01Legal · Data Protection

Privacy Policy

Last updated · 2026-09-16

Section 01

Data Controller

The controller of personal data collected through this website (aviatec.pl) is:

AVIATEC

Addressul. Olszanska 7, 31-513 Krakow, Poland

NIP6772530250

Emailcommercial@aviatec.pl

Phone+48 793 774 310

In this Policy "we", "us" refers to AVIATEC; "you" or "User" refers to a person visiting or using the website.

Section 02

Definitions

GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.
Personal data — any information relating to an identified or identifiable natural person.
Processing — any operation performed on personal data (collection, storage, use, deletion).
Cookies — small text files stored on the User's device when using a website.

Section 03

Data Protection Officer

Pursuant to Article 37 GDPR, AVIATEC has not appointed a Data Protection Officer. For all matters concerning the processing of personal data, please contact us at commercial@aviatec.pl.

Section 04

What Data We Process

Through the contact form: company name (optional), email, message content, phone number (optional).

Through the newsletter subscription form: email.

Automatically for technical reasons: IP address and server logs (date/time, URL, user-agent, referrer). The website sets no cookies of its own (Section 11).

When you open the Contact page, the Google map embedded there transmits technical data about your device to Google — see Section 12.

Providing data is voluntary. Email and message content are required for us to respond; for the newsletter — email and consent.

Section 05

Purposes and Legal Bases (GDPR)

Purpose	Legal Basis
Responding to inquiry / pre-contractual contact	Art. 6(1)(b) GDPR
Business correspondence	Art. 6(1)(f) GDPR — legitimate interest
Newsletter (by subscription)	Art. 6(1)(a) GDPR — consent
Website security and log analysis	Art. 6(1)(f) GDPR — legitimate interest
Showing the location of our office on an embedded map (Contact page)	Art. 6(1)(f) GDPR — legitimate interest
Compliance with legal obligations	Art. 6(1)(c) GDPR

Additionally for users in Poland: Polish Personal Data Protection Act of 10 May 2018 and the Polish Act of 18 July 2002 on the provision of services by electronic means.

Section 06

If you subscribe to our newsletter through the form on the website — this is voluntary and based on your explicit consent (Art. 6(1)(a) GDPR; Art. 10 of the Polish Act of 18 July 2002). The consent checkbox is never pre-ticked.

We send only AVIATEC content: new products, services, industry updates. Consent can be withdrawn at any time via the unsubscribe link in any email or by writing to commercial@aviatec.pl. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. After unsubscription, the email is removed from the active list within 30 days.

Section 07

Data Sharing

Data may be shared with:

Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) — hosting provider: the website runs on a server in Hetzner's data centre in Helsinki, Finland (European Union), with a data processing agreement in place
Hostinger International Ltd — provider of business email, with a data processing agreement in place
Google Ireland Limited and Google LLC — providers of the map embedded on the Contact page (Section 12)
Public authorities when required by applicable law

We process data within the European Economic Area (EEA). The one transfer outside the EEA that this website involves is described in Section 12: data the embedded Google map sends to Google may be processed by Google LLC in the United States, under the EU-US Data Privacy Framework and, where it does not apply, Standard Contractual Clauses (SCC) approved by the European Commission.

We do not sell personal data and do not share it with third parties for their own marketing purposes.

Section 08

Data Retention

Data Type	Retention Period
Contact form	Up to 12 months from last contact
Newsletter	Until consent is withdrawn + 30 days
Server logs	Up to 90 days
Business correspondence	Duration of the business relationship + 6 years
Accounting data	As required by law (typically 5 years)

After the retention period ends, data is deleted or anonymised.

Section 09

Your Rights

Under GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), object to processing based on legitimate interest (Art. 21), withdraw consent (Art. 7(3)).

To exercise your rights: commercial@aviatec.pl. We respond within one month of receiving the request (Art. 12(3) GDPR). You also have the right to lodge a complaint with the Polish supervisory authority UODO.

Section 10

No Profiling

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. All decisions concerning you are made by humans.

Section 11

Cookies

This website sets no cookies of its own. The only thing it writes to your browser is one entry in local storage (avt-cookie-notice) that remembers you have closed the cookie notice; it contains no personal data and is never sent anywhere.

The Google map embedded on the Contact page may set Google's own cookies when that page is opened (Section 12). We do not use analytics, advertising or marketing cookies. For details, see our Cookies Policy.

Section 12

Embedded Google Maps on the Contact Page

The Contact page embeds an interactive Google map showing the location of our office. It loads from Google as soon as the page opens.

When the map loads, your browser connects directly to Google's servers, and Google receives: your IP address; browser and device data (browser type and version, language, screen size, operating system); the address of the page you opened the map from (aviatec.pl/contact); and, if you use the map, your interaction with it (zooming, dragging, clicks). Google may also read and set its own cookies (Cookies Policy, Section 03). We receive none of this data from Google.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for data processed in the United States, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google processes this data as an independent controller, for its own purposes, described at policies.google.com/privacy.

Purpose and legal basis: showing visitors where our office is — our legitimate interest under Art. 6(1)(f) GDPR in presenting our location in a convenient, interactive form. You may object to this processing (Section 09); the simplest way is not to open the Contact page: our address, e-mail and telephone number are in the footer of every page.

Transfer outside the EEA: Google may transfer data to the United States. Google LLC is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023); where the Framework does not apply, the transfer relies on Standard Contractual Clauses approved by the European Commission.

Retention: determined by Google in accordance with its own policies; we hold none of this data.

Section 13

Security

We apply appropriate technical and organisational measures: HTTPS/TLS encryption for all data transmission, access controls, data minimisation, and secure hosting infrastructure with a data processing agreement.

Section 14

Changes and Contact

We may update this Policy. The "Last updated" date at the top of the page indicates when the policy was last revised.

For privacy matters: