Privacy Policy

In force from 20 March 2026.

English translation provided for the convenience of non-Polish-speaking customers. In case of any discrepancy, the Polish version is binding.

I. Data controller

1. The data controller is Doradztwo Paweł Mamcarz, ul. Jesionowa 18, 05-825 Grodzisk Mazowiecki, Poland, Tax ID (NIP): 7122188089 (hereinafter: the "Controller").
2. Contact with the Controller in matters concerning personal data:
   1. email: [email protected]
   2. phone: +48 535 535 221
   3. postal address: ul. Jesionowa 18, 05-825 Grodzisk Mazowiecki, Poland

II. Purposes and legal bases of processing

The Controller processes personal data for the following purposes:

III. Scope of processed data

1. Upon purchase of a voucher: full name, email address, optionally Tax ID.
2. Upon pilot account registration: phone number (for SMS verification).
3. Upon flight scheduling: contact details, information about health condition (provided voluntarily during the briefing).
4. Technical data: IP address, browser type, time of visit — collected automatically in server logs.

IV. Data recipients

Personal data may be transferred to the following entities:

V. User rights

Under the GDPR you have the following rights:

1. Right of access (Article 15) — you may obtain information on what data of yours we process.
2. Right to rectification (Article 16) — you may request the correction of inaccurate data.
3. Right to erasure (Article 17) — you may request the deletion of data when there is no basis for further processing.
4. Right to restrict processing (Article 18) — you may request the restriction of processing in certain situations.
5. Right to data portability (Article 20) — you may receive your data in a machine-readable format.
6. Right to object (Article 21) — against processing based on legitimate interest.
7. Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
8. Right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

Requests regarding the exercise of these rights should be sent to: [email protected]. The Controller responds within 30 days.

VI. Cookies

1. The akrobacja.com website uses cookies — small text files stored on the user's device.
2. Types of cookies used on the Website:

   Type	Purpose	Legal basis	Retention
   Necessary (session)	Form handling, cart, login session	Legitimate interest	Until browser is closed
   Analytical (Cloudflare Web Analytics)	Anonymous visit statistics, no user tracking	Legitimate interest	No cookies — server-side analytics
   Stripe	Payment transaction security	Necessary for contract performance	According to Stripe's policy
   Google Analytics 4 & Google Ads (gtag.js)	Ad effectiveness measurement, remarketing, traffic analytics	User consent (Article 6(1)(a) GDPR)	Up to 24 months

3. The Website implements Google Consent Mode v2 — Google marketing and analytics cookies are disabled by default until the user gives consent through the cookie banner.
4. Consent management: You may change or withdraw your consent at any time by clicking here to open cookie settings. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
5. You may also change cookie settings in your browser, including blocking their storage. This may affect the functioning of some Website features (e.g. the payment process).

VII. Data security

1. The Website uses an encrypted HTTPS connection (TLS 1.3).
2. Payment data (card numbers) are not stored on the Controller's servers — they are handled exclusively by the certified payment processor Stripe (PCI DSS Level 1).
3. Passwords and verification codes are not stored in plain text.
4. Access to the administrative panel is password-protected.
5. The database is hosted on Cloudflare infrastructure (D1) with automatic at-rest encryption.

VIII. Transfers of data outside the EEA

1. Some service providers (Stripe, Resend, Cloudflare) are based in the United States.
2. Data transfers take place on the basis of:
   1. a European Commission adequacy decision (EU-US Data Privacy Framework), or
   2. Standard Contractual Clauses (SCC) approved by the European Commission.

IX. Changes to the privacy policy

1. The Controller reserves the right to modify this Privacy Policy.
2. The Controller will notify users of any material changes through a notice on the Website.
3. The current version of the Privacy Policy is always available at: akrobacja.com/en/polityka-prywatnosci

→ Voucher Sale Terms & Conditions