is not used for profiling and does not require consent under the ePrivacy rules.
We use a small number of processors, each under a written agreement that binds them to our instructions and to equivalent confidentiality and security obligations:
The current list of processors is available on request. We will notify affected customers before adding a new processor that will handle their data.
All processing of personal data and customer telemetry takes place within the European Economic Area. The Reykjavík and Keflavík ground stations are in the EEA, ingest and storage run in EU regions, and backups are held in the same region as the primary store. We do not transfer personal data outside the EEA.
We keep personal data only for as long as it is needed for the purpose it was collected, or as long as the law requires.
| Category | Retention period | Basis |
|---|---|---|
| Account data for active accounts | Duration of the agreement | Contract |
| Account data after closure | 12 months, then deleted | Legitimate interests |
| Usage and API logs | 13 months | Legitimate interests |
| Support correspondence | 24 months | Legitimate interests |
| Billing and accounting records | 6 years | Legal obligation |
| Customer telemetry | Per the plan's retention period | Customer instructions |
| Backups | 35 days rolling | Legitimate interests |
When the retention period expires, the data is deleted or irreversibly anonymised. Deletion from backups occurs as the rolling window advances.
Security measures are proportionate to the risk and documented in our information security management system, which is certified to ISO 27001 and audited annually. In summary: encryption in transit with TLS 1.3 and at rest with AES-256 or customer-managed keys; mutual TLS on ingest connections on the Fleet plan; role-based access control with per-spacecraft grants; an append-only audit log for operator actions; mandatory multi-factor authentication for owner and operator accounts; segregated production and development environments; annual penetration testing by an external firm; and a documented incident response procedure with customer notification within 72 hours of confirming a breach affecting customer data.
Subject to the conditions in the GDPR, you have the right to:
To exercise any of these rights, write to our data protection contact below. We respond within one month and we will tell you if an extension is needed and why. You also have the right to complain to the Icelandic Data Protection Authority, which supervises us.
Our data protection contact handles all privacy questions, data subject requests and regulator correspondence.
We do not use automated decision-making that produces legal effects or similarly significant effects on you. Alert rules configured by you evaluate telemetry thresholds and notify a human; they do not make decisions about people. We do not use your data for profiling or for automated eligibility decisions on credit or insurance.
The platform is not directed at children and is not intended for use by anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, write to the data protection contact and we will delete it.
We update this policy when our processing changes. Material changes are notified to account holders by email at least thirty days before they take effect, and the date of the last revision is shown at the top of this page. The previous versions are retained and available on request.
Write to our data protection contact. We treat access requests as operational work, not as an exception.