SealsLog is used to record the issue, use, and return of numbered security seals as part of aviation security and supply chain integrity controls at participating operator sites. This notice explains what personal data the system holds, why, and for how long.
Aviation cargo security is subject to statutory requirements under UK and international aviation security regulation, including oversight by the Civil Aviation Authority, and industry standards such as ISO 17712 for seal integrity. Maintaining an accurate, tamper-evident record of who issued, used, and returned each security seal is necessary to demonstrate compliance to regulators, investigate any discrepancy or suspected tampering, and support the wider national aviation security framework.
| Data | About whom | Why |
|---|---|---|
| Full name, employee ID | Drivers | Identify who received/returned each seal |
| Username, display name, email | System users | Account access and accountability |
| Which user issued/received each seal, and when | System users | Audit trail |
| Login and action timestamps | System users | Security audit trail |
| Avatar photo (optional) | System users | Personalises their own account only |
We do not process any special category data (health, ethnicity, religion, trade union membership, biometric data used for identification, etc.). Biometric login (Face ID / fingerprint), where enabled, is verified entirely on your own device and no biometric data is ever sent to or stored by SealsLog.
Seal issue/return records and the associated audit trail are held securely for 10 years from the date of the record, in line with our records retention policy for aviation security accountability. This period may run concurrently with, and is not shorter than, the minimum 30-day record retention required under CAA aviation security regulation.
An organisation using SealsLog may request that its data be purged before the 10-year period ends. Any such request is actioned subject to the CAA's minimum 30-day retention requirement — records cannot be deleted earlier than 30 days from the date they were created, regardless of a purge request, as this minimum is a regulatory requirement rather than a choice made by SealsLog or the organisation.
User account data (name, email, login history) is kept for the duration of employment plus a limited period afterward to allow for any post-employment audit, then deleted.
Access is role-based. Drivers see only their own seal records for the current day. Standard users see records for their own site. Superusers and Organisation Admins see records across their site(s)/organisation. Data is stored with a UK/EU-based cloud database provider and is not sold or shared with third parties for marketing.
Under UK GDPR, you have the right to:
Passwords are never stored in plain text. Access to the system requires authenticated login. Administrative actions that change user roles or permissions are independently verified server-side.