Air Taxi form data protection notice

Effective from 15 September 2026.

Controller and contact

The controller is Wekter Sp. z o.o. Spółka Komandytowa, ul. Św. Jerzego 1A, 50-518 Wrocław, Poland, tax identification number NIP 8971828697. For personal data enquiries, contact lo**@****************rs.eu.

Purposes and legal bases

We use contact details, proposed flight requirements and correspondence to handle your enquiry, clarify your needs and prepare an individual response or quotation. The form does not make a booking or take a payment; our team reviews the enquiry.

GDPR Article 6(1)(b) applies to processing necessary to provide the form service to you and take steps at your request before entering into a contract. When communicating with someone representing a company or another person, we rely on Article 6(1)(f): our legitimate interest in handling requested correspondence and business enquiries.

We also rely on Article 6(1)(f) to protect the form against spam and abuse and, only where necessary, retain information to clarify a response or quotation and handle specific legal claims. Submitting an enquiry does not subscribe you to a newsletter or constitute consent to marketing.

Recipients and technical services

Data is available to authorised people handling enquiries and providers of necessary technical services, including hosting, email, form security and tools supporting the organisation of enquiry handling, within the scope of their respective roles. We do not share data from this form with other aircraft operators.

Enquiries are handled in WordPress and through lo**@****************rs.eu. Hosting and email infrastructure use cyber_Folks/domeny.host services. Correspondence is retained in that mailbox and is also forwarded to the Gmail mailbox we use.

Google processes data under its Privacy Policy. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is the controller for processing of EEA users’ data covered by that policy.

Cloudflare, Inc. provides Turnstile bot protection. It processes technical signals, including IP address, browser and connection information. Cloudflare acts on the controller’s behalf to protect the form and as a separate controller to improve bot detection. Details and contact: Cloudflare’s Turnstile notice.

Transfers outside the EEA

Using Google and Cloudflare may involve processing outside the EEA, including in the USA. These providers describe applicable adequacy decisions, including the EU–US Data Privacy Framework for covered transfers, and standard contractual clauses where appropriate. Details and safeguards: Google, Cloudflare. You may request information about, or a copy of, the safeguards applicable to our process using the controller’s contact address.

Retention and reviews

For enquiries that do not lead to a contract, we retain data for as long as needed to handle the enquiry and delete identifying data no later than 90 days after closing it. We delete it earlier if there is no further need to retain it. This rule covers the WordPress enquiry record, correspondence in both mailboxes we use, and local copies and exports under our control. It does not mean deleting messages from a customer’s own mailbox.

We close an enquiry when its handling has definitively ended. If we are waiting for your reply, we close it 30 days after the last substantive message requiring a response, unless a later contact has been agreed. Automatic reminders do not extend this period. We review the continuing need to keep enquiries open every 90 days.

Our authorised team is responsible for classifying and closing enquiries and deciding on data deletion. Deadline monitoring supports this work but does not mean that data is deleted automatically.

Records needed for a contract, statutory obligations or a specific dispute are separated and retained only as necessary, using the periods and criteria applicable to that obligation or matter. This does not mean retaining all enquiries just in case.

Our adopted retention period for technical security data held by WEKTER is up to 30 days, or less if its purpose has been fulfilled. Evidence needed for a specific incident may be separated for the time needed to investigate it or handle related claims. Our authorised team reviews deadlines and deletes this data through a manual procedure; the reminder mechanism does not delete data itself.

Disaster-recovery copies are not used for day-to-day handling of closed enquiries. After restoration, we reapply approved deletions before resuming operations. Technical deletion from providers’ systems and backups is separate from deleting data from the mailbox or application we use and follows their cycles and legal obligations. We do not state a uniform 30-day limit for every provider-held copy. Details: Google’s retention practices and Cloudflare’s policy. You may contact the controller for information about other backups in our process.

Your rights

You may request access to and rectification of your data and, subject to GDPR conditions, erasure, restriction of processing and data portability. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. You may complain to the President of the Polish Personal Data Protection Office (UODO).

Providing data is voluntary. Fields marked as required are needed to receive and handle your enquiry; you cannot submit the form without them. Alternatively, contact us by email or telephone on +48 730 730 066. Please do not enter passwords, payment card details or information that is not needed for a quotation.

Use of the form is governed by the Air Taxi / charter enquiry form terms.