Privacy Policy of Delayed.pl
Data protection directives and technical ecosystem transparency statement.
1. General Provisions
The administrator of personal data collected via the Delayed.pl web service (hereinafter: 'Service') is VXN Marcin Gański, ul. Myśliwska 33F/125, 80-283 Gdańsk, Poland, registered in the Central Register and Information on Economic Activity (CEIDG).
Personal data processing is governed in strict accordance with GDPR (EU) 2016/679 and applicable domestic Polish data protection laws.
For inquiries regarding your personal information, contact the administrator directly at: support@delayed.pl.
2. Purposes, Legal Grounds, and Data Retention Terms
A. Registration and Account Maintenance
Purpose: Profile provisioning, session authorization, and access to core services (Logbook, Travel Map, Packing Lists, Budgets). Ground: Art. 6(1)(b) GDPR (performance of contract). Scope: e-mail, username, hashed password. Retention: Active account life span.
B. Operational Data & Travel Metrics Processing
Purpose: Flight logging, airtime calculations, Great-Circle arc path mapping, and multicurrency accounting. Ground: Art. 6(1)(b) GDPR. Scope: flight numbers, routes, carriers, expenses. Retention: Duration of data connection with the active profile.
C. Technical Notifications & Verification Handling (Sad Path)
Purpose: Secure PIN transmittals, resuming broken registration loops, and password resets. Ground: Art. 6(1)(b) and (f) GDPR (legitimate business interest). Retention: Technical code expiration window (maximum 15 minutes).
D. Performance & Traffic Analytics
Purpose: Traffic metrics auditing and UI tuning. Ground: Art. 6(1)(a) GDPR (explicit consent via the Cookie Preferences Panel). Scope: anonymized IP, Google Analytics 4 path logs. Retention: Cookie life span or until consent is revoked.
3. Data Processors & Proxy System Architecture
The Service architecture is containerized via Docker and deployed safely inside home.pl S.A. computing systems in Szczecin, Poland. Account storage and SMTP system automated notifications execute here. Google Analytics 4 (Google Ireland Limited) captures metrics only post-consent. Systems logging exceptions (AuthGatewayController) write exclusively to local secure machine files without third-party exposure.
4. Transfers Outside the EEA
User operational data resides strictly in the European Economic Area (Poland). Under explicit analytics activation, masked metrics route to Google LLC (USA) governed by Standard Contractual Clauses and the EU-US Data Privacy Framework.
5. Data Subject Rights
Users maintain full rights to access, rectify, or erase ('right to be forgotten') information, restrict processing, demand data portability, object, or withdraw consent at any moment via support@delayed.pl. You also retain the right to lodge formal complaints with the Polish Data Protection Officer (PUODO).
6. Cookie Policy Directives
The infrastructure triggers strictly necessary cookies (mg_auth_token persistence, next-intl localizers, theme parameters) and optional analytical blocks (Google Analytics). Performance engines load in passive text/plain shapes until opt-in occurs on the Cookie Banner.