Privacy policy

1. Data controller

The controller of personal data is PILOT Prosta Spółka Akcyjna with its registered office in Warsaw, Rondo ONZ 1, 00-124 Warszawa, Poland, branch office: ul. Opolska 110, 31-323 Kraków, entered in the register of entrepreneurs of the Polish National Court Register under KRS number 0001233166, NIP (tax ID) 5253085101, REGON 544401249 (the “Controller”).

Contact for all personal data matters: mail@pilot.place, tel. +48 511 359 802, or in writing to the registered office. The Controller has not appointed a data protection officer — given the scale and nature of processing, this is not required (Art. 37 GDPR).

2. What data we process and where it comes from

pilot.place is a purely informational website: it has no user accounts, no forms, and no newsletter sign-up. Personal data appears in two situations only:

• correspondence — if you contact us by e-mail or phone, we process the data you provide yourself: e-mail address, name, phone number, message content and data contained in attachments;
• infrastructure logs — the hosting provider automatically records standard technical request data (IP address, date and time, browser identifier) necessary to keep the website secure and reliable.

3. Purposes and legal bases of processing

• handling enquiries and correspondence — Art. 6(1)(f) GDPR (the Controller's legitimate interest: communicating with people who contact us);
• steps towards concluding or performing a contract, where the correspondence concerns one — Art. 6(1)(b) GDPR;
• ensuring the security and reliability of the website (technical logs) — Art. 6(1)(f) GDPR;
• establishing, pursuing or defending legal claims — Art. 6(1)(f) GDPR;
• compliance with legal obligations, in particular tax and accounting duties for concluded contracts — Art. 6(1)(c) GDPR.

4. Retention periods

• correspondence — for the duration of the matter and then no longer than 12 months after its conclusion, unless longer storage is necessary to establish, pursue or defend claims or is required by law;
• contractual and accounting documentation — for the periods required by law (as a rule, 5 years from the end of the tax year);
• technical logs — short-term, within the infrastructure provider's log rotation cycle.

5. Recipients of data

We entrust data only to processors acting on our instructions, to the extent necessary to run the website and handle correspondence:

• Vercel Inc. (USA) — website hosting;
• Migadu AG (Switzerland) — e-mail services;
• where justified: the Controller's legal, tax or accounting advisers — to the extent necessary for the given matter.

6. Transfers outside the EEA

The website is hosted by Vercel Inc., established in the USA — transfers take place on the basis of the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework and standard contractual clauses.

E-mail is provided by Migadu AG, established in Switzerland — a country covered by a European Commission adequacy decision.

7. Your rights

Every person whose data we process has the right to:

• access their data and obtain a copy (Art. 15 GDPR);
• rectification (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability — to the extent processing is based on a contract (Art. 20 GDPR);
• object to processing based on legitimate interest, on grounds relating to their particular situation (Art. 21 GDPR);
• lodge a complaint with the supervisory authority: the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa (uodo.gov.pl).

8. Voluntary provision of data

Providing data is voluntary. Without an e-mail address or phone number, however, we will not be able to reply to your message.

9. Cookies, analytics and profiling

The website uses no cookies or similar technologies, runs no traffic analytics and uses no marketing tools. We make no decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

10. Links to other websites

The website contains links to sites operated by separate controllers (including in the portfolio section). Data processing on those sites is governed by their own privacy policies.

11. Changes to this policy

The current version of this policy is always available at pilot.place. We announce material changes by publishing a new version with a new effective date.