Privacy Policy of the SkyRepublic ID Account

Version 1.0 — effective from 2026-08-28.

Note: this document is an unofficial English translation provided for information only. The Polish version is the binding one and prevails in the event of any discrepancy.

Note: this document is a draft prepared in accordance with the SkyRepublic ID legal annex (Article 13 GDPR information clause) and requires review by a lawyer before production publication. It does not constitute legal advice.

This Privacy Policy describes the rules for processing the personal data of Users of the SkyRepublic ID Account, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the Prawo komunikacji elektronicznej (PKE — the Polish Electronic Communications Law), Article 398. It is an integral part of the Account Terms of Service, available at `/regulamin`.

1. Data controller

The controller of the personal data processed in connection with maintaining the SkyRepublic ID Account is „DLAPILOTA.PL” spółka z ograniczoną odpowiedzialnością with its registered seat in Warsaw, ul. Księżycowa 3 lok. 19, 01-934 Warszawa, entered into the register of entrepreneurs of the National Court Register (Krajowy Rejestr Sądowy) under number KRS 0000104174, NIP 9512156017, REGON 015153278.

Contact for all matters concerning the processing of personal data: e-mail contact@skyrepublic.aero.

The Administrator is a single, joint controller of data for the entire SkyRepublic family of services that use the Account (see point 4) — accordingly, no separate data processing agreements (Article 28 GDPR) are concluded between the Account and these services, because the data is processed within the same responsible entity.

2. Purposes of processing and legal bases

The personal data of Users is processed for the following purposes:

• Creating and maintaining the Account (e-mail address, password stored in encrypted form) — legal basis: Article 6(1)(b) GDPR (necessity for the conclusion and performance of the agreement, which is the Terms of Service).
• Verification of the phone number and two-factor authentication (2FA) — legal basis: Article 6(1)(b) GDPR (the phone number is an element of the service itself — identity verification and sign-in — and not the subject of a separate consent).
• Security logs (IP address, User-Agent header, timestamps of sign-ins and other authentication events) — legal basis: Article 6(1)(f) GDPR (the Administrator's legitimate interest, described in point 3).
• Marketing (e-mail newsletter about what is new across the SkyRepublic family of services, SMS about aviation events) — legal basis: Article 6(1)(a) GDPR in conjunction with a separate, voluntary consent given in accordance with Article 398 of the Prawo komunikacji elektronicznej (PKE — the Polish Electronic Communications Law) — only if the User has checked the relevant checkbox.

3. The Administrator's legitimate interest

With regard to the processing of data on the basis of Article 6(1)(f) GDPR (security logs), the Administrator's legitimate interest is: preventing abuse and attempts at unauthorised access to Accounts (e.g. brute-force attacks, automated registrations), detecting and investigating security incidents, and demonstrating the Administrator's accountability in accordance with Article 5(2) GDPR. The scope and retention period of this data are limited to the necessary minimum (see point 6), so that this interest does not override the rights and freedoms of Users.

4. Recipients of the data

The personal data of Users may be disclosed to the following categories of recipients:

• Services of the SkyRepublic family to which the User signs in using the Account — airfield aviation-information services (skyradio.aero, jgdata.pl), SkyPhoto, SkyLogger, the flight school platform, and the mobile application. Each of these services receives only the data necessary to carry out sign-in and the permissions assigned to it (including the identifier, e-mail address, verification status, permission level); the phone number is disclosed only to those services that actually use it.
• dbhosting.pl — the e-mail service provider through which e-mail messages are sent (registration confirmation, notifications, transactional correspondence).
• SMS gateway — the technical provider for sending SMS messages (verification codes, marketing SMS messages where consent has been given).
• Entities authorised under applicable law (e.g. courts, law-enforcement authorities) — only to the extent and under the rules provided for by applicable law.

The providers listed above (e-mail, SMS gateway) process data on the basis of data processing agreements concluded with the Administrator (Article 28 GDPR) and only to the extent necessary to perform the commissioned service.

5. Transfer of data outside the European Economic Area

The personal data of Users is processed on servers located within the territory of the Republic of Poland / the European Economic Area. The Administrator does not transfer Users' personal data to third countries (outside the EEA) or to international organisations.

6. Data retention period

Personal data is retained for the following periods:

• Account data (e-mail, phone, password) — for the entire period the Account exists. An Account to which the User has not signed in for 24 months is considered inactive — the User receives an e-mail warning, and after a further 30 days of inactivity the Account and its data are deleted.
• Security logs (raw: IP address, User-Agent, timestamps) — 90 days, after which they are deleted or aggregated into a form that no longer allows the User to be identified.
• Verification codes (OTP) sent by SMS or e-mail — until they expire, plus a short safety buffer (10–15 minutes).
• System backups — until they are rotated, no longer than 90 days from the deletion of the data from the production system.
• Records of acceptance of the Terms of Service and of marketing consents given/withdrawn — retained indefinitely as legal evidence of having fulfilled information obligations and of consents given (accountability, Article 5(2) GDPR); after deletion of the Account, these records are retained in a form disconnected from any active account.

7. Rights of the data subject

The User has the following rights regarding the processing of their personal data:

• the right of access to the data (Article 15 GDPR) — including obtaining a copy of it; the User can download the basic scope of data themselves in JSON format in the Account panel;
• the right to rectification of the data (Article 16 GDPR);
• the right to erasure of the data / the "right to be forgotten" (Article 17 GDPR) — exercised on a self-service basis by deleting the Account in the Account panel;
• the right to restriction of processing (Article 18 GDPR);
• the right to data portability (Article 20 GDPR) — through the export of data in a structured format (JSON), available in the Account panel;
• the right to object (Article 21 GDPR) to processing based on the Administrator's legitimate interest (point 3);
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal (Article 7(3) GDPR) — for marketing consents: by the link in the footer of the e-mail message, or by replying "STOP" to an SMS.

To exercise the above rights, to the extent not available on a self-service basis in the Account panel, please contact the Administrator at the address indicated in point 1.

8. Right to lodge a complaint

The User has the right to lodge a complaint with the supervisory authority responsible for the protection of personal data — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland, if they consider that the processing of their personal data infringes the GDPR.

9. Voluntary nature of providing data and the consequences of not providing it

Providing the e-mail address and phone number, and setting a password, is voluntary but necessary for concluding the Account service agreement — without providing this data and completing verification of both channels, creating and using the Account is not possible.

Providing data for the purpose of receiving marketing information (e-mail newsletter, SMS) is entirely voluntary and does not affect the ability to create or use the Account.

10. Automated decision-making and profiling

The Administrator does not make automated decisions concerning Users, including decisions resulting from profiling, that would produce legal effects concerning the User or similarly significantly affect their situation (Article 22 GDPR).

11. Changes to the Privacy Policy and contact

This Privacy Policy may be amended under the same procedure and on the same terms as the Account Terms of Service — see §14 of the Terms of Service (notice at least 14 days before the changes take effect, given electronically and by a notice in the Account panel). Each version of this Privacy Policy is marked with a number and the date it takes effect, and is archived.

For matters concerning this Privacy Policy and the processing of personal data, please contact: contact@skyrepublic.aero.