Privacy Policy

1. Data Controller

The data controller is HUBICHEM Hubert Wodnicki, NIP: 8571849862, Jasiel 9, 72-300 Gryfice, Poland. Contact regarding data protection: hubinet@proton.me

2. What Data We Collect

3. Purposes of Processing

Provision of Platform services — Art. 6(1)(b) GDPR (performance of a contract); Security and abuse prevention — Art. 6(1)(f) (legitimate interest); Payment processing — Art. 6(1)(b) (performance of a contract); Communication with the User — Art. 6(1)(b) (performance of a contract); Push notifications — Art. 6(1)(a) (consent); Geolocation (pilot app) — Art. 6(1)(a) (consent); Accounting obligations — Art. 6(1)(c) (legal obligation)

4. Data Retention

Data is stored on servers within the European Union. Retention periods: Account data — for the duration of the account + 30 days after deletion; Digital signatures (audit trail) — indefinitely (data integrity); Accounting data (invoices) — 5 years (legal obligation); Security logs (IP, logins) — 90 days; Backups — daily, retained for 30 days.

5. Data Sharing

We do not sell personal data to third parties. Data may only be shared with: Stripe, Inc. (USA) — payment processing (email, transaction data); Google (OAuth) — authentication (email, name, avatar); Resend (Magic Link) — email delivery (email address). All sub-processors are subject to appropriate safeguards (EU standard contractual clauses). Data may be disclosed to law enforcement only on the basis of a valid court order.

6. Data Sharing Within the Platform

Drop zone (DZ): The zone manager can see data of jumpers assigned to the zone (first name, last name, license, document status, equipment, weight). The scope of sharing is controlled by the User. AFF instructors can see data of their students within the scope of the AFF course. Friends: The User decides who can see their profile, jumps, and statistics. Public profile: The User can enable a public profile — only data marked as public will be visible.

7. User Rights (GDPR)

Every User has the right to: access their data (visible in profile and logbook); rectification of data (profile editing); erasure of data — right to be forgotten (account deletion, data removed within 30 days); data portability (logbook export to PDF); restriction of processing (contact: hubinet@proton.me); objection to processing; withdrawal of consent at any time (e.g., push notifications, geolocation); lodge a complaint with the supervisory authority: President of UODO (Polish Data Protection Authority), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl.

8. Cookies

The Platform uses only cookies essential for operation: session cookies (authentication), language preference cookies, color theme cookies (light/dark). The Platform does not use advertising, tracking, or third-party analytics cookies.

9. Data Security

We apply the following security measures: encryption of data in transit and at rest; industry-standard password hashing; role-based access control system (RBAC) — 8 distinct roles; rate limiting on authentication endpoints; security headers (CSP, HSTS, X-Frame-Options); daily backups with geographic redundancy; multi-factor authentication (MFA). SHA-256 digital signatures ensure data integrity in the logbook, AFF modules, and instructor evaluations.

10. Data Breach

In the event of a personal data breach, the Service Provider will notify the supervisory authority (PUODO) within 72 hours, notify Users without undue delay, and take immediate remedial action. To report suspected security breaches: hubinet@proton.me (handled with priority).

11. Children's Data

The Platform is intended for persons aged 16 and over. We do not knowingly collect data from persons under 16 years of age. If the Service Provider determines that data of a person under 16 has been collected without the consent of a legal guardian, the data will be promptly deleted.

12. Changes to the Privacy Policy

Users will be notified of significant changes to the Privacy Policy with 14 days' advance notice. The current version of the Privacy Policy is always available at https://skydivelog.pro/privacy.

13. Contact

HUBICHEM — Hubert Wodnicki, NIP: 8571849862, Email: hubinet@proton.me, Web: https://skydivelog.pro