MAGNIFLY SEARCH PRIVACY POLICY
version of 1 November 2026
Courtesy translation. The Polish text at /pl/prywatnosc is the binding version (Terms § 11(2)); in case of discrepancy the Polish text prevails.
1. Controller. The controller of personal data is Mateusz Tomczak, trading under the MagniFly brand (registration details: [NIP (tax identification number), address], hereinafter “MagniFly”). Contact: concierge@magnifly.services.
2. Scope of data. We process the data provided in the Platform’s forms (full name, company, e-mail address, telephone number, country, content of the message, role), data on the acceptance of documents (version and hash of the document, date and time, hash of the IP address, browser), data on the use of the Platform (enquiries, offers, listings, correspondence), e-mail correspondence sent to MagniFly addresses and to the addresses of the Platform’s brokers (sender, recipients, subject, content, names of attachments; the attachments themselves go to the recipient’s mailbox), call notes and organisation cards kept by brokers (who decides, needs related to the carriage, objections, preferences), operators’ documents (certificate and policy numbers, expiry dates, scans), correspondence an external broker forwards to its mailbox address in the Platform, data of people in MagniFly’s crew pool (name, role, licence and type ratings, base, languages, rate, contact details, busy days), login data (a hash of the session token, the kind of device, the country the login came from, a hash of the IP address, the passkey’s public key), a change log (who changed what and when) and passenger data provided by the User for the purpose of arranging carriage (full name, nationality, travel document details).
3. Purposes and legal bases. (a) Conclusion and performance of a contract, including settlements and the handling of enquiries – art. 6(1)(b) of the GDPR (Regulation (EU) 2016/679); (b) compliance with legal obligations, in particular tax and accounting obligations – point (c); (c) the controller’s legitimate interest: maintaining business contacts with representatives of businesses, direct marketing of its own services, pursuing and defending claims, security of the Platform (including protection against the sharing of personal accounts) – point (f); (d) consent, where given (e.g. to telephone contact concerning offers) – point (a); consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.
4. Recipients. Operators and brokers to the extent necessary to arrange carriage (correspondence forwarded to an external broker’s mailbox address is seen only by that broker, MagniFly processes it as a processor on the broker’s behalf and uses from it only aggregate figures; data of people in the crew pool is not passed to operators without that person’s consent to a specific proposal), e-mail and hosting providers (including Cloudflare and Resend), payment service providers, legal and accounting advisers, and authorities entitled under the law. Data may be transferred to third countries only on the basis of a European Commission adequacy decision or of standard contractual clauses.
5. Retention period. Contact data and acceptance data – for the term of the contract and the limitation period for claims (as a rule 6 years from the end of the year in which the contract terminated); settlement data – 5 years from the end of the tax year; passenger data – until the journey is completed and the carriage settled, no longer than 12 months, unless longer retention follows from the law; data processed on the basis of consent – until it is withdrawn. E-mail correspondence in the Platform – 24 months from receipt; the change log – 12 months; login sessions – up to 30 days after expiry; the request counter protecting against abuse – 1 day; backups – 30 days; operators’ documents – for the term of cooperation and the limitation period for claims; data of people in the crew pool – until removal from the pool, at that person’s request or when cooperation ends. After these periods the data is deleted automatically.
6. Rights. The right of access to the data, to rectification, erasure, restriction of processing and data portability, the right to object to processing based on legitimate interest (including to direct marketing – at any time), and the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). Requests: concierge@magnifly.services.
7. Voluntary provision. Providing data is voluntary but necessary to obtain access to the Platform and to conclude a contract. The Platform does not take decisions based solely on automated processing which produce legal effects.
8. Cookies and browser storage. The Platform stores in the browser only what is necessary for its operation: a random session token (the access key is not stored in the browser), preferences for appearance, units and currency, and the selected role; it uses no third-party analytics or advertising tools. Passkey login (Face ID, fingerprint, Windows Hello): the private key stays on the user’s device and the Platform stores only the public key; biometric data never leaves the device and never reaches the controller.
9. Erasure on request. A person whose data appears in correspondence, notes or organisation cards may request its erasure at concierge@magnifly.services; we then delete their correspondence, notes and entries and confirm it, except for data we must keep under the law.