Privacy policy
Effective date: [TO BE COMPLETED: effective date]
Last updated: [TO BE COMPLETED: date of last update]
1. Who we are (Data Controller)
The controller of your personal data processed in connection with the website https://fubaraviation.com (the "Website") and our services is:
- Legal name and legal form: [TO BE COMPLETED: full legal name and legal form, e.g. FUBAR AVIATION LTD – confirm exact form]
- Country of registration and register: [TO BE COMPLETED: country of incorporation, name of register, e.g. Companies House / Polish National Court Register (KRS)]
- Registration number: [TO BE COMPLETED: company/registration number]
- Tax ID / VAT number: [TO BE COMPLETED: NIP / VAT ID]
- Registered office address: [TO BE COMPLETED: registered office address]
- Correspondence address: [TO BE COMPLETED: correspondence address, if different]
- Polish branch / representative (if applicable): [TO BE COMPLETED: details of Polish branch or EU representative under Art. 27 GDPR, if the controller is established outside the EU]
- E-mail: fly@fubaraviation.com
- Phone: +48 605 217 521, +48 608 204 671
In this Policy, "we", "us" and "our" refer to the controller identified above, operating under the name "FUBAR Aviation".
2. Data Protection Officer
[TO BE COMPLETED: state whether a Data Protection Officer (DPO) has been appointed. If yes – provide name/contact details; if no – keep the sentence below]
We have not appointed a Data Protection Officer. In all matters concerning personal data, please contact us at fly@fubaraviation.com or at the correspondence address indicated above.
3. Legal framework
We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, "GDPR"), the Polish Act of 10 May 2018 on the Protection of Personal Data, and the Polish Electronic Communications Law (in respect of cookies and similar technologies). [TO BE COMPLETED: if the controller is a UK company, verify whether UK GDPR also applies]
4. Purposes, legal bases and categories of data
| Purpose | Categories of data | Legal basis (GDPR) |
|---|---|---|
| Handling enquiries and booking requests submitted via the contact/booking form | Full name, e-mail address, phone number, selected package, preferred date, number of persons, message content, consent confirmation | Art. 6(1)(b) – steps taken at your request prior to entering into a contract; Art. 6(1)(f) – our legitimate interest in responding to enquiries not related to a contract |
| Concluding and performing the contract for flight services or vouchers (including flight scheduling, passenger briefing, communication) | Identification and contact data, booking details, and – where required for flight safety – data such as age, body weight, height [TO BE COMPLETED: list any other data collected, e.g. ID document data] | Art. 6(1)(b) – performance of a contract; Art. 6(1)(c) – legal obligations, including aviation law requirements |
| Assessment of fitness to fly / health information (if collected) | Health declarations, medical certificates [TO BE COMPLETED: specify whether and what health data is collected] | Art. 9(2)(a) – explicit consent; and/or Art. 9(2)(f) – establishment, exercise or defence of legal claims [TO BE COMPLETED: lawyer to confirm basis] |
| Insurance of passengers (if applicable) | [TO BE COMPLETED: data transferred to insurer] | Art. 6(1)(b) and/or 6(1)(c) [TO BE COMPLETED: verify] |
| Accounting and tax obligations (invoices, payments) | Name, address, tax ID (if provided), transaction data | Art. 6(1)(c) – legal obligation (tax and accounting laws) |
| Handling complaints and establishing, exercising or defending legal claims | Data relating to the contract and correspondence | Art. 6(1)(f) – legitimate interest |
| Website security and operation (server/CDN logs, spam protection) | IP address, date and time of request, URL, browser and device information (user agent), referrer, Turnstile verification data | Art. 6(1)(f) – legitimate interest in ensuring the security and proper functioning of the Website |
| Storing your cookie/consent choices | Consent preferences stored in your browser | Art. 6(1)(c) and (f) – demonstrating compliance and remembering your choice |
| Website analytics (Google Analytics 4) | Online identifiers, pseudonymous usage data, approximate location, device and browser data | Art. 6(1)(a) – consent |
| Displaying an embedded Google Maps map | IP address, device and browser data transmitted to Google | Art. 6(1)(a) – consent (the map loads only after you click/consent) |
| Correspondence by e-mail or phone | Contact data and content of communication | Art. 6(1)(f) – legitimate interest in communicating with you; Art. 6(1)(b) where related to a contract |
Providing data in the form is voluntary but necessary to process your enquiry or booking. Fields required for this purpose are marked in the form. Failure to provide them will prevent us from responding or making a booking. Data required by law (e.g. for invoicing) must be provided if you wish to receive the service.
We do not use your data for automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.
5. Recipients of personal data
Your data may be disclosed to the following categories of recipients, to the extent necessary:
- Hosting and CDN provider: [TO BE COMPLETED: select actual provider – Cloudflare, Inc. (Cloudflare Pages, USA) or cyber_Folks S.A. (Poland)] – hosting the Website and processing server logs;
- Cloudflare, Inc. (USA) – Cloudflare Turnstile anti-spam protection [TO BE COMPLETED: confirm whether Turnstile is used];
- Resend (Plus Five Five, Inc., USA) – transactional e-mail service used to deliver form submissions to our mailbox [TO BE COMPLETED: verify provider's legal entity name];
- E-mail mailbox provider: [TO BE COMPLETED: provider of the fly@fubaraviation.com mailbox, e.g. Google Workspace, cyber_Folks];
- Google Ireland Limited / Google LLC – Google Analytics 4 and Google Maps (only after consent);
- Stripe Payments Europe, Ltd. – payment processing for vouchers (when launched, see section 9);
- accounting/bookkeeping service providers [TO BE COMPLETED: name or category];
- insurers [TO BE COMPLETED: if applicable];
- airport operator (Olsztyn-Mazury Airport, EPSY), aviation authorities (e.g. Polish Civil Aviation Authority – ULC) and other public authorities where required by law [TO BE COMPLETED: verify which data are passed and when];
- legal advisors, IT service providers and other entities supporting our business, bound by confidentiality.
Processors act on our behalf under data processing agreements (Art. 28 GDPR).
6. Transfers outside the European Economic Area
Some of our service providers (in particular Resend, Cloudflare and Google) are based in or may process data in the United States or other third countries. Where data is transferred outside the EEA, we ensure an adequate level of protection by:
- relying on the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the recipient is certified; and/or
- Standard Contractual Clauses (SCC) adopted by the European Commission, together with supplementary measures where necessary.
You may obtain a copy of the applicable safeguards by contacting us at fly@fubaraviation.com. [TO BE COMPLETED: verify DPF certification status of each provider]
7. Data retention periods
| Data / purpose | Retention period |
|---|---|
| Enquiries not resulting in a contract | [TO BE COMPLETED: e.g. 12 months from last contact] |
| Contract and booking data | For the duration of the contract and thereafter until the limitation period for claims expires [TO BE COMPLETED: specify, e.g. 6 years / end of the calendar year] |
| Health/fitness-to-fly data (if collected) | [TO BE COMPLETED: retention period] |
| Accounting documents | 5 years from the end of the calendar year in which the tax payment deadline expired (Polish law) [TO BE COMPLETED: verify for country of registration] |
| Server/CDN logs | [TO BE COMPLETED: per hosting provider settings, e.g. up to 30 days] |
| Google Analytics data | [TO BE COMPLETED: GA4 retention setting, e.g. 2 or 14 months] |
| Consent choice in localStorage | [TO BE COMPLETED: e.g. 12 months] or until you clear browser storage |
| Data processed on the basis of consent | Until consent is withdrawn (without affecting processing before withdrawal) |
8. Your rights
Under the GDPR, you have the right to:
- access your personal data and receive a copy (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure ("right to be forgotten") (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20) – for data processed on the basis of consent or contract by automated means;
- object to processing based on our legitimate interests (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3)) – you can change your cookie preferences via the "Cookie settings" link in the Website footer [TO BE COMPLETED: confirm name/location of the link];
- lodge a complaint with a supervisory authority – in Poland: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl, or the authority in your EU Member State of residence or place of work.
To exercise your rights, contact us at fly@fubaraviation.com. We will respond without undue delay and within one month at the latest (extendable by two months in justified cases).
9. Payments (when launched)
This section will apply once online voucher payments are launched. Payments will be processed by Stripe Payments Europe, Ltd. (Ireland) and, where applicable, Stripe, Inc. (USA). Card data is entered directly with Stripe; we do not store full card numbers. We receive transaction data (e.g. name, e-mail, amount, payment status). Legal basis: Art. 6(1)(b) and (c) GDPR. Stripe acts as an independent controller for certain purposes (e.g. fraud prevention, regulatory compliance) – see https://stripe.com/privacy. [TO BE COMPLETED: confirm configuration and launch date]
10. Cookies and similar technologies
The Website uses browser storage (localStorage) and, only after your consent, cookies of third parties. Strictly necessary storage is used without consent; analytics and the map load only after you consent. We use Google Consent Mode v2: until you consent, Google Analytics tags do not set analytics cookies. Fonts are hosted locally – no data is sent to Google Fonts.
| Name | Type | Provider | Purpose | Duration | Consent required |
|---|---|---|---|---|---|
| fa-consent | localStorage | FUBAR Aviation (first party) | Stores your consent choices | [TO BE COMPLETED: e.g. 12 months] / until cleared | No (necessary) |
| Cloudflare Turnstile / security cookies (e.g. __cf_bm, cf_clearance) | Cookie / browser storage | Cloudflare, Inc. | Bot and spam protection, security | Session – up to [TO BE COMPLETED: verify] | No (necessary) |
| _ga | Cookie | Google (GA4) | Distinguishing users for statistics | Up to 2 years [TO BE COMPLETED: verify] | Yes (analytics) |
| _ga_<ID> | Cookie | Google (GA4) | Maintaining session state | Up to 2 years [TO BE COMPLETED: verify] | Yes (analytics) |
| Google Maps cookies (e.g. NID and others) | Cookie | Displaying the map, user preferences | Per Google policy (e.g. NID – 6 months) | Yes (loaded only after click/consent) |
[TO BE COMPLETED: verify the final list of cookies with a browser scan before publication]
You can manage or delete cookies and localStorage data in your browser settings. Blocking necessary storage may affect Website functionality. More information on Google's practices: https://policies.google.com/technologies/partner-sites.
11. Social media
The Website contains only links to our Facebook and Instagram profiles; no social plugins are embedded, so no data is transmitted to Meta when you visit the Website. When you visit our profiles, Meta Platforms Ireland Limited processes your data under its own policies, and we may act as a joint controller with Meta for page insights (Art. 26 GDPR). [TO BE COMPLETED: links to profiles]
12. Security
We apply appropriate technical and organisational measures to protect personal data, including encrypted HTTPS connections, access control and limiting data to what is necessary.
13. Changes to this Policy
We may update this Policy, in particular in the event of changes to legislation or the technologies we use. The current version is always available on the Website with its effective date.