Service Administrator

(1) This Privacy Policy describes the rules regarding the processing of data, in particular personal data, by Aerotunel Sp. z o.o. with its registered office in Warsaw, 00-090, Al. Solidarności 75/26, entered in the National Court Register kept by the District Court for the m. st. Warsaw, XII Commercial Department of the National Court Register under the KRS number 0000821632, NIP: 5252533508, share capital of PLN 19,000,000 (hereinafter:‘Aerotunel’ or ‘Administrator’).

2 The Privacy Policy describes the principles of data processing in connection with the offering of services by Aerotunnel, in particular those available at the wind tunnel facilities operated under the name FlySpot FlySpot’) and a facility including a deep diving pool, operating under the name ‘DeepSpot‘), while the rules described herein shall also apply to additional services or functionalities related to FlySpot‘s and DeepSpot ‘s activities, such as, in particular, services and content made available through the Administrator ‘s websites, includingwww.flyspot.comSerwis’)and processes related to the sale of products and services in stationary and online stores (all of the above services and activities shall be hereinafter collectively referred to as ‘Services‘, and persons using or wishing to purchase or use such Services as ‘Users‘).

(3) The Administrator can be contacted on all issues related to data processing, including personal data, at e-mail address: [email protected].

Personal data – general provisions

(1) Personal data is any information about an identified or identifiable natural person, by which is meant a person who can be identified directly or indirectly, in particular on the basis of an identifier such as a name, an identification number, location data, an online identifier or one or more specific factors that determine the physical, physiological, genetic, mental, economic, cultural or social identity of a natural person.

(2) The administrator of the Users’ personal data will be Aerotunel Spółka z ograniczoną odpowiedzialnością, with its registered office in Warsaw (other data provided in Article I, paragraphs 1 and 3 above).

(3) Aerotunel will process, including the collection and storage of personal data, in accordance with applicable laws, in particular the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016. on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC (‘RODO‘), as well as in accordance with this Privacy Policy.

(4) The provision of personal data is always voluntary, while it may be a condition for the acquisition or use of Services or the use of certain features available on the Site. In particular, the acquisition of the Services, the booking of a date for their implementation through the Service and the actual use of the Service in FlySpot or DeepSpot require the provision of the User’s personal data. In the case of the use of FlySpot’s wind tunnel or DeepSpot’s pool flight services, the personal data of each person actually using such Services is required, including if the Services were purchased by another person. Provision of personal data in the above situation is necessary, in particular, for the purpose of confirming the User’s acquaintance with important information provided by Aerotunel in model statements or other documents, confirming their acceptance by the User and the absence of contraindications to use the Service.

How we collect your personal information

(1) Aerotunel shall obtain and collect Users’ personal data in connection with the provision of the Services or in connection with the User’s willingness to use the Services, including, in particular, through:

A) information entered by the User when creating an account on the Website

B) information entered by the User in forms filled out in connection with the use of the Services

C) information provided by the User for the purpose of carrying out purchases of Services through the Website

D) information provided by the User in the course of contacting Aerotunel, including in connection with complaints, inquiries regarding the Services, etc.

E) saving in the final devices used by the User, cookie files

F) collection of web server logs

G) obtaining data from publicly available sources or from external parties

H) The service may record information about connection parameters (time stamp, IP address).

I) For what purposes we process your personal data

J) Aerotunel may process Users’ personal data in the following manner and for the following purposes:

K) accept and manage reservations made by the User with respect to the Services

L) enable the User to use the Service

M) to carry out other activities related to the performance of the Service, such as receiving and processing complaints, answering Users’ questions about the Services, etc.

N) issuing an invoice or other purposes related to bookkeeping, as well as fulfilling the obligations required by applicable law

O) promoting Aerotunel Services

(2) Aerotunel may also process the User’s personal data for purposes other than those indicated in para. 1 above, provided that the User gives appropriate consent thereto or that the Administrator has another legal basis for such processing, as well as provided that the User is provided with appropriate additional information about such processing of personal data in a situation where it would be carried out for other purposes or on different terms than those arising from this Privacy Policy.

(3) The processing of personal data referred to above may be carried out on the following grounds provided for by the RODO:

A) processing is necessary for the performance of a contract to which the User is a party, or to take action at the User’s request, prior to the conclusion of the contract (Article 6(1)(a) RODO)

B) on the basis of the consent expressed by the User (Art. 6.1.b. RODO)

C) for the purpose of fulfilling a legal obligation incumbent on the Administrator (Art. 6.1.c. RODO)

D) for the purposes of legitimate interests pursued by the Administrator or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the User (Article 6.1.f. RODO).

E) Legitimate interests pursued by the Administrator, referred to in paragraph. 3 pt. (d) above, are in particular: contacting the User in connection with the performance of the Services, answering the User’s questions or other similar communication with the User, asserting claims by Aerotunel or defending against claims made by the User.

(4) Due to the fact that certain Services made available by Aerotunel may involve significant risks, in particular in the case of using them despite the existence of health contraindications on the part of the User, Aerotunel may collect certain personal data concerning the User’s health condition or habits or way of life that may affect the User’s health condition or mental and physical abilities. Such data may include the so-called special categories of personal data referred to in Art. 9 para. 1 RODO. The processing of this type of data is related to the concern for the safety of the User, and in particular for the purpose of informing the User about contraindications related to the use of the given Service and receiving a statement from the User that there are no such contraindications on the User’s side, or – if they exist – for the purpose of possible further communication with the User, including the transmission of further explanations, verification of possible certificates from a doctor and similar purposes related to the efforts to ensure the safe use of the Services by the Users.

(5) Special categories of personal data will be processed only if the User expressly agrees.

6 The Administrator may process Users’ personal data for the purpose of marketing the Services, including profiling personal data for the above purposes, based on Art. 6 para. 1 pt. (f) RODO, i.e. , whereby the User may object to such processing at any time. Any processing of the User’s personal data for third-party marketing purposes will be allowed only with the User’s express consent.

(7) The Administrator’s sending of commercial information to the User by electronic means, if any, including the use of terminal equipment for the above purposes, shall be based on the consent given by the User.

(8) In order to best match marketing messages and content on the Service to the User’s preferences, the Administrator may profile the User’s personal data. As part of profiling, the Administrator may, in particular, analyze the history of a given User’s activity on the Service, so as to direct to the User an offer to use the Service, an event notification or other similar marketing information, which in Aerotunel’s assessment – made on the basis of the above profiling – will be best suited to the User’s needs or interests.

(9) In addition, Aerotunel may process your personal data, including profiling of your personal data, for the purpose of creating statistics, conducting market research, analyzing consumer preferences, habits and choices.

10. profiling of Users’ personal data by Aerotunel for the purposes indicated above will be based on Art. 6 para. 1 pt. (f) RODO, i.e., it may take place in situations where it will be necessary for the purposes of legitimate interests pursued by the Administrator or a third party, provided that such interests are not? subordinate to the interests of the User or his/her fundamental rights and freedoms.

(11) The profiling of personal data shall not produce any legal effects against the User, as referred to in Art. 22 para. 1 RODO, or otherwise materially affect him in a similar manner.

(12) You have the right to object at any time to the use of your personal data for the Administrator’s marketing purposes, including regarding the profiling of your personal data.

What personal data we process

(1) The extent of the personal data that Aerotunel will actually process with respect to a User will depend, in particular, on:

A) the extent of the data actually provided by the User

B) the nature of the Service or activity that Aerotunel performs at the request of the User, for example – sending a voucher in the form of a plastic card will require the User to provide a residential or other mailing address, while delivery of a voucher in electronic form will only require an e-mail address

C) the requirements of applicable laws, for example, the issuance of an invoice at the request of the User will require the provision of the relevant data required by the regulations, including the Taxpayer Identification Number or PESEL number.

D) the type of Service the User is using, such as:

(E) the use of the Boeing flight simulator, which does not involve any specific risks, will require a relatively narrower range of data than the use of DeepSpot deep pool diving services

F) the use of diving in DeepSpot does not require the User’s gender or size, but if the User additionally wishes to use the Foam Rental Service, the Administrator may process such data (gender, size) for the purpose of performing the above Service

G) additional functionalities, offers or other similar benefits that the User may wish to use in connection with the Services, e.g. The Administrator may offer the User a complimentary T-shirt in connection with the purchase of another Service and ask the User about his/her gender or size in order to select the appropriate product (providing such data is always voluntary, and any refusal to provide such data does not affect the User’s right to use the Services, but may at most result in the User’s inability to take advantage of additional offers or their worse fit for the User).

(2) Depending in particular on the aspects mentioned in para. 1 above, Aerotunel may process all or some of the following personal data of the User:

A) name or nickname

B) residential or mailing address

C) e-mail address

D) telephone number

E) date of birth

F) gender

G) size

H) data on health status or habits or activities affecting health status

I) Tax ID or PESEL number

J) data from diving licenses or other similar documents proving the User’s authority, in particular, the license number, the organization under which it was issued, etc.

K) image

L) data generated by the Aerotunel system, such as customer number

M) data on the details of the User’s use of the Services, including the type of Services, the dates of their use, the cost of the Services purchased, etc.

N) in the case of persons who obtain services of a training nature from Aerotunel – additional data related to the obtained authorizations, such as the course of previous training, number of dives, training progress, exam results, etc.

Who may be the recipient of your personal data

(1) Personal data may be entrusted or shared with the following categories of entities:

A) entities that Aerotunel engages in connection with the provision of the Services, for the purpose of carrying out processes related to the performance of the Services, such as, for example, IT system providers, couriers, instructors and other entities with which Aerotunel cooperates in this regard

B) other controllers of personal data, in particular providers of training formats on the basis of which Aerotunel provides the Services

(2) Aerotunel may transfer Users’ personal data outside the European Economic Area (EEA). In such cases, Aerotunel will ensure that a similar level of data protection in the third country is provided by implementing one of the following safeguards:

(A) the transfer of personal data will take place to countries that the European Commission has recognized as providing an adequate level of protection for personal data

(B) The Administrator will use appropriate standard contractual clauses.

(C) As part of the exercise of Users’ rights, the Administrator will also ensure that a copy of appropriate safeguards for personal data can be obtained in the event of transfer to third countries.

User Rights

(1) In connection with Aerotunel’s processing of your personal data, you have rights under the RODO.

(2) In particular, under the terms of the RODO, you have the right to:

A) access to personal data processed by the Administrator

B) request rectification of personal data – in case the data is incorrect or incomplete

(C) request deletion of personal data (the so-called “right to be forgotten”) – in case: (i) the User’s data are no longer necessary for the purposes for which they were collected or otherwise processed, (ii) The User has objected to the processing of personal data based on the pursuit of the Administrator’s legitimate interests, including data profiling, (iii) The User has withdrawn the consent on which the processing is based and there is no other legal basis for the processing, (iv) the data was processed unlawfully, (v) the data must be deleted in order to comply with a legal obligation, (vi) the personal data were collected in connection with the offering of information society services referred to in Art. 8 para. 1 RODO

(D) request the restriction of the processing of personal data if (i) the User questions the accuracy of the personal data (for a period of time that allows the Administrator to verify the accuracy of the data), (ii) the processing is unlawful, and the User objects to? erasure of the personal data, requesting instead a restriction on its use, (iii) the Administrator no longer needs the personal data for the purposes of processing, but they are? they are needed by the User to establish, assert or defend claims, (iv) The User has objected under Art. 21 para. 1 RODO against the processing (until it is determined whether the legitimate grounds on the part of the Administrator override the grounds of the User’s objection)

E) portability of personal data, in case the processing is carried out by automated means, on the basis of a contract concluded with the User or on the basis of consent expressed by the User

F) object to the processing of personal data, including profiling, in the case of the processing of personal data used for the purposes of realizing the legitimate interests of the Controller

G) lodge a complaint to the supervisory authority, i.e. to the President of the Office for Personal Data Protection, in the event that the Administrator’s processing of the User’s personal data violates the provisions of the RODO.

(3) To the extent that you have given your consent to the processing of personal data, you have the right to withdraw your consent to the processing of personal data at any time. Withdrawal of consent shall not affect the lawfulness of data processing performed on the basis of consent before its withdrawal.

(4) The User may make demands or make representations regarding the exercise of the rights referred to in para. 2 and 3 above, in particular to the Administrator’s e-mail address indicated in Art. I para. 3 of this Privacy Policy.

How long we will keep your personal information

(1) In the case of Users who have entered into a contract with the Administrator, personal data will be kept for the period of its execution, and after its expiration – for a period no longer than required by applicable law. In particular, if the User has requested that the Administrator issue an invoice, personal data will be kept for a period of five years from the end of the calendar year in which the invoice was issued.

(2) If the User has filed a complaint regarding the provision of the Services by the Administrator, or if it is otherwise justified for the protection of the Administrator’s interests, the Administrator will keep the User’s personal data for a period until the statute of limitations for the User’s claims against the Administrator. If a dispute is initiated between Aerotunel and the User, the personal data will be kept until the dispute is legally resolved and any benefits awarded by a final court judgment or a final administrative decision are satisfied, and if necessary, until the statute of limitations for such awarded claims has expired.

(3) To the extent that the processing of personal data is based on the premise of the necessity of the processing for purposes arising from legitimate interests pursued by the Administrator or by a? third party, the personal data will be stored no longer than until the User objects to the processing of his/her personal data (including their profiling), unless the Administrator demonstrates the existence of valid legitimate grounds for processing that override the interests, rights and freedoms of the User, such as, in particular, the establishment or assertion of claims or the defense against claims.

(4) To the extent that the processing of personal data is based on the premise of the User’s consent, personal data will be stored no longer than until the User revokes such consent, unless the Administrator has another valid legal basis for processing, including the storage of personal data.

(5) In the case of Users who have registered with the Service, personal data will be kept for the period of use of the Service, but the Administrator may delete personal data and the User’s account on the Service if the User has not used the Service for a period of 12 months or longer, including not logging into his/her account on the Service.

Image monitoring

(1) In the event that the User takes advantage of flights in the FlySpot wind tunnel, the User’s image will be recorded by Aerotunel in order to enable the User to obtain videos of the flight, which may also be sent at the User’s request to the e-mail address indicated by the User or may be copied by the User at the FlySpot facility to the storage medium of the User’s choice, depending on the options currently offered by Aerotunel in the above regard. Video materials with the recorded image of the User are deleted after 14 days from the date of their recording.

(2) Additional Services may also be available to Users at FlySpot and DeepSpot facilities, which include the recording of the User’s image, e.g. while diving. Recordings containing the image captured in connection with the performance of such additional Services will be deleted after 1 month.

(3) A video surveillance system is in place at the FlySpot and DeepSpot facilities to ensure the safety of the occupants of the facilities, as well as to protect the property of such occupants and the property of Aerotunel. Personal data collected as a result of monitoring may be transferred to entities authorized by law to access such data. The administrator shall store surveillance recordings for a period of no more than 3 months, with the proviso that recordings that may constitute evidence in proceedings under the law may be kept longer, until the proceedings are legally concluded. After the expiration of the above periods, the image recordings obtained as a result of the monitoring containing personal data shall be destroyed, unless otherwise stipulated by separate regulations.

Relevant marketing techniques

(1) On the Service, the Administrator uses the Facebook pixel. The use of the above technology causes the Facebook provider to obtain information that a particular User with a FaceBook account is using the Service. The provider of the FaceBook service in this case relies on the data in relation to which it is itself an administrator, i.e. the Administrator. Aerotunel does not transfer any additional personal data to Facebook for the above purposes.The technology is based on the use ofcook files on the terminal device from which the User logs into the Service.

Information about the use of cookies

1 The service uses cookies.

2. cookie(so-called “cookies”) are IT data, in particular text files, which are stored in the Service User’s terminal equipment and are intended for use on the Website. Cookies usually contain the name of the website from which they originate, the time they are stored on the terminal equipment and a unique number.

(3) The entity placing on the final device of the Service Usericookie files and accessing them is Aerotunel.

4 Cookie files are used for the following purposes:

A) creation of statistics that help to understand how Users use the content of the Website, which allows to improve its structure and content

B) maintaining a session of the Service User (after logging in), so that the User does not have to re-enter his/her login and password on each sub-page of the Service.

C) determine the User’s profile in order to display content tailored to the User’s preferences on advertising networks, in particular the Google network.

D) The Service uses two main types of cookies: “session” (session cookies) and “permanent” (persistent cookies). “Session” cookies are temporary files that are stored on the User’s terminal device until the User logs out, leaves the website or shuts down the software (web browser). “Permanent “cookies are stored on the User’s end device for the time specified in the parameters of the cookies or until they are deleted by the User.

(5) Web browsing software (Internet browser) usually allows the storage of cookies on the User’s terminal device by default. Users of the Service may change their settings in this regard. Your web browser allows you to deletecookie files. It is also possible to automatically block the files For details, please refer to the help or documentation of your web browser.

6 Restrictions on the use of cookie files may affect some of the functionality available on the Website.

(7) If the User does not want to receive cookie files, he can change his browser settings. Disabling cookies necessary for authentication processes, security, maintenance of User preferences may hinder, and in extreme cases may make it impossible to use the Website.

8. To manage the settingsmicook, select a web browser/system from the list below and follow the instructions:

A) Internet Explorer

B) Chrome

C) Safari

D) Firefox style=’>.

E) Opera

F) Android

G) Safari (iOS)

H) Windows Phone

9 Information about certain behaviors of Users is subject to logging in the server layer. This data is used exclusively for the administration of the Site and to provide the best possible service for the Services provided .

10. the viewed resources of the Service are identified by URLs. In addition, the record may be subject to:

A) the arrival time of the query

(B) the time to send a response

C) the name of the User’s station – identification carried out by the http protocol

D) information about errors that occurred in the execution of http transactions

E) the URL address of the page previously visited by the User ( referer link) – in case the access to the Site was through a link

F) information about the user’s browser

G) IP address information.

(11) The above data are not associated with specific Users browsing the sites and are used only for the purpose of server administration.

Final provisions

(1) To the extent not regulated in the Privacy Policy, applicable laws, in particular the RODO, shall apply to the principles of personal data processing.