Privacy Policy

In force from 20 March 2026.

English translation provided for the convenience of non-Polish-speaking customers. In case of any discrepancy, the Polish version is binding.

I. Data controller

1. The data controller is Doradztwo Paweł Mamcarz, ul. Jesionowa 18, 05-825 Grodzisk Mazowiecki, Poland, Tax ID (NIP): 7122188089 (hereinafter: the "Controller").
2. Contact with the Controller in matters concerning personal data:
   1. email: info@akrobacja.com
   2. phone: +48 535 535 221
   3. postal address: ul. Jesionowa 18, 05-825 Grodzisk Mazowiecki, Poland

II. Purposes and legal bases of processing

The Controller processes personal data for the following purposes:

III. Scope of processed data

1. Upon purchase of a voucher: full name, email address, optionally Tax ID.
2. Upon pilot account registration: phone number (for SMS verification).
3. Upon flight scheduling: contact details, information about health condition (provided voluntarily during the briefing).
4. Technical data: IP address, browser type, time of visit - collected automatically in server logs.

IIIa. Optional pilot-account connections

In Pilot Account, you may optionally add Google or Apple as a sign-in method and independently connect Google Calendar to receive private warnings before a time is booked. SMS remains the method for account recovery and proof of account ownership.

1. For optional sign-in, we retain only the technical issuer identifier and immutable account identifier; we do not merge accounts by email address or display name.
2. With separate Google Calendar consent, we retain encrypted access material solely to check the availability of a selected time range. We do not retain titles, descriptions, attendees or locations of events.
3. You can disconnect Google Calendar in Pilot Account; we then delete the access material and consent metadata. Apple Calendar is not connected in this mode and remains available only through a private ICS subscription.
4. Information from these optional connections is not sent to marketing or advertising analytics.

IV. Data recipients

Personal data may be transferred to the following entities:

V. User rights

Under the GDPR you have the following rights:

1. Right of access (Article 15) - you may obtain information on what data of yours we process.
2. Right to rectification (Article 16) - you may request the correction of inaccurate data.
3. Right to erasure (Article 17) - you may request the deletion of data when there is no basis for further processing.
4. Right to restrict processing (Article 18) - you may request the restriction of processing in certain situations.
5. Right to data portability (Article 20) - you may receive your data in a machine-readable format.
6. Right to object (Article 21) - against processing based on legitimate interest.
7. Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
8. Right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

Requests regarding the exercise of these rights should be sent to: info@akrobacja.com. The Controller responds within 30 days.

VI. Cookies

1. The akrobacja.com website uses cookies - small text files stored on the user's device.
2. Types of cookies used on the Website:

   Type	Purpose	Legal basis	Retention
   Necessary (session)	Form handling, cart, login session	Legitimate interest	Until browser is closed
   Analytical (Cloudflare Web Analytics)	Aggregate visit statistics without user profiling	Legitimate interest	No cookies
   PayNow / Stripe	Payment security and transaction processing	Necessary for contract performance	According to the active processor's policy
   Google Analytics 4 & Google Ads (gtag.js)	Ad effectiveness measurement, remarketing, traffic analytics	User consent (Article 6(1)(a) GDPR)	Up to 24 months
   Meta Pixel (Facebook / Instagram)	Remarketing, audience matching, ad effectiveness measurement on Facebook and Instagram	User consent (Article 6(1)(a) GDPR)	According to Meta Platforms Ireland Ltd. policy

3. The Website implements Google Consent Mode v2 - Google marketing and analytics cookies are disabled by default until the user gives consent through the cookie banner.
4. Your choice about optional cookies is stored locally in your browser for 180 days, so the Website does not ask on every visit.
5. Consent management: You may change or withdraw your consent at any time by clicking here to open cookie settings. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
6. You may also change cookie settings in your browser, including blocking their storage. This may affect the functioning of some Website features (e.g. the payment process).

VII. Data security

1. The Website uses an encrypted HTTPS connection (TLS 1.3).
2. Payment data (card numbers) are not stored on the Controller's servers. They are handled by the payment processor used for the transaction: Autopay S.A. (PayNow) or Stripe.
3. Passwords and verification codes are not stored in plain text.
4. Access to the administrative panel is password-protected.
5. The database is hosted on Cloudflare infrastructure (D1) with automatic at-rest encryption.

VIII. Transfers of data outside the EEA

1. Some service providers (Stripe, Resend, Cloudflare) are based in the United States.
2. Data transfers take place on the basis of:
   1. a European Commission adequacy decision (EU-US Data Privacy Framework), or
   2. Standard Contractual Clauses (SCC) approved by the European Commission.

IX. Changes to the privacy policy

1. The Controller reserves the right to modify this Privacy Policy.
2. The Controller will notify users of any material changes through a notice on the Website.
3. The current version of the Privacy Policy is always available at: akrobacja.com/en/polityka-prywatnosci

→ Voucher Sale Terms & Conditions