Privacy Policy
1. Who Controls Your Data
The data controller is ENDAXI CZ s.r.o., registered office at Dlouhá třída 1146/95, Havířov, 736 01, Czech Republic, IČO: 26809869 (the "Controller", "we"). We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Czech law.
2. What We Collect
- Account data: name, username, email address, a securely hashed password (we never see or store it in plain text), the clubs you belong to and your role in each, subscription tier and status, and the date you accepted these Terms.
- Flight and operational data: logged flights (aircraft, pilot, instructor, timings, tow pairings, notes), aircraft records, and any flight templates you save.
- Billing data: for a club that has a paid subscription, its company name, company/tax identification numbers, billing address, and phone number, plus a reference ID linking the club to our payment processor (Stripe) - we do not store card numbers ourselves; Stripe handles and stores payment card details directly.
- Preferences: things like your dashboard's custom aircraft ordering, manually highlighted airspace zones, and whether you opted into our newsletter.
- Security tokens: short-lived tokens used for actions like email verification or password resets, along with when they were issued and when they expire.
- Technical data: standard web server logs (such as IP address and browser information) generated automatically as part of running the Service securely.
3. Why We Process It, and On What Basis
- To provide the Service (account data, flight/operational data): necessary for performance of the contract between us and you or your club (GDPR Art. 6(1)(b)).
- To bill your subscription (billing data): necessary for performance of the contract, and to meet our own accounting/tax obligations (Art. 6(1)(b) and (c)).
- To keep accounts secure (security tokens, technical logs): our legitimate interest in operating a secure service (Art. 6(1)(f)).
- To send you our newsletter: only where you've opted in, based on your consent (Art. 6(1)(a)), which you can withdraw at any time.
4. How Long We Keep It
We keep account and flight data for as long as your account or club remains active, since a club's flight log is meant to be a continuous record. Billing records are kept for the period required by Czech accounting and tax law (generally several years) even after a subscription ends. Security tokens are deleted automatically once used or expired. If you ask us to delete your account, we'll remove personal data that we're not otherwise required to keep for legal or accounting reasons.
5. Who We Share It With
We don't sell personal data. We share it only where necessary to run the Service: our payment processor (Stripe) for billing and subscription management, and our hosting provider for running the application and storing backups. These providers only process data on our instructions and under appropriate data-processing agreements.
Open Glider Network (OGN): the live traffic shown on the map comes from OGN, a public, community-run tracking network, not from us. We don't send your personal account details to OGN. If your aircraft carries a FLARM/OGN-compatible tracker, its position is already public on that network independently of Prostagma.
6. International Transfers
Some of our service providers (including Stripe) may process data outside the European Economic Area. Where that happens, we rely on the safeguards recognized under GDPR for such transfers, such as the European Commission's Standard Contractual Clauses.
7. Your Rights
Under GDPR, you have the right to access the personal data we hold about you, request that inaccurate data be corrected, request erasure ("right to be forgotten") where it doesn't conflict with a legal retention obligation, restrict or object to certain processing, request a portable copy of your data, and withdraw consent (e.g. to the newsletter) at any time without affecting processing already carried out. To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), or with the supervisory authority in your own EU member state.
8. Security
Passwords are hashed before storage - nobody at Prostagma, including club Administrators, can see your actual password. We run daily backups to reduce the risk of data loss. No system connected to the internet can be guaranteed 100% secure, and we can't promise protection against every possible attack, but we take reasonable, industry-standard steps to protect your data.
9. Changes to This Policy
We may update this Privacy Policy from time to time, for example to reflect a new feature or a change in the law. We'll post the updated version here with a new effective date; if a change is material, we'll make a reasonable effort to let you know.
10. Contact
Questions about this Privacy Policy, or requests relating to your personal data, can be sent to [email protected].