FPV Training
Log in Sign up

Privacy Policy

  • Version 1.0
  • Effective date to be set
Download PDF

Draft for legal reviewThis document is a draft and may still change.

In the event of any discrepancy between language versions, the Polish version prevails.

Draft for review by a lawyer before publication. This English version is provided for information; in case of discrepancies the Polish version prevails.

§ 1. Data controller

  1. The controller of personal data is Power Technology P.S.A., with its registered office in Lubicz Górny, ul. Widokowa 8, 87-162 Lubicz Górny, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0001087392, NIP 8792755036, REGON 527760094 (hereinafter: the "Controller").
  2. In matters relating to personal data, you can contact the Controller by email at biuro@power-technology.pl or in writing at the address of its registered office. The Controller has not appointed a data protection officer.
  3. This Privacy Policy fulfils the information obligations laid down in Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: the "GDPR") towards persons whose data the Controller processes in connection with running the website fpv.power-technology.pl (hereinafter: the "Website"), organising FPV drone piloting courses and contact with the Controller.
  4. Capitalised terms (e.g. Buyer, Participant, Supervising Adult, Course, Order, Account) have the meanings given to them in the Training Terms and Conditions and in the Terms of Service Provided by Electronic Means.

§ 2. What data we process and where we obtain it

  1. The Controller processes the following categories of data:
    • a) Buyer data: full name, email address, telephone number (if provided), billing and invoice details (including address, country, company name and tax identification number), information about Orders and payments, and the content of correspondence,
    • b) Participant data: full name, date of birth, email address and telephone number (if provided), STS-01 certificate number (for the Shortened Variant), information on acting as a Supervising Adult or being a Minor Participant, and the data necessary to register for the exams and to issue documents confirming competency,
    • c) data of the parent or legal guardian of a Minor Participant contained in the written consent to participation in the Course (full name, contact details, signature),
    • d) health data – only if provided voluntarily, e.g. information about dietary requirements or information relevant to the Participant's safety contained in the Participant's declaration or in the parental consent,
    • e) information about the result of a sobriety test – only if such a test is carried out, and to the extent necessary to document the grounds for non-admission to classes or exclusion from the Course,
    • f) data provided by Google when logging in with a Google account: full name, email address, account identifier and – if Google makes it available – profile picture,
    • g) data provided by PayU: payment identifier and status, amount and selected payment method (the Controller does not receive full payment card details or online banking login details),
    • h) technical data: IP address, information about the browser and device, date and time of requests to the Website, identifiers stored in cookies, and technical signals processed by the Cloudflare Turnstile mechanism,
    • i) image – only on the basis of separate consent.
  2. We obtain data directly from the persons it concerns and, in addition: Participant data – from the Buyer who places the Order; Google account data – from Google, at the request of the User logging in with Google; payment data – from PayU; technical data – automatically, in connection with use of the Website.
  1. Creating and maintaining the Account, enabling login (with Google, email address and password, or a Login Link) and providing services by electronic means – Article 6(1)(b) GDPR (performance of a contract).
  2. Concluding and performing the Contract with the Buyer, including handling the Order and payments and sending organisational information and reminders – Article 6(1)(b) GDPR.
  3. Organising and running the Course for Participants other than the Buyer (identification of Participants, attendance list, provision of meals and equipment) – Article 6(1)(f) GDPR; the Controller's legitimate interest is the performance of the Contract concluded with the Buyer for the benefit of the Participants.
  4. Verifying the age of Participants and the conditions for the participation of a Minor Participant, including storing the consent of a parent or legal guardian, and verifying the STS-01 certificate – Article 6(1)(b) GDPR with respect to the Buyer and Article 6(1)(f) GDPR with respect to Participants and parents; the legitimate interest is ensuring that the Course runs safely and in accordance with the Training Terms and Conditions, and documenting that its conditions have been met.
  5. Registering Participants for the A2 and STS-01 exams and providing their data to the entity conducting the exams – Article 6(1)(f) GDPR (performance of the Contract for the benefit of the Participant) and, to the extent that the obligation to provide the data arises from the rules on examining remote pilots of unmanned aircraft, Article 6(1)(c) GDPR.
  6. Taking into account dietary requirements and health information relevant to the Participant's safety – Article 9(2)(a) GDPR (explicit consent). Providing this information is voluntary.
  7. Ensuring safety during the Course, including documenting the result of a sobriety test and the reasons for non-admission to classes or exclusion – Article 6(1)(f) GDPR (legitimate interest: the safety of persons and property and the establishment, pursuit or defence of claims) and, with regard to health data, Article 9(2)(f) GDPR.
  8. Issuing invoices, keeping accounting records and tax settlements – Article 6(1)(c) GDPR in conjunction with the provisions of the Polish VAT Act, the Accounting Act and the Tax Ordinance.
  9. Handling complaints, notices of withdrawal from the contract and complaints about accessibility – Article 6(1)(c) GDPR in conjunction with the provisions of the Consumer Rights Act and the Act on ensuring compliance with accessibility requirements for certain products and services by economic operators, and, with respect to persons who are not consumers, Article 6(1)(f) GDPR.
  10. Responding to enquiries sent using the contact form or by email, including enquiries about group courses – Article 6(1)(f) GDPR (legitimate interest: conducting correspondence) and, if the enquiry is aimed at concluding a contract, Article 6(1)(b) GDPR.
  11. Ensuring the security of the Website, including protecting forms against bots with Cloudflare Turnstile and keeping server logs – Article 6(1)(f) GDPR.
  12. Compiling statistics on use of the Website with Google Analytics – Article 6(1)(a) GDPR (consent), given in accordance with Article 399 of the Polish Electronic Communications Law of 12 July 2024. Details are described in the Cookie Policy.
  13. Recording and disseminating images for documentation and promotional purposes – Article 6(1)(a) GDPR and Article 81 of the Polish Act of 4 February 1994 on Copyright and Related Rights (consent).
  14. Establishing, pursuing or defending claims – Article 6(1)(f) GDPR.
  15. Documenting consents given and the exercise of data subjects' rights – Article 6(1)(c) GDPR in conjunction with Article 5(2) and Article 7(1) GDPR.

§ 4. Whether providing data is voluntary

  1. Providing data is voluntary but necessary to create an Account, place an Order and take part in the Course. Without the Participants' data, including date of birth, it is not possible to conclude and perform the Contract or to register for the exams.
  2. Providing invoice details is a statutory requirement if the Buyer requests an invoice or is a taxpayer.
  3. Providing health data and consenting to analytics cookies and to the recording of images is entirely voluntary. Not giving consent does not affect the possibility of taking part in the Course.

§ 5. Recipients of data

  1. Data may be disclosed to the following recipients or categories of recipients:
    • a) PayU S.A., with its registered office in Poznań – for payment processing; PayU S.A. processes data as a separate controller with regard to the payment services it provides,
    • b) the provider of hosting and server infrastructure services for the Website,
    • c) the provider of the email sending service for the Website,
    • d) Google Ireland Limited and Google LLC – for login with a Google account, the Controller's email service (Google Workspace) and – only after consent has been given – the Google Analytics service,
    • e) Cloudflare, Inc. – for the Cloudflare Turnstile mechanism protecting forms against bots; according to Cloudflare, it processes data as a processor and, with regard to improving its bot detection mechanisms, as a separate controller,
    • f) the catering company providing meals during the Course – with regard to Participants' full names, the number of meals and, with consent, information about dietary requirements,
    • g) the accounting firm serving the Controller – with regard to accounting records,
    • h) the Co-organisers of the Courses: Militarne Borne and the Museum of Military History in Borne Sulinowo – to the extent necessary to organise the Course on the area they make available (e.g. the list of Participants),
    • i) the entity conducting the A2 and STS-01 exams and the President of the Civil Aviation Authority – to the extent necessary to conduct the exams and issue documents confirming competency,
    • j) instructors and other persons cooperating with the Controller in running the Courses – on the basis of an authorisation and a confidentiality undertaking,
    • k) IT service providers, legal advisers, postal operators and couriers – to the extent necessary to perform their services,
    • l) public authorities – only where an obligation to disclose data arises from the law.
  2. Entities processing data on behalf of the Controller act on the basis of data processing agreements referred to in Article 28 GDPR.

§ 6. Transfers of data outside the European Economic Area

  1. In connection with the use of the services of Google LLC and Cloudflare, Inc., data may be transferred to the United States of America.
  2. The transfer takes place on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU-US Data Privacy Framework – to the extent that the recipient participates in that framework – or on the basis of standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR).
  3. If the hosting or email sending service provider transfers data outside the European Economic Area, the Controller ensures that one of the safeguards provided for in Chapter V of the GDPR is applied.
  4. A copy of the safeguards applied can be obtained by contacting the Controller.

§ 7. Data retention period

  1. Data related to the Account – until the Account is deleted and then, to the extent necessary to establish, pursue or defend claims, until the limitation periods for those claims expire.
  2. Data related to the Contract – for the duration of its performance and then until the limitation periods for claims expire (as a rule 6 years, and 3 years for claims related to running a business; the limitation period ends on the last day of the calendar year).
  3. Invoices and other accounting documents – for the period required by tax and accounting regulations, as a rule 5 years from the end of the calendar (tax) year in which the tax payment deadline expired.
  4. The consent of a parent or legal guardian and documentation of non-admission to classes or exclusion from the Course – until the limitation periods for claims related to the Course expire.
  5. Health data provided in connection with the Course – until the end of the Course, after which it is deleted no later than within 30 days, unless it is necessary to establish, pursue or defend claims (e.g. in connection with an accident).
  6. Data from enquiries and correspondence – for the duration of the correspondence and for up to 12 months after it ends, unless the enquiry leads to the conclusion of a contract.
  7. Server logs – no longer than 90 days, unless they are necessary to investigate a security incident.
  8. Data processed on the basis of consent – until consent is withdrawn or the purpose of processing has been achieved. The retention period for analytics data is described in the Cookie Policy.
  9. Documentation of complaints, notices of withdrawal and accessibility complaints – until the limitation periods for the claims to which they relate expire.

§ 8. Rights of data subjects

  1. Every data subject has the right to:
    • a) access their data (Article 15 GDPR),
    • b) rectification of their data (Article 16 GDPR),
    • c) erasure of their data (Article 17 GDPR),
    • d) restriction of processing (Article 18 GDPR),
    • e) portability of data processed by automated means on the basis of a contract or consent (Article 20 GDPR),
    • f) object to the processing of data on the basis of the Controller's legitimate interest (Article 21 GDPR),
    • g) withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR).
  2. Requests can be sent to biuro@power-technology.pl. The Controller responds without undue delay and no later than within one month of receiving the request; where necessary, this period may be extended by a further two months, of which the Controller will inform you.
  3. Everyone has the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, Poland, www.uodo.gov.pl) if they consider that the processing of their data infringes the GDPR.

§ 9. Automated decision-making

  1. The Controller does not make decisions based solely on automated processing of data, including profiling, which would produce legal effects concerning a person or similarly significantly affect them (Article 22 GDPR).
  2. The Cloudflare Turnstile mechanism automatically assesses whether a form is being sent by a human. This assessment does not produce legal effects. If the verification prevents you from using a form, you can contact the Controller by email.

§ 10. Participant data provided by the Buyer

  1. A Buyer who provides other persons' data in the Order declares that they are entitled to provide it and informs those persons that their data has been provided to the Controller.
  2. The Controller provides Participants with the information required by Article 14 GDPR in the first message to the Participant or, if their email address was not provided, no later than on the first day of the Course.

§ 11. Data security

The Controller applies technical and organisational measures appropriate to the risk, in particular encryption of the connection to the Website, storage of passwords in cryptographically protected form, access control to the administration panel, backups, and authorising only those persons who need the data to perform their tasks to process it.

§ 12. Changes to the Privacy Policy

  1. The Privacy Policy may be updated, in particular in the event of a change in the law, a change of service providers or the introduction of new Website functions. The current version, with its effective date, is available on the Website.
  2. Account holders are informed of significant changes by email.
  3. The Privacy Policy applies from (to be announced).
13,000 PLN 7 days · A2 and STS-01 Sign up