Privacy Policy

Version 1.9 · Effective 21 October 2026 · Operated by Dutch Aviation Services Sp. z o.o. (90-369 Łódź, Poland)

This Privacy Policy explains how Dutch Aviation Services Sp. z o.o. ("we", "us", "the Controller") collects, uses, and protects personal data of users of the flyinpoland.com website and recipients of FlyInPoland services.

This Policy is issued in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ("GDPR", known in Poland as "RODO") and the Polish Act of 10 May 2018 on the Protection of Personal Data (consolidated text: Dz.U. 2019 poz. 1781, as amended).

1. What data we collect

We collect personal data in the following contexts:

(a) When you visit our website

• Standard server-log data (IP address, browser type, pages visited, referring URL, timestamp) for the purpose of security, fraud prevention, and aggregate analytics. Retained for up to 12 months.
• Cookies, as described in our Cookie Policy.

The website stores a versioned record of your separate analytics and advertising choices in your browser's local storage, kept until you change your choice or clear your site data. When a page loads, our website platform sets a security cookie (__cf_bm, provided by Cloudflare, 30 minutes) and a visitor identifier (msgsndr_id, 12 months). Both are set before any choice and are listed in the Cookie Policy. Use the persistent Cookie settings control to change or withdraw any optional choice.

Platform visit statistics and attribution. On every page, our website platform records visit statistics and attribution when the page loads, before any cookie choice and whatever you choose in the cookie banner. It writes visit-history and session entries to your browser's local storage and sends the platform operator the address of each page you open, the referring address, the source, keyword and campaign parameters of your visit and a session identifier, together with the visitor identifier (msgsndr_id) and technical data such as your IP address. The purpose is the platform's visit statistics and attribution, which show how the website is reached and used. The legal basis we rely on is our legitimate interest in knowing how the website is reached and used (Art. 6(1)(f) GDPR); you may object at any time (see section 5). These entries are listed in the Cookie Policy. Withdrawing a cookie choice does not remove them; you can delete them by clearing the site data in your browser.

Every page carries a technical hint (a browser preconnect) to Google's font server, added by our website platform. The pages themselves use fonts served from this website, but the hint causes your browser to open a connection to Google, which discloses your IP address. The blog pages (the blog index and the articles) are an exception: when you open one, it loads its typefaces from Bunny Fonts, a font service operated in the European Union, before any cookie choice, so your IP address and browser details are sent to Bunny Fonts. Pages that show our enquiry form, such as the homepage and the Contact page, load it in a frame supplied by our website platform. That frame downloads its typefaces from Bunny Fonts, a font service operated in the European Union, loads two script files from Google's file-storage service, runs Cloudflare's automated-abuse check and keeps form-session entries in your browser, so when the form is displayed your IP address and browser details are sent to Bunny Fonts, Google and Cloudflare before any cookie choice. The legal basis is our legitimate interest in operating the website and a working, protected enquiry form on the infrastructure our platform provides (Art. 6(1)(f) GDPR). You may object to this processing at any time (see section 5), and you can always contact us by email instead of using the form.

(b) When you submit a contact form or ask us for guidance

• Identification data: name, email, phone number, nationality;
• Enquiry data: the training route you are interested in, your stated goals or timeline, any information you choose to add to the message field;
• Consent records: the consents you ticked + timestamp + IP address (kept as proof of valid consent).

(c) When we coordinate, mentor or refer you

We process what you tell us about your training plans and progress, such as the stage you have reached, the training organisation you have chosen and the milestones you choose to share with us, together with our correspondence with you. Training organisations in our network also report your training progress to us.

When we refer you to a provider (a training organisation, an aeromedical centre, or a theory-course or examination provider), we pass on your name, your contact details and the route you are interested in, with your knowledge, so that the provider can contact you and make you an offer. From then on that provider processes your data as a controller in its own right, under its own privacy notice. The training records required by aviation rules are kept by your training organisation, not by us, and we take no payment for training.

The pilot assessment is ordered and taken at mywingman.eu. MyWingman is another brand of Dutch Aviation Services Sp. z o.o., so the same company is the controller of the assessment data, and that processing is described in the MyWingman Privacy Policy published on that website. Your assessment result is not shared with your Fly in Poland mentors unless you agree.

The aeromedical centre examines you and keeps your medical records.

If you ask for our support in a dispute with your training organisation, we pass the information and documents you give us about the dispute to the lawyer we work with, with your knowledge, so that the lawyer can assess your case and contact you.

(d) Advertising measurement - the Meta Pixel

The Meta Pixel is an advertising-measurement tool of Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta”). It is used on this website only after you choose to accept advertising cookies, through “Accept all” or the Advertising switch under “Manage choices”. Without that choice the Pixel is not loaded, sets no cookie and sends nothing to Meta.

Where the Pixel is active and you have accepted, it stores the _fbp cookie, and the _fbc cookie if you arrive from one of our adverts on Facebook or Instagram, and sends Meta information about your visit, such as the pages you open and how you interact with them, together with technical data such as your IP address, browser and device details and those cookie identifiers. When you successfully submit an enquiry form, the Pixel also sends Meta a “Lead” event, which tells Meta that an enquiry was made from your browser; it is sent only if you have accepted advertising cookies, and we do not send Meta the contents of the form. We use this to measure the results of our advertising on Facebook and Instagram and to show our adverts to people who have visited the website. The legal basis is your consent (Article 6(1)(a) GDPR and, for storage on your device, Article 399(1) of the Act of 12 July 2024 - Prawo komunikacji elektronicznej). You can withdraw it at any time through the Cookie settings control; withdrawal does not affect processing carried out before it.

Joint controllership. For the collection of this data through the Pixel and its transmission to Meta, we and Meta are joint controllers within the meaning of Article 26 GDPR. Where the Pixel is used, the arrangement between them is Meta’s Controller Addendum, available at https://www.facebook.com/legal/controller_addendum. In essence: we are responsible for giving you this information and for obtaining your consent before the Pixel is used; Meta is responsible for enabling your rights under Articles 15 to 20 GDPR in respect of the personal data it stores after the joint processing. What Meta does with the data after receiving it is not part of the joint processing; for that, Meta is a controller in its own right. Meta’s contact details and those of its data protection officer, the legal bases it relies on and the ways to exercise your rights against Meta are set out in Meta’s Privacy Policy at https://www.facebook.com/about/privacy. You may exercise your rights against Meta directly, or send your request to us at [email protected]; we forward requests that concern the joint processing to Meta.

Meta Platforms Ireland Limited may transfer this data to Meta Platforms, Inc. in the United States. Those transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023) where the recipient is certified under it, and otherwise on Standard Contractual Clauses under Article 46 GDPR.

(e) When you contact us on WhatsApp

Every page shows a WhatsApp button. It is an ordinary link: nothing is sent to WhatsApp until you click it, and clicking opens a WhatsApp chat with our number +48 887 888 978. If you write to us there, we process your phone number, your WhatsApp profile name and the messages you send in order to answer you, on the same basis and for the same period as any other enquiry (see section 2). WhatsApp is provided in the European Region by WhatsApp Ireland Limited, which processes your data as a controller under its own terms and privacy policy. Please do not send medical, identity-document or payment information over WhatsApp.

2. Why we process your data (legal bases)

Purpose	Legal basis (GDPR)	Retention
Respond to your enquiry; provide pre-contractual information	Art. 6(1)(b) - pre-contractual measures	12 months from last contact
Coordinate and mentor your training route at your request	Art. 6(1)(b) - steps taken at your request and performance of our service to you	Duration of our relationship with you + 6 years (statute of limitations)
Refer you to a provider you have asked to be put in touch with	Art. 6(1)(b) - steps taken at your request	Record of the referral: duration of our relationship with you + 6 years (statute of limitations)
Deliver and protect the website and the enquiry form (server logs, security cookie, platform visitor identifier, fonts on the blog pages, fonts and automated-abuse check in the form frame)	Art. 6(1)(f) - legitimate interest	Server logs up to 12 months; device storage as listed in the Cookie Policy
Visit statistics and attribution recorded by our website platform on every page (pages opened, referring address, campaign parameters and a session identifier, sent to the platform operator with the visitor identifier)	Art. 6(1)(f) - legitimate interest	Entries in your browser: until you clear your site data, as listed in the Cookie Policy
Analytics through Google Analytics, which measures how the website is used (only after you accept analytics cookies)	Art. 6(1)(a) - consent	Until consent is withdrawn; cookie lifetimes as listed in the Cookie Policy
Advertising measurement through the Meta Pixel (only after you accept advertising cookies)	Art. 6(1)(a) - consent	Until consent is withdrawn; cookie lifetimes as listed in the Cookie Policy
Marketing communications (where you opted in)	Art. 6(1)(a) - consent	Until consent is withdrawn, max 36 months from last engagement
Defend legal claims; respond to regulatory inquiry	Art. 6(1)(f) - legitimate interest; Art. 9(2)(f) for special category	Until limitation period expires (typically 6 years)
Support you in a dispute with your training organisation, at your request, through the lawyer we work with	Art. 6(1)(b) - steps taken at your request and performance of our service to you	Duration of our relationship with you + 6 years (statute of limitations)

We are not a training organisation and keep no training records under aviation rules; those are kept by the training organisation that trains you.

Do you have to give us your data? No law and no contract obliges you to. Your name and a way to reach you (an email address or a phone number) are needed to answer an enquiry, to mentor you and to refer you; without them we cannot do so. Everything else, including any marketing consent and any optional cookie choice, is voluntary, and declining it does not affect our answer to your enquiry.

3. Who has access to your data

Inside our organisation, access is limited to those individuals who need the data to perform their role.

Outside our organisation, we share data with the following categories of recipient, each operating either as a processor under Art. 28 GDPR or as an independent controller where they determine their own purposes:

• Hosting and IT infrastructure providers (web hosting, email, document storage) - processors. Some are established outside the EEA or use sub-processors outside the EEA, on the safeguards described in section 4;
• Customer relationship management platform (CRM) - processor, with sub-processors outside the EEA, on the safeguards described in section 4;
• Providers we refer you to (training organisations, aeromedical centres, theory-course and examination providers) - independent controllers, receiving your contact details and the route you are interested in, with your knowledge;
• Accountancy and tax advisors - processors, to the extent that our accounting records contain personal data;
• The lawyer we work with, when you ask for our support in a dispute with your training organisation - an independent controller bound by professional secrecy, receiving the information and documents you give us about the dispute, with your knowledge;
• Public authorities and courts - independent controllers, only where a legal provision requires us to disclose data. We are not a training organisation, so we hold no statutory training records and make no routine reports to aviation authorities;
• Our own legal advisors and dispute-resolution bodies - only as needed to establish, exercise or defend legal claims.

We do not sell your personal data. Where you have accepted advertising cookies and the Meta Pixel is active, information about your use of the website is shared with Meta as described in section 1(d), so that we can measure our advertising and show our adverts on Facebook and Instagram to people who have visited the website. We do not otherwise disclose personal data for advertising purposes.

With analytics consent, Google Analytics (Google Ireland Limited) measures how the website is used; without that choice it is not loaded. We take no payment for training; Stripe appears in the list below only for the case that a payment for a service of our own is ever taken online. Google's font server is contacted as described in section 1(a).

The providers behind those categories are:

• Avantwerk, operated by Bennovate sp. z o.o. - Supplies and administers the website, CRM, forms and email sending, and engages its own infrastructure providers as sub-processors, some of which are outside the EEA. Established in Poland, with sub-processors outside the EEA. Transfers are made under Standard Contractual Clauses in the platform's data-processing terms.
• Zoom - Calls or online meetings, where one is arranged. Established in the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback.
• Stripe - If a payment is ever taken online: card payments. A full card number is never received or stored by the controller. Established in the United States / Ireland. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback.
• Google Ireland Limited - Analytics and advertising. Established in Ireland, with transfers to the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback. Loads only after the corresponding analytics or advertising choice, or after “Accept all”.
• Meta Platforms Ireland Limited - Where the Meta Pixel is active on this website and you have accepted advertising cookies: advertising measurement and audiences on Facebook and Instagram. Established in Ireland, with transfers to the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback. Loads only after the corresponding analytics or advertising choice, or after “Accept all”.
• Cloudflare - Protects the website and forms against automated abuse, and delivers the pages. Established in the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback.
• Google (script files for the enquiry form) - The enquiry-form frame supplied by our website platform loads two script files from Google's file-storage service (storage.googleapis.com) before any cookie choice, which discloses your IP address to Google. No cookie was observed for this.

This list is kept current; a provider may be replaced by another of the same kind.

4. International transfers

Where data is transferred outside the European Economic Area, we rely on the following safeguards:

• Adequacy decisions (Art. 45 GDPR) - applies to transfers to the UK, Switzerland, Israel, and other adequacy-listed countries;
• Standard Contractual Clauses (Art. 46(2)(c)) - for transfers to other third countries where applicable;
• Your explicit consent (Art. 49(1)(a) GDPR) - only for transfers that are not repetitive and are necessary for a specific situation you have agreed to. This basis is not used for systematic or regular transfers.

Transfers to the United States by the providers named in section 3 rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023) where the recipient is certified under it, and otherwise on Standard Contractual Clauses.

5. Your rights

Under the GDPR you have the following rights:

• Access (Art. 15) - request a copy of your data;
• Rectification (Art. 16) - correct inaccurate or incomplete data;
• Erasure (Art. 17) - "right to be forgotten", subject to legal retention obligations;
• Restriction of processing (Art. 18) - limit how we use your data while a dispute is resolved;
• Data portability (Art. 20) - receive your data in a structured machine-readable format;
• Object (Art. 21) - to processing based on legitimate interests or direct marketing;
• Withdraw consent at any time, for any processing based on consent - without affecting prior lawful processing;
• Lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych (UODO)) or your local EU data protection authority.

Detailed information about your rights and how to exercise them is on our GDPR Rights page.

6. Automated decision-making and profiling

We do not make decisions about you that are based solely on automated processing and that produce legal or similarly significant effects on you. Fly in Poland does not carry out assessments. The pilot assessment in the Starter Pack is carried out by MyWingman under the MyWingman Privacy Policy; it includes a psychometric test, and its results are interpreted by a qualified professional before any recommendation is given to you.

7. Security

We implement technical and organisational measures appropriate to the risk: TLS encryption for data in transit, encryption at rest where supported by the platform, role-based access controls, regular access reviews, incident-response procedures, and personnel-confidentiality undertakings. Breach notification follows Art. 33–34 GDPR - within 72 hours to the supervisory authority where required, and without undue delay to you where the breach is likely to result in a high risk to your rights.

8. Contact us about this Privacy Policy

Email: [email protected] (subject: "Privacy request")

Post: Dutch Aviation Services Sp. z o.o., ul. Piotrkowska 222/3, 90-369 Łódź, Poland

We respond to data-subject requests within one calendar month, extendable by a further two months for complex requests (in which case we will tell you within the first month).

9. Supervisory authority

10. Changes to this Policy

This Policy is Version 1.9, effective 21 October 2026. This version adds Google Analytics, on the basis of your consent, to the table of legal bases in section 2 and states that the blog pages load their typefaces from Bunny Fonts. Version 1.8, effective 14 October 2026, added Google Analytics, used only after analytics consent. Material changes are notified by email to active customers; the current version and effective date are always shown at the top of this page.