PL EN

FLAARE Privacy Policy

Last updated: 16 October 2026

This English version is provided for information purposes only. The legally binding version of this Policy is the Polish version. In the event of any discrepancy, the Polish version prevails.

1. Data controller

  1. The controller of personal data processed in connection with the flaare.pl website (the “Website”) and the FLAARE application (the “Application”) is Mikołaj Wachulski, conducting business under the name UAV Service Mikołaj Wachulski, Ojrzanowo 29, 89-210 Ojrzanowo, Poland, tax ID (NIP) 5621805694 (the “Controller”).
  2. Data-protection contact: kontakt@flaare.pl or by post to the above address.
  3. Division of roles. The Controller is the controller of the data of: persons contacting it through the Website, persons representing Customers, and Application User accounts to the extent necessary to provide and account for the service. However, personnel data and other personal data entered into the Application by a Customer’s organisation (e.g. pilot records, assignment of persons to flights, register entries) are processed by the Controller on the Customer’s behalf as a processor - the controller of such data is the Customer’s organisation, and the rules of entrustment are set out in § 11 of the Terms of Service. In matters concerning such data, data subjects should first contact their own organisation.

2. Scope of data processed and purposes

a) Contact form on the Website - organisation name, full name, e-mail address, optionally phone number, message content; in the short version of the form (e.g. reached via a QR code at events) only the e-mail address and, optionally, a phone number. The data is sent by e-mail to the Controller’s mailbox and is not saved in any Website database; after submitting the short form, an automatic confirmation e-mail is sent to the address provided. Purpose: handling the enquiry, arranging a demonstration, presenting an offer.

b) Application User accounts - e-mail address, full name, role in the organisation, technical account identifiers. Accounts are maintained in a login system operated by the Controller itself; passwords are stored in secured form only. Purpose: provision of the service, authentication, permission control, service-related communication (e.g. licence-expiry notifications).

c) Operational data in the Application (processed, as a rule, on the Customer’s behalf - see point 1.3): personnel and qualification data, flight logs together with GPS tracks and telemetry, live drone positions, the location of the KOL session coordinator (obtained from the browser with its consent - refusal only prevents starting a coordination session), DJI device log files, equipment photos, checklist entries and incident-register entries, the drone camera video in a live stream (started by the User, not recorded by the Controller).

d) Technical data - IP addresses, browser and device data, server logs. Purpose: security, diagnostics and infrastructure maintenance.

Providing data is voluntary but necessary, respectively, to handle an enquiry or to use the Application.

  • Article 6(1)(b) GDPR - performance of a contract or steps prior to entering into one (provision of access to the Application, handling sales enquiries);
  • Article 6(1)(c) GDPR - the Controller’s legal obligations (including tax and accounting obligations);
  • Article 6(1)(f) GDPR - legitimate interest: ensuring the security of the Website and the Application, establishing, pursuing or defending against claims, communication with persons representing Customers;
  • Article 6(1)(a) GDPR - consent, to the extent required (e.g. the contact form); consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal;
  • with respect to entrusted data - Article 28 GDPR (processing on the Customer’s behalf).

4. Data recipients and sub-processors

Data may be transferred to the following categories of recipients:

  • LH.pl - hosting of the Website and e-mail services (including contact-form messages and Application notifications);
  • Application infrastructure providers - the servers on which the Application and its databases are maintained, located in the European Union;
  • DJI - solely to the extent technically necessary to decrypt uploaded flight-log files: only encrypted key material extracted from the log file is sent to the DJI API; no flight data, tracks or User account data is transferred;
  • map-data providers - OpenStreetMap tile servers, Geoportal/GUGiK services (orthophoto, terrain data) and the Forest Data Bank operated by the Polish State Forests (forest overlays on maps): when maps are used, the IP address of the User’s device is transmitted to these providers as part of standard HTTP requests;
  • the Distributor (uStrażaka.pl) - to the extent necessary to handle orders and licences (as a separate controller of sales-related data);
  • the Video Provider - in the “FLAARE for services” edition, uStrażaka.pl Sp. z o.o., whose server receives the video directly from the drone’s controller and provides the player embedded in the Application. Recording and storage of the video take place on the side of uStrażaka.pl Sp. z o.o. under the terms of that entity’s streaming service; the Controller does not store the video and has no access to the recordings. In the “FLAARE Enterprise” edition the video server is operated by the Controller, without recording;
  • Google Ireland Limited - provider of the Google Tag Manager service used by the Website (see point 7): when a page loads, the browser fetches a script from Google’s servers, and that request transmits the device’s IP address and basic browser data;
  • entities providing accounting, legal and IT services to the Controller, and public authorities where required by law.

The Website and the Application are maintained on servers located in the European Union, and each organisation’s data is isolated from the others. Personal data is not transferred outside the European Economic Area, subject to three technical reservations: (a) when map tiles are loaded, the IP address of the User’s device reaches the servers of the OpenStreetMap Foundation, based in the United Kingdom - a country covered by a European Commission adequacy decision; (b) when logs are decrypted, only encrypted key material is sent to DJI servers, which contains no flight data and no data enabling the identification of individuals; (c) when the Google Tag Manager script is fetched, the IP address may be processed by Google LLC in the United States - on the basis of the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, in which Google LLC participates.

5. Retention periods

  • live drone positions (current telemetry) - up to 24 hours;
  • video from a live stream - not stored by the Controller; in the “FLAARE for services” edition the retention period of recordings is set out in the streaming service terms of uStrażaka.pl Sp. z o.o.;
  • uploaded DJI log files - up to 30 days from processing (log data feeds the Customer’s flight log);
  • account data and operational data - for the term of the agreement with the Customer and a transitional period after its end (30 days), after which they are deleted or returned to the Customer in accordance with the Terms, unless the law requires longer storage;
  • contact-form correspondence - up to 3 years from the end of contact;
  • billing data - for the periods required by tax and accounting law (as a rule, 5 years);
  • data necessary to establish or defend claims - until the expiry of limitation periods.

6. Data-subject rights

Every person has the right of: access to data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), objection to processing based on legitimate interest (Article 21), and withdrawal of consent. Requests may be sent to kontakt@flaare.pl.

Every person also has the right to lodge a complaint with the supervisory authority - the President of the Polish Personal Data Protection Office (PUODO) (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

With respect to data entered into the Application by a Customer’s organisation (point 1.3), requests are handled in cooperation with that organisation as the controller; the Controller, as processor, will forward the request to the relevant Customer.

The Controller does not take decisions concerning individuals based solely on automated processing, including profiling, that produce legal effects.

7. Cookies and local storage

  1. The flaare.pl website does not set tracking cookies and does not analyse visitor behaviour. Fonts are served from the Controller’s own server (no requests to external providers).
  2. The Website includes the Google Tag Manager script - a tool for managing tags on a website. The script starts with consent denied by default (Consent Mode: no consent for analytics, advertising, functionality or personalisation cookies), and no analytics or marketing tags are currently configured in the container. In this configuration Google Tag Manager sets no cookies and collects no data about activity on the Website; the only effect is the fetching of the script from Google’s servers described in point 4. Should the Controller enable analytics or marketing tools in the future, this Policy will be updated and a cookie-consent mechanism implemented before they are switched on.
  3. The Website may use the browser’s local storage (localStorage) solely for technical purposes, e.g. remembering the theme preference in the documentation.
  4. The Application uses only mechanisms technically necessary for its operation: session data and authentication tokens stored in the browser after login. Without them, logging in and using the Application is not possible.
  5. Because only strictly necessary mechanisms are used, the Website and the Application do not display a cookie-consent banner.

8. Data security

The Controller applies technical and organisational measures appropriate to the risk, in particular: encrypted data transmission (TLS), isolation of each organisation’s data, named accounts with roles and minimal permissions, one-time device-pairing codes, secure password storage in a dedicated authentication system, and infrastructure backups and monitoring.

  1. The Controller may update this Policy, in particular in the event of changes in the law, the scope of services or the providers used. The Controller announces material changes on the Website or in the Application; the date of the last update is shown at the beginning of the document.
  2. The Controller plans to continue the activity related to the Application within a capital company. If the enterprise or an organised part of it is transferred to a legal successor (in particular a newly established limited-liability company), the role of data controller, to the extent described in this Policy, will be taken over by that successor. Data subjects will be informed of the change of controller at least 14 days in advance, in accordance with § 13 of the Terms of Service.

10. Contact

For personal-data matters: kontakt@flaare.pl, phone +48 500 072 567, or in writing: UAV Service Mikołaj Wachulski, Ojrzanowo 29, 89-210 Ojrzanowo, Poland.

This Policy is effective as of 16 August 2026. Last amended: 16 October 2026 (points 2, 4 and 5 - video streaming and map data).