Privacy Policy

Service Controller

  • This Privacy Policy describes the rules regarding the processing of data, in particular personal data, by Flyspot Group Sp. z o.o. with its registered office in Warsaw, 00-090, Al. Solidarności 75/26, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register under KRS number 0000821632, NIP: 5252533508, share capital in the amount of 19,000,000 PLN (hereinafter: ‘Flyspot Group’ or ‘Controller’).
  • The Privacy Policy describes the rules of data processing in connection with the offering of services by Flyspot Group, in particular those available in the wind tunnel facilities operated under the name FlySpot (‘FlySpot’) and the facility including a deep diving pool, operating under the name ‘DeepSpot’), whereby the rules described in this document also apply to additional services or functionalities related to the activities of FlySpot and DeepSpot, such as, in particular, services and content made available via the Controller’s websites, including www.flyspot.com the Website) and processes regarding the sale of products and services in physical and online shops (all the above services and activities will hereinafter be collectively referred to as ‘Services’, and persons using or expressing a will to purchase or use such Services as ‘Users’).
  • The Controller can be contacted on all matters related to the processing of data, including personal data, at the e-mail address: [email protected].

Personal data – general provisions

  • Personal data means any information relating to an identified or identifiable natural person, who is understood as a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name and surname, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • The controller of the Users’ personal data will be Flyspot Group Spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw (other details provided in Art. I, sections 1 and 3 above).
  • Flyspot Group will process, including collect and store, personal data in accordance with applicable law, in particular the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (‘GDPR’), as well as in accordance with this Privacy Policy.
  • Providing personal data is always voluntary, but it may be a condition for purchasing or using the Services or using certain functions available on the Website. In particular, the purchase of Services, booking a date for their performance via the Website and the actual use of the Service at FlySpot or DeepSpot requires the provision of the User’s personal data. In the case of using the FlySpot wind tunnel flight services or the DeepSpot pool, it is required to provide the personal data of each person actually using such Services, even if the Services were purchased by another person. Providing personal data in the above situation is necessary, in particular, for the purpose of confirming that the User has read the important information provided by Flyspot Group in the form of statements or other documents, confirming their acceptance by the User and the absence of contraindications to using the Service.

How we collect your personal data

  • Flyspot Group will obtain and collect Users’ personal data in connection with the provision of Services or in connection with the User’s expression of a will to use the Services, including in particular through:

A) information entered by the User during the creation of an account on the Website

B) information entered by the User in forms filled in connection with the use of the Services

C) information provided by the User for the purpose of purchasing Services via the Website

D) information provided by the User as part of contacting Flyspot Group, including in connection with complaints, enquiries regarding the Services, etc.

E) saving cookies on the terminal devices used by the User

F) collecting web server logs

G) obtaining data from publicly available sources or from third parties

H) The Website may save information about connection parameters (timestamp, IP address).

For what purposes we process your personal data

J) Flyspot Group may process Users’ personal data in the following way and for the following needs:

K) accepting and managing the booking made by the User in relation to the Services

L) enabling the User to use the Service

M) carrying out other activities related to the performance of the Service, such as receiving and considering complaints, answering Users’ questions regarding the Services, etc.

N) issuing an invoice or other purposes related to bookkeeping, as well as fulfilling obligations required by applicable law

O) promoting Flyspot Group Services

  • Flyspot Group may also process the User’s personal data for needs other than those indicated in section 1 above, provided that the User gives appropriate consent or that the Controller has another legal basis for the purposes of such processing, as well as provided that the User is provided with appropriate additional information about such processing of personal data in a situation where it were to take place for other purposes or on other principles than those resulting from this Privacy Policy.
  • The processing of personal data referred to above may be carried out based on the following grounds provided for by the GDPR:

A) processing is necessary for the performance of a contract to which the User is a party or to take steps at the request of the User prior to entering into a contract (Art. 6(1)(b) GDPR)

B) based on the consent expressed by the User (Art. 6(1)(a) GDPR)

C) for the purpose of fulfilling a legal obligation incumbent on the Controller (Art. 6(1)(c) GDPR)

D) for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the User (Art. 6(1)(f) GDPR).

E) The legitimate interests pursued by the Controller, referred to in section 3(d) above, are in particular: contacting the User in connection with the performance of the Services, answering Users’ questions or other similar communication with the User, pursuing claims by Flyspot Group or defending against claims submitted by the User.

  • Due to the fact that some Services provided by Flyspot Group may involve significant risk, in particular in the case of using them despite the existence of health contraindications on the part of the User, Flyspot Group may collect certain personal data regarding the User’s health or their habits or lifestyle that may affect the User’s health or psychophysical abilities. Such data may include so-called special categories of personal data referred to in Art. 9(1) GDPR. The processing of this type of data is related to ensuring the User’s safety, and in particular for the purpose of informing the User about contraindications related to the use of a given Service and obtaining a statement from the User that there are no such contraindications on their part or – in the event of their existence – for the purpose of possible further communication with the User, including providing further explanations, verifying any medical certificates and similar purposes related to the pursuit of ensuring the safe use of the Services by Users.
  • Special categories of personal data will only be processed if the User gives explicit consent.
  • The Controller may process Users’ personal data for the purposes of marketing the Services, including profiling personal data for the above needs, based on Art. 6(1)(f) GDPR, whereby the User may object to such processing at any time. Any processing of the User’s personal data for the marketing purposes of third parties may only take place with the User’s explicit consent.
  • Any sending of commercial information to the User by the Controller by electronic means, including the use of terminal devices for the above needs, will take place based on the consent expressed by the User.
  • In order to best match marketing messages and content contained on the Website to the User’s preferences, the Controller may profile the User’s personal data. As part of profiling, the Controller may, in particular, analyse the history of a given User’s activity on the Website, so as to direct to the User a proposal to use the Service, a notification about an event or other similar marketing information which, in the opinion of Flyspot Group – made on the basis of the above profiling – will be best suited to the User’s needs or interests.
  • Furthermore, Flyspot Group may process the User’s personal data, including profiling their personal data, for the purposes of creating statistics, conducting market research, analysing preferences, habits and consumer choices.
  • Profiling of Users’ personal data by Flyspot Group for the needs indicated above will be based on Art. 6(1)(f) GDPR, i.e. it may take place in situations where it is necessary for the purposes of the legitimate interests pursued by the Controller or a third party, provided that such interests are not overridden by the interests of the User or their fundamental rights and freedoms.
  • Profiling of personal data will not produce any legal effects concerning the User, as referred to in Art. 22(1) GDPR, nor similarly significantly affect them in any other way.
  • The User has the right to object at any time to the use of their personal data for the Controller’s marketing purposes, including regarding the profiling of their personal data.

What personal data we process

  • The scope of personal data that Flyspot Group will actually process in relation to a given User will depend in particular on:

A) the scope of data actually provided by the User

B) the nature of the Service or activity that Flyspot Group performs at the User’s request, for example – sending a voucher in the form of a plastic card will require the User to provide a residential address or other correspondence address, while delivering a voucher in electronic form will only require providing an e-mail address

C) requirements resulting from applicable law, for example, issuing an invoice at the User’s request will require providing appropriate data required by regulations, including NIP or PESEL number

D) the type of Service the User uses, e.g.:

E) using the Boeing flight simulator, which does not involve any special risks, will require providing a relatively narrower scope of data than using the diving services in the DeepSpot deep pool

F) using diving in DeepSpot does not require providing the User’s gender or size, but if the User also wishes to use the wetsuit rental Service, the Controller may process such data (gender, size) for the purpose of performing the above Service

G) additional functionalities, offers or other similar benefits that the User may wish to use in connection with the Services, e.g. the Controller may offer the User a free T-shirt in connection with the purchase of another Service and ask the User for their gender or size in order to select the appropriate product (providing this type of data is always voluntary, and any refusal to provide it does not affect the User’s right to use the Services, and may at most result in the inability to use additional offers or their poorer fit for the User).

  • Depending in particular on the aspects mentioned in section 1 above, Flyspot Group may process all or some of the following personal data of the User:

A) name and surname or nickname

B) residential or correspondence address

C) e-mail address

D) telephone number

E) date of birth

F) gender

G) size

H) data regarding health status or habits or activities affecting health status

I) NIP or PESEL number

J) data resulting from diving licences or other similar documents proving the User’s qualifications, in particular the licence number, the organisation under which it was issued, etc.

K) image

L) data generated by the Flyspot Group system, such as the Customer number

M) data regarding the details of the User’s use of the Services, including the type of Services, dates of their use, cost of purchased Services, etc.

N) in the case of persons who obtain training services from Flyspot Group – additional data related to the qualifications obtained, such as the course of previous training, number of dives, training progress, exam results, etc.

Who can be the recipient of your personal data

  • Personal data may be entrusted or shared with the following categories of entities:

A) entities that Flyspot Group engages in connection with the provision of Services, for the purpose of carrying out processes related to the performance of Services, such as e.g. IT system providers, couriers, instructors and other entities with which Flyspot Group cooperates in this respect

B) other personal data controllers, in particular providers of training formats based on which Flyspot Group provides Services

C) persons or bodies that are entitled to obtain access to personal data in accordance with applicable law.

  • Flyspot Group may transfer Users’ personal data outside the European Economic Area (EEA). In such cases, Flyspot Group will guarantee that a similar level of data protection in the third country will be ensured by introducing one of the following safeguards:

A) the transfer of personal data will take place to countries that the European Commission has recognised as providing an adequate level of protection for personal data

B) The Controller will use appropriate standard contractual clauses.

C) As part of the exercise of Users’ rights, the Controller will also provide the possibility of obtaining a copy of the appropriate measures securing personal data in the event of transfer to third countries.

User Rights

  • In connection with the processing of personal data by Flyspot Group, the User has the rights set forth in the GDPR.
  • In particular, on the principles resulting from the GDPR, the User has the right to:

A) access to personal data processed by the Controller

B) request rectification of personal data – in the event that the data is incorrect or incomplete

C) request erasure of personal data (the so-called “right to be forgotten”) – in the event that: (i) the User’s data is no longer necessary for the purposes for which it was collected or otherwise processed, (ii) the User has objected to the processing of personal data based on the pursuit of the Controller’s legitimate interest, including data profiling, (iii) the User has withdrawn the consent on which the processing is based and there is no other legal basis for processing, (iv) the data was processed unlawfully, (v) the data must be erased in order to comply with an obligation resulting from the law, (vi) the personal data was collected in connection with the offering of information society services referred to in Art. 8(1) GDPR

D) request restriction of processing of personal data if (i) the User contests the accuracy of the personal data (for a period enabling the Controller to check the accuracy of this data), (ii) the processing is unlawful and the User opposes the erasure of the personal data, requesting instead the restriction of its use, (iii) the Controller no longer needs the personal data for the purposes of processing, but it is needed by the User to establish, pursue or defend claims, (iv) the User has objected pursuant to Art. 21(1) GDPR to processing (pending the verification whether the legitimate grounds of the Controller override those of the User’s objection)

E) data portability, in the event that the processing is carried out in an automated manner, based on a contract concluded with the User or based on consent expressed by the User

F) object to the processing of personal data, including profiling, in the case of processing personal data used for the purpose of pursuing the Controller’s legitimate interest

G) lodge a complaint with a supervisory authority, i.e. the President of the Personal Data Protection Office, in the event of considering that the processing of the User’s personal data by the Controller violates the provisions of the GDPR.

  • To the extent that the User has given consent to the processing of personal data, they have the right to withdraw consent to the processing of personal data at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
  • The User may submit requests or make statements regarding the exercise of the rights referred to in sections 2 and 3 above, in particular to the Controller’s e-mail address indicated in Art. I, section 3 of this Privacy Policy.

How long we will store your personal data

  • In the case of Users who have concluded a contract with the Controller, personal data will be stored during the period of its performance, and after its expiry – for a period no longer than required by applicable law. In particular, if the User has requested the Controller to issue an invoice, personal data will be stored for a period of five years from the end of the calendar year in which the invoice was issued.
  • If the User has filed a complaint regarding the provision of Services by the Controller or if for other reasons it is justified from the point of view of protecting the Controller’s interests, the Controller will store the User’s personal data for a period until the expiry of the User’s claims against the Controller. In the event of a dispute between Flyspot Group and the User, personal data will be stored until the final conclusion of the dispute and the fulfillment of any benefits awarded by a final court judgment or a final administrative decision, and if necessary – until the expiry of such awarded claims.
  • To the extent that the processing of personal data is based on the premise of the necessity of processing for the purposes of the legitimate interests pursued by the Controller or by a third party, personal data will be stored no longer than until the User objects to the processing of their personal data (including their profiling), unless the Controller demonstrates the existence of valid legitimate grounds for processing, overriding the interests, rights and freedoms of the User, such as in particular the establishment or pursuit of claims or defence against claims.
  • To the extent that the processing of personal data is based on the premise of the User’s consent, personal data will be stored no longer than until the User withdraws such consent, unless the Controller has another valid legal basis for processing, including storing personal data.
  • In the case of Users who have registered on the Website, personal data will be stored for the period of using the Website, whereby the Controller may delete the personal data and the User’s account on the Website if the User has not used the Website for a period of 12 months or longer, including not logging into their account on the Website.

Image monitoring

  • In the case of the User using the FlySpot wind tunnel flights, the User’s image will be recorded by Flyspot Group in order to enable the User to obtain videos of the flight, which may also be sent at the User’s request to the e-mail address indicated by them or may be copied by the User at the FlySpot facility to a storage medium selected by the User, depending on the options currently offered by Flyspot Group in the above scope. Video materials with the recorded image of the User are deleted after 14 days from the day of their recording.
  • Additional Services may also be available to Users at the FlySpot and DeepSpot facilities, including recording the User’s image, e.g. during diving. Recordings containing the image recorded in connection with the performance of such additional Services will be deleted after 1 month.
  • A video monitoring system operates on the premises of the FlySpot and DeepSpot facilities in order to ensure the safety of persons staying on the premises, as well as to protect the property of these persons and the property of Flyspot Group. Personal data collected as a result of the use of monitoring may be transferred to entities entitled under the law to obtain access to such data. The Controller stores monitoring recordings for a period no longer than 3 months, with the proviso that recordings that may constitute evidence in proceedings conducted on the basis of the law may be stored longer, until the final conclusion of the proceedings. After the expiry of the above periods, the image recordings obtained as a result of monitoring containing personal data are destroyed, unless separate regulations provide otherwise.

Important marketing techniques

  • On the Website, the Controller uses the Facebook pixel. The use of the above technology causes the Facebook service provider to obtain information that a given User with a Facebook account uses the Website. The Facebook service provider relies in this case on data for which it is itself the controller, i.e. Flyspot Group does not transfer any additional personal data to the Facebook service for the above needs. The technology is based on the use of cookies on the terminal device from which the User logs into the Website. Collected data may be transferred outside the European Economic Area on the principles described in this Policy. The Facebook pixel is activated only after the User gives consent to marketing cookies.
  • On the Website, the Controller uses the TikTok Pixel, provided by TikTok Technology Limited (a TikTok group company, which is the data controller for users from the European Economic Area). The use of the above technology causes the provider to obtain information that a given User uses the Website, in particular visits specific subpages or performs specific actions (e.g. purchase, registration), and in the case of Users with an account on the TikTok service, it can match these events to their account. The provider relies in this case on data for which it is itself the controller. The technology is based on the use of cookies (own and third-party) saved on the User’s terminal device, used for advertising purposes, including measuring the effectiveness of campaigns, creating audience groups (including remarketing and lookalike audiences) and matching advertisements. Collected data may be transferred outside the European Economic Area on the principles described in this Policy. The TikTok pixel is activated only after the User gives consent to marketing cookies.
  • On the Website, the Controller uses the Snapchat Pixel (Snap Pixel), provided by Snap Inc. The use of the above technology causes Snap Inc. to obtain information that a given User uses the Website, in particular visits specific subpages or performs specific actions (e.g. purchase, registration), and in the case of Users with an account on the Snapchat service, it can match these events to their account. Snap Inc. relies in this case on data for which it is itself the controller. The technology is based on the use of cookies (own and third-party) saved on the User’s terminal device, used for advertising purposes, including measuring the effectiveness of campaigns, creating audience groups and matching advertisements displayed to the User. Collected data may be transferred outside the European Economic Area on the principles described in this Policy. The Snapchat pixel is activated only after the User gives consent to marketing cookies.
  • On the Website, the Controller uses the Reddit Pixel, provided by Reddit Inc. The use of the above technology causes Reddit Inc. to obtain information that a given User uses the Website, in particular visits specific subpages or performs specific actions (e.g. purchase, registration), and in the case of Users with an account on the Reddit service, it can match these events to their account. Reddit Inc. relies in this case on data for which it is itself the controller. The technology is based on the use of cookies (own and third-party) saved on the User’s terminal device, used for advertising purposes, including measuring the effectiveness of campaigns, creating audience groups (including remarketing and lookalike audiences) and matching advertisements. Collected data may be transferred outside the European Economic Area on the principles described in this Policy. The Reddit pixel is activated only after the User gives consent to marketing cookies.

Information about the use of cookies

  • The Website uses cookies.
  • Cookies are IT data, in particular text files, which are stored on the Website User’s terminal device and are intended for using the Website’s pages. Cookies usually contain the name of the website they come from, the time they are stored on the terminal device and a unique number.
  • The entity placing cookies on the Website User’s terminal device and obtaining access to them is Flyspot Group.
  • Cookies are used for the following purposes:

A) creating statistics that help to understand how Users use the Website’s content, which enables improving its structure and content

B) maintaining the Website User’s session (after logging in), thanks to which the User does not have to re-enter their login and password on each subpage of the Website

C) determining the User’s profile in order to display content matched to their preferences in advertising networks, in particular the Google network.

D) Two basic types of cookies are used within the Website: ‘session’ cookies and ‘persistent’ cookies. ‘Session’ cookies are temporary files that are stored on the User’s terminal device until logging out, leaving the website or turning off the software (web browser). ‘Persistent’ cookies are stored on the User’s terminal device for the time specified in the cookie parameters or until they are deleted by the User.

  • Software for browsing websites (web browser) usually allows the storage of cookies on the User’s terminal device by default. Website Users can change the settings in this regard. The web browser allows for the deletion of cookies. It is also possible to automatically block cookies. Detailed information on this subject is contained in the help or documentation of the web browser.
  • Restrictions on the use of cookies may affect some functionalities available on the Website’s pages.
  • If the User does not want to receive cookies, they can change their browser settings. Disabling cookies necessary for authentication, security, and maintaining User preferences may make it difficult, and in extreme cases may make it impossible, to use the Website.
  • In order to manage cookie settings, select a web browser/system from the list below and follow the instructions:

A) Internet Explorer

B) Chrome

C) Safari

D) Firefox

E) Opera

F) Android

G) Safari (iOS)

H) Windows Phone

  • Information about certain User behaviours is subject to logging in the server layer. This data is used solely for the purpose of administering the Website and in order to ensure the best possible service for the provided Services.
  • The viewed Website resources are identified by URL addresses. Furthermore, the following may be subject to recording:

A) time of arrival of the enquiry

B) time of sending the response

C) name of the User’s station – identification carried out by the HTTP protocol

D) information about errors that occurred during the execution of the HTTP transaction

E) URL address of the page previously visited by the User (referrer link) – in the case where the transition to the Website occurred via a link

F) information about the User’s browser

G) information about the IP address.

  • The above data is not associated with specific Users browsing the pages and is used only for server administration purposes.

Final provisions

  • In matters not regulated in the Privacy Policy, the applicable provisions of law, in particular the GDPR, shall apply to the principles of personal data processing.

Part of FlySpot Group