Privacy policy

Short version: I use your details to answer your request and to work with you. No tracking; one technically necessary cookie only when you open a personal link; a newsletter only if you tick the box. Full version below.

1. Controller

The controller of your personal data is Mateusz Tomczak, Poland, e-mail mattomczak.vipfa@gmail.com. This policy follows Regulation (EU) 2016/679 (GDPR) and the Polish Act of 10 May 2018 on the Protection of Personal Data.

2. What I collect and why

• Request and availability forms: name, company, e-mail, phone, the content of your request (dates, route, airfield, aircraft, number of passengers, message). Purpose: to answer you, prepare a quote and, if you book, perform the service. Legal basis: steps prior to a contract and its performance (Art. 6(1)(b) GDPR) and my legitimate interest in following up on a request you made (Art. 6(1)(f)).
• Portfolio request: name, company, e-mail, phone and what you are looking for. Purpose: to call or message you about the request and to send you a private viewing link to the portfolio. Legal basis: Art. 6(1)(b) and (f) GDPR.
• Personal links to the member area and the portfolio: the link carries a digitally signed code with your name, e-mail address and the date it expires. When you open it, your browser keeps that code in a technically necessary cookie until the link expires, so the pages stay open for you; it is not used for tracking. Your name or e-mail address may appear on the content as a watermark, to protect it from being passed on. After an online payment for interview preparation, the thank-you page asks the server to check the payment with the payment provider and to issue your member link; the server reads your name and e-mail address from the payment and stores nothing. Legal basis: Art. 6(1)(b) and (f) GDPR.
• Stay-in-touch form and newsletter: e-mail and, if you leave it, phone. Purpose: to get back to you. If you tick the newsletter box, I also send occasional news about availability and services. Legal basis for the newsletter: your consent (Art. 6(1)(a) GDPR), which you withdraw at any time with one line by e-mail or the unsubscribe link; withdrawal does not affect what was sent before.
• Online payment (the price of the interview-preparation package or a booking fee): handled by the payment provider named on the payment page (Stripe), which is a separate controller for card and bank data; I receive confirmation of the payment, the amount, the reference and the booking details you entered (service, dates, name, phone). While you pay, your choice (service, dates, amount) is kept in your browser tab so that the thank-you page can show it; the page deletes it and nothing is sent anywhere with it. Legal basis: Art. 6(1)(b) and (c) GDPR (accounting).
• Correspondence by e-mail, phone, WhatsApp or LinkedIn: whatever you send me, for as long as the matter is open. On request we use end-to-end encrypted messengers with disappearing messages; binding arrangements are then confirmed by e-mail.
• Approximate location: when the site is served through a hosting provider's edge network, the airfield map may ask that network (not a third party) which town your connection appears to come from, to suggest the nearest airfields. Only a town-level estimate reaches the page, nothing is stored, and the precise-location button works only when you press it and your browser asks you first. Legal basis: my legitimate interest in a usable map (Art. 6(1)(f) GDPR).

3. Cookies and browser storage

The site keeps almost nothing in your browser, and nothing that follows you around the web.

• Cookies that are needed: the member area and the portfolio set a login cookie (mf_m, mf_p) when you open a personal link, so the pages stay open for you until the link expires; it is limited to those folders, invisible to scripts and not used for anything else. The hosting provider may set a short-lived security cookie of its own while it checks that a person, not a bot, is loading the page or paying.
• Browser storage (not cookies): the language and currency you chose, the music switch, a form you started but did not send and an order in progress while you pay, a note that the farewell message was shown, and your cookie choice itself. This is the page remembering what you asked it for; it stays in your browser, nothing is sent anywhere, and most of it is wiped when you close the tab.
• Visit statistics: when switched on, Cloudflare Web Analytics counts visits without cookies, without browser storage and without profiling, and only after you choose "Accept" in the cookie notice. "Only what is needed" keeps it off, as does not choosing at all.

Your choice is kept for 12 months; the "Cookies" link in the footer brings the notice back whenever you want to change it. You can also delete cookies and site data in your browser's settings at any time; the site keeps working, it only forgets your settings. I don't profile you and I make no automated decisions about you. The newsletter goes only to people who asked for it; everyone else hears from me only about the request they made, including availability relevant to it. If you'd rather I didn't, one line by e-mail is enough.

4. Who else sees the data

Only what is needed, only when needed: the hosting provider of this site (server logs incl. IP address, and its protection against attacks and bots, which when you pay or send a request may check technical data of your browser to confirm that a person is booking), the form service that delivers your request to my mailbox (when enabled), my e-mail provider, the payment provider, the newsletter tool (when enabled), the map service behind the airfield map (OpenFreeMap, Hyperknot Software Kft., Hungary: when the map loads, your browser fetches the map from its servers, which receive your IP address for that; it sets no cookies and deletes its logs after 7 days), and, once you decide to book, the pilot or air operator performing the flight (route, date, number of passengers and the lead passenger's name as required by law). Some providers process data outside the EEA under standard contractual clauses or an adequacy decision. The weather forecasts next to the booking calendar are fetched by this site's server from MET Norway (Norway) and NOAA (USA); it sends them only the approximate position and the codes of the airfields, none of your data.

5. How long

Requests that don't lead to a booking: up to 12 months after our last contact, then deleted. Bookings and contracts: for as long as tax and accounting law requires (in Poland, 5 years from the end of the tax year) and for the limitation period of claims. Newsletter: until you unsubscribe.

6. Your rights

Access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR), withdrawal of consent (Art. 7(3)), and the right to lodge a complaint with a supervisory authority (Art. 77): in Poland the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority in your country. Write to mattomczak.vipfa@gmail.com.

7. Changes

This version is dated 24 October 2026. If something changes, the date changes with it.