Privacy Policy and Personal Data Protection

1. The controller of personal data is the "Lotnicze Marzenia" Foundation, based in Grodzisk Mazowiecki, entered into the Register of Associations, Other Social and Professional Organisations, Foundations and Independent Public Healthcare Institutions of the National Court Register, hereinafter referred to as the "Foundation" or the "Controller".
2. For matters concerning the protection of personal data, the Controller can be contacted:
   • – e-mail: kontakt@lotniczemarzenia.pl
   • – by post: to the registered address of the Foundation
3. The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), the Polish Personal Data Protection Act of 10 May 2018, and other applicable laws.

The Controller processes personal data for the following purposes and on the following legal bases:

1. PARTICIPATION IN THE FOUNDATION'S EDUCATIONAL PROGRAMMES (Young Pilot Academy, Eco-Aviation Zone, Aviation Competitions, Aviation Village and others)
   • – Scope of data: participant's first and last name, age, class/school, parent's/legal guardian's first and last name, contact phone number, e-mail address, health information relevant to safety (for programmes involving flights)
   • – Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (performance of an agreement/participation regulations), Art. 6(1)(f) GDPR (legitimate interest of the Controller — ensuring participants' safety)
   • – For underage participants, consent is given by parents or legal guardians
2. AVIATION SCHOLARSHIP — APPLYING FOR TRAINING FUNDING
   • – Scope of data: first and last name, date of birth, place of residence, phone number, e-mail address, information about financial situation, information about previous aviation experience, motivation, details of the aviation school
   • – Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (steps prior to entering into a scholarship agreement)
3. VOLUNTEER REGISTRATION
   • – Scope of data: first and last name, date of birth, place of residence, phone number, e-mail address, information about qualifications and experience, PESEL number (only when required for the conclusion of a volunteer agreement under the Polish Act of 24 April 2003 on Public Benefit and Volunteer Activity)
   • – Legal basis: Art. 6(1)(b) GDPR (performance of the volunteer agreement), Art. 6(1)(c) GDPR (legal obligation under the Volunteer Act)
4. COLLECTION OF DONATIONS AND PAYMENTS
   • – Scope of data: donor's first and last name or business name, e-mail address, transfer details (to the extent provided by the payment operator), donation amount, and — for tax-deductible donations — data necessary to issue a confirmation
   • – Legal basis: Art. 6(1)(b) GDPR (performance of the donation agreement), Art. 6(1)(c) GDPR (tax and accounting obligations)
5. NEWSLETTER AND MARKETING COMMUNICATIONS
   • – Scope of data: e-mail address, optionally first name
   • – Legal basis: Art. 6(1)(a) GDPR (consent). The consent also covers consent to receive commercial information by electronic means (Art. 10 of the Polish Act of 18 July 2002 on Providing Services by Electronic Means) and consent to use telecommunications terminal equipment for direct marketing (Art. 172 of the Polish Telecommunications Act of 16 July 2004)
   • – Consent may be withdrawn at any time by clicking the unsubscribe link in the e-mail or by contacting the Controller
6. APPLICATIONS FROM SCHOOLS AND MUNICIPALITIES TO THE FOUNDATION'S PROGRAMMES
   • – Scope of data: name of the school/institution, contact person's first and last name, position, phone number, e-mail address, address of the school/institution
   • – Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract), Art. 6(1)(f) GDPR (legitimate interest — handling the application)
7. RECORDING AND DISSEMINATION OF IMAGES AT EVENTS
   • – Scope of data: images (photographs and video recordings) of participants of events organised by the Foundation
   • – Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with Art. 81 of the Polish Act of 4 February 1994 on Copyright and Related Rights
   • – The consent covers the recording and dissemination of images in the Foundation's information, promotional and reporting materials, including on the website, on social media, in printed materials and in activity reports
   • – For underage individuals, consent is given by parents or legal guardians
   • – Consent to use the image is voluntary — refusal does not preclude participation in the event
   • – Pursuant to Art. 81(2) of the Copyright Act, no permission is required to disseminate the image of a person who is merely a detail of a whole, such as a gathering, landscape or public event
8. CONTACT FORM AND CORRESPONDENCE
   • – Scope of data: first and last name, e-mail address, phone number (optional), message content
   • – Legal basis: Art. 6(1)(f) GDPR (legitimate interest — handling enquiries)
9. OPERATION OF SOCIAL MEDIA
   • – Scope of data: public profile data of the user, content of comments and messages
   • – Legal basis: Art. 6(1)(f) GDPR (legitimate interest — conducting communication and promoting statutory activity)
   • – The Controller is a joint controller of personal data together with the operator of the relevant social media platform (Facebook/Meta, Instagram, YouTube, LinkedIn) to the extent set out in the rules of those platforms
10. ARCHIVING, STATISTICAL AND REPORTING PURPOSES
    • – Legal basis: Art. 6(1)(c) GDPR (legal obligation — foundation reporting), Art. 6(1)(f) GDPR (legitimate interest — documenting statutory activity)

1. Data of participants of educational programmes — for the duration of the programme and for 3 years after its completion (limitation period for claims).
2. Data of Aviation Scholarship candidates — for the duration of the recruitment and assessment process; if the scholarship is granted — for the duration of the training and 5 years after its completion. Data of candidates who were not granted a scholarship — 6 months from the end of the recruitment process.
3. Volunteers' data — for the duration of cooperation and 3 years after its completion.
4. Donors' data — for the period required by tax and accounting laws (5 years from the end of the tax year).
5. Newsletter subscribers' data — until consent is withdrawn.
6. Data from school and municipality applications — for the duration of cooperation and 2 years after its completion.
7. Images — indefinitely or until consent is withdrawn, provided that withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Materials already published (printed, archival) may not be possible to remove for technical reasons — in such cases, the Controller will cease further dissemination.
8. Data from the contact form — 12 months from the last contact, unless the correspondence leads to cooperation (in which case the appropriate period for the relevant category applies).

1. Personal data may be transferred to the following categories of recipients:
   • entities processing data on behalf of the Controller under data processing agreements: hosting providers, newsletter platform providers, online payment operators, accounting office, providers of analytical tools
   • state authorities pursuant to applicable law (tax authorities, supervisory bodies)
   • aviation schools — only to the extent necessary to administer the Aviation Scholarship and only with the scholarship holder's consent
   • insurers — to the extent necessary to conclude an insurance policy for participants of programmes involving flights
2. The Controller does not sell personal data to third parties.
3. The Controller does not transfer personal data to third countries (outside the European Economic Area), with the exception of using technology providers (e.g. Google, Meta) which may process data on servers outside the EEA on the basis of standard contractual clauses or European Commission adequacy decisions.

1. Every individual whose data is processed by the Controller has the right to:
   • access their data (Art. 15 GDPR)
   • rectification of data (Art. 16 GDPR)
   • erasure of data — the "right to be forgotten" (Art. 17 GDPR)
   • restriction of processing (Art. 18 GDPR)
   • data portability (Art. 20 GDPR)
   • object to processing based on the legitimate interest of the Controller (Art. 21 GDPR)
   • withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR)
2. To exercise the above rights, please contact the Controller by e-mail at: kontakt@lotniczemarzenia.pl or in writing to the registered address of the Foundation.
3. The Controller will respond to requests without undue delay, no later than one month from receipt of the request. For complex requests, the deadline may be extended by a further two months, of which the Controller will inform the requesting person.
4. Every individual has the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl) if they consider that the processing of their data infringes the GDPR.

1. CONSENT FOR PARTICIPATION IN AN EDUCATIONAL PROGRAMME AND USE OF IMAGE (for parents/guardians of an underage person):

   "I consent to my child [first and last name] participating in the [programme name] organised by the 'Lotnicze Marzenia' Foundation. I declare that I have read the programme regulations and the Foundation's Privacy Policy.

   ☐ I consent to the recording and free dissemination of my child's image captured during the event in the Foundation's information, promotional and reporting materials, including on the website, on social media and in printed materials.

   ☐ I do not consent to the recording and dissemination of my child's image. (Lack of consent does not preclude participation in the programme.)"

2. CONSENT FOR PARTICIPATION IN AN EVENT AND USE OF IMAGE (for adults):

   "I declare that I have read the Privacy Policy of the 'Lotnicze Marzenia' Foundation and consent to the processing of my personal data for the purpose of participating in [name of event/programme].

   ☐ I consent to the recording and free dissemination of my image captured during the event in the Foundation's information, promotional and reporting materials.

   ☐ I do not consent to the use of my image."

3. NEWSLETTER CONSENT:

   "I consent to receiving from the 'Lotnicze Marzenia' Foundation information about the Foundation's activities, programmes and events by electronic means at the e-mail address provided, in accordance with the Act on Providing Services by Electronic Means. I am aware that I may withdraw my consent at any time."

4. CONSENT TO PROCESSING OF DATA IN THE SCHOLARSHIP RECRUITMENT PROCESS:

   "I consent to the processing of my personal data contained in the application form by the 'Lotnicze Marzenia' Foundation for the purpose of carrying out the recruitment process for the Aviation Scholarship programme. I declare that I have read the Foundation's Privacy Policy and the information about my rights."

1. The Foundation's website uses cookies — small text files stored on the user's device.
2. The Foundation uses the following types of cookies:
   • necessary — required for the proper functioning of the website, do not require consent
   • analytical — used to analyse traffic on the website (e.g. Google Analytics) — require user consent
   • marketing — used to display personalised content (e.g. social media pixels) — require user consent
3. The user can manage cookie settings via the cookie banner displayed on the first visit to the website or in the browser settings.
4. When using Google Analytics, data may be transferred to Google LLC. The Foundation uses the IP-anonymisation feature.
5. Detailed information about cookies used on the website is available in the cookie settings panel.

1. The Controller applies appropriate technical and organisational measures to protect the personal data being processed, in particular:
   • encryption of data transmission (SSL/TLS certificate)
   • access control to data — access is granted only to authorised persons
   • regular backups
   • training of persons with access to personal data
2. The Controller maintains a record of personal data processing activities in accordance with Art. 30 GDPR.

The Controller does not apply automated decision-making, including profiling, as referred to in Art. 22(1) and (4) GDPR.

1. The Foundation processes personal data of underage individuals only with the consent of their parents or legal guardians.
2. In the case of information society services (e.g. newsletter) directed directly at a child, the processing of the child's personal data is lawful where the child is at least 16 years old. Below this age, consent of a parent or legal guardian is required (Art. 8 GDPR in conjunction with Art. 7 of the Polish Personal Data Protection Act).

1. The Controller reserves the right to make changes to this Privacy Policy in the event of changes to the law, changes to the Foundation's activities or technological changes.
2. The Controller will notify of material changes by publishing the updated version on the website. Newsletter subscribers will also be notified by e-mail.
3. The date of the last update is always shown at the top of the document.

All questions, concerns and requests regarding the protection of personal data should be directed to: kontakt@lotniczemarzenia.pl