Privacy policy

The controller of your personal data is the Foundation "Institute for the Development and Promotion of Aviation", ul. Świeradowska 44A, 02-662 Warsaw, Poland, registered under KRS 0001244600, tax ID (NIP) 5214167160.

For any question about personal data, write to [email protected].

We collect only what we need. Some data you give us in forms, and some we record automatically when you open the site: that is how the server logs and the visit counter work.

Newsletter sign-up

Data: first name, email address, the wording of the consent, the date, your IP address and browser name.
Why: to send information about the Foundation's work. The IP address and browser are stored solely so that we can demonstrate the consent was given.
Legal basis: your consent (Article 6(1)(a) GDPR).
How long: until you withdraw consent. After that we keep only the record of the consent and its withdrawal, for 5 years. The basis is then our legitimate interest in showing that consent was given (Article 6(1)(f) in conjunction with Articles 5(2) and 7(1) GDPR). Your address stays on a suppression list for that time so that we do not email you by mistake.

Accepting an invitation to the Advisory Board

Data: full name, email address, the declarations submitted, the date and time, and the IP address.
Why: to document the appointment of a member of a governing body of the Foundation.
Legal basis: our legitimate interest in documenting the composition and work of the Foundation's bodies and in showing who submitted a declaration and when (Article 6(1)(f) GDPR).
How long: 10 years from the date the document was created (§ 32 of the Rules of Procedure of the Advisory Board). Records of who sat on a body may be needed that long to show that its resolutions were validly adopted.

Donations

Data: full name, email address, postal address, amount and transaction identifier.
Why: to accept the donation, issue a confirmation and account for it.
Legal basis: performance of the donation agreement (Article 6(1)(b) GDPR) and our tax and accounting obligations (Article 6(1)(c)).
How long: 5 years from the end of the calendar year in which the tax payment fell due (Article 86 § 1 in conjunction with Article 70 § 1 of the Polish Tax Ordinance), and 5 years from the start of the year following the financial year the accounting document relates to (Article 74 of the Polish Accounting Act). We apply whichever period is longer.

Messages to us

Data: whatever you write in the message.
Legal basis: our legitimate interest in answering you (Article 6(1)(f) GDPR).
How long: until the matter is closed, and no longer than 3 years.

Server logs

Data: IP address, date and time of the request, the page requested, browser name.
Why: to keep the site running and to detect abuse.
Legal basis: our legitimate interest in the security of the site (Article 6(1)(f) GDPR).
How long: the logs are held by our hosting provider, which sets the retention period. We do not archive or analyse them ourselves.

Visit statistics

Data: the address of the page you open and the date of the visit. The server also uses your IP address and browser name to create a one-day code from them.
Why: to know how many people read the analyses and which pages are opened most often.
Legal basis: our legitimate interest in knowing how much attention our analyses receive (Article 6(1)(f) GDPR).
How long: we do not store your IP address or browser name. The code only lets us count the same person once a day. We create it with a random value that changes every day, and we never match it against server logs or any other data. The code and that value are deleted from the database within about 30 hours, after which nobody, us included, can link the code to an IP address. All that remains are daily counts of page views and visitors for each page.

Providing your data is voluntary, but without it we cannot add you to the newsletter, issue a donation confirmation or reply to your message. We do not make automated decisions and we do not profile.

We do not sell your data and we do not share it for marketing purposes. We use the following providers, who process data on our behalf:

1. Vercel - website hosting,
2. Cloudflare - routing traffic to the site and protection against attacks,
3. Supabase - database,
4. Resend - email delivery,
5. Stripe - payment handling for donations,
6. the accounting firm working for the Foundation - donation records.

Some of them process data outside the European Economic Area, mainly in the United States. Those transfers rely on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR) or on a Commission adequacy decision (Article 45 GDPR). Write to [email protected] and we will tell you which mechanism applies to a given provider and give you a copy of the safeguards. We may also disclose data to public authorities where the law requires it.

You have the right to access your data, to have it corrected, erased or its processing restricted, the right to data portability, and the right to object to processing based on our legitimate interest. You may withdraw consent at any time, which does not affect the lawfulness of what we did before that.

To exercise any of these rights, write to [email protected]. You can also unsubscribe from the newsletter using the link at the foot of every message.

If you believe we are handling your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

This site uses no advertising pixels and no tools that track you across websites, and it runs no statistics scripts in your browser. The server counts visits from the page request your browser sends anyway. The counter stores nothing on your device, which is why there is no consent banner.

If you do not want your visits counted, turn on the Global Privacy Control signal in your browser and the server will skip them.

The only cookies we use are technical ones, and they appear only once you log in. They keep you signed in for 30 days and do nothing else. You can remove them sooner by logging out or clearing site data in your browser.

If we change how we handle personal data, we will update this page. Last updated: 15 September 2026.