Privacy Policy

1. Data controller

The controller of personal data is INTER-DYWIZ SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, trading as FlyKRK, with its registered office in Kraków at ul. Bulwarowa 13A/2, 31-751 Kraków, Poland, entered in the National Court Register under KRS number 0000496661, NIP 6751496482, REGON 123040168.

Privacy enquiries may be sent to hello@flykrk.com. FlyKRK has not designated a Data Protection Officer in the current project configuration.

2. Personal data we collect

• Identity and contact details, including first name, last name, email address and telephone number.
• Journey details, including pickup and destination, date and time, passenger count, requested vehicle, return-transfer choice, flight number and notes supplied with the booking.
• Booking, price, fleet allocation, availability and payment-status records.
• Stripe Checkout Session and Payment Intent identifiers. FlyKRK does not receive or store full payment-card details.
• Communication records relating to bookings, changes, support or complaints.
• Technical and security information that may be recorded by hosting, database, email, mapping and payment providers, such as timestamps, IP address, request data, device/browser information and diagnostic logs.
• The booking form identifies optional fields. Providing the remaining requested customer and journey details is necessary to take steps at the customer’s request, create the booking and perform the transfer. Without those details, FlyKRK cannot accept or perform the booking.
• FlyKRK does not use booking data for automated decision-making, including profiling, that produces legal or similarly significant effects.

3. Why we use personal data and our legal bases

• To provide quotes, create and perform bookings, arrange transfers, communicate about pickup details and process requested changes: performance of a contract or steps requested before entering a contract (Article 6(1)(b) GDPR).
• To process payments and confirm paid bookings: performance of a contract (Article 6(1)(b) GDPR).
• To understand how visitors use the website and where they leave the booking process through Google Analytics 4: consent (Article 6(1)(a) GDPR).
• To measure Google Ads campaign effectiveness and, only when separately selected, permit ad-personalization consent signals: consent (Article 6(1)(a) GDPR).
• To prevent fraud, secure the service, diagnose faults and establish, exercise or defend legal claims: legitimate interests (Article 6(1)(f) GDPR).
• To keep tax, accounting and other records required by law: compliance with legal obligations (Article 6(1)(c) GDPR).
• To answer enquiries or complaints outside an existing contract: legitimate interests in customer service and dispute handling (Article 6(1)(f) GDPR), or pre-contractual steps where applicable.

4. Payments

Payments are handled on Stripe-hosted Checkout. Stripe receives payment and related technical information under its own privacy terms. FlyKRK stores payment identifiers and payment status needed to reconcile and perform the booking, but does not store card numbers or card security codes.

5. Customer communication

FlyKRK uses Resend to deliver transactional messages such as booking-received, availability and confirmation emails. These messages are necessary for the requested booking service. The website does not currently operate marketing email subscriptions or request marketing consent.

6. Recipients and processors

Personal data may be shared only as needed with drivers or transport subcontractors performing the transfer, professional advisers and public authorities where legally required.

• Stripe — payment processing and hosted Checkout.
• Resend — transactional email delivery.
• Neon — managed PostgreSQL database infrastructure.
• Vercel — application hosting, delivery and technical logs, where FlyKRK is deployed on Vercel.
• Mapbox — location search and route calculation. In the current implementation, FlyKRK’s server communicates with Mapbox; no Mapbox browser script is embedded.
• Google Tag Manager — consent-controlled delivery of configured measurement tags.
• Google Analytics 4 — consent-based website and booking-funnel analytics.
• Google Ads — consent-based advertising measurement and, only when separately chosen, ad-personalization signals.

7. International transfers

Some providers may process data outside Poland or the European Economic Area. Where GDPR requires safeguards, FlyKRK and its providers rely on an applicable adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism. Provider locations and safeguards may change, so their current privacy documentation should also be consulted. Information about the applicable safeguards, including how to obtain a copy where available, may be requested at hello@flykrk.com.

8. Retention

• Booking and contract records are kept for the period needed to perform the service and afterwards for applicable limitation periods and legal-claim handling.
• Invoices, payment evidence and accounting records are kept for the period required by tax and accounting law.
• Customer communications are kept while needed to administer the booking, resolve disputes and document service performance.
• Analytics and advertising-measurement data are kept according to the retention settings configured in the relevant Google service and are reviewed to avoid keeping them longer than needed for the stated purpose.
• Security and technical logs are retained for the shortest period reasonably necessary for security, diagnostics and provider operations, subject to provider retention settings.
• Email delivery events are retained while needed to prevent duplicates, retry failures and evidence delivery.
• When data is no longer required, it is deleted or anonymised unless continued retention is legally required.

9. Cookies, consent and local storage

FlyKRK uses a consent manager and Google Consent Mode v2. Analytics and advertising technologies are disabled by default and Google Tag Manager is not loaded until the visitor makes a choice permitting analytics or advertising measurement. Visitors can accept all optional categories, reject them, customize them and later withdraw or change consent through the permanent Cookie settings control in the footer.

With Analytics consent, Google Analytics 4 may use cookies such as _ga and _ga_* to distinguish visits and analyse the booking funnel. With Advertising measurement consent, Google Ads and tags delivered through Google Tag Manager may use first-party measurement storage such as _gcl_* and process advertising click identifiers supplied by Google. Ad personalization remains a separate optional choice. Exact cookies and lifetimes can depend on Google’s current tag configuration and browser controls.

Analytics events use only categorical journey information such as passenger, vehicle, route, lead-time, price and pickup-zone buckets, locale and display currency. FlyKRK does not send customer names, email addresses, telephone numbers, booking references, exact locations or coordinates, flight numbers, notes, or exact journey dates and times to Google as analytics event parameters. Page locations sent for analytics omit query strings and fragments.

Browser localStorage is used independently of optional analytics consent to remember the customer’s display-currency preference and the consent choice. These functional values are not used as customer identifiers and the currency preference does not change the authoritative PLN booking or payment amount. Essential platform or security technologies may be used by the hosting environment. Stripe may use cookies or similar technologies under its own policy on Stripe-hosted Checkout.

10. Your GDPR rights

• Access your personal data and receive a copy.
• Correct inaccurate or incomplete data.
• Request deletion or restriction where the legal conditions apply.
• Object to processing based on legitimate interests.
• Withdraw analytics or advertising consent at any time through Cookie settings, without affecting processing carried out before withdrawal.
• Receive data in a portable format where processing is automated and based on contract.
• Lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) or another competent supervisory authority.

11. Contact

To exercise your rights or ask a privacy question, email hello@flykrk.com. FlyKRK may need to verify identity before acting on a request.

12. Server-side purchase analytics

Only after Analytics consent, FlyKRK creates a random anonymous server-side analytics context in an HttpOnly cookie and may store pseudonymous Google Analytics client and session identifiers obtained through the Google tag. The cookie itself contains only the random context identifier. The context and identifiers expire after approximately 90 days of inactivity.

When Stripe verifies a paid booking, FlyKRK creates a durable, deduplicated purchase-measurement record containing only the authoritative PLN value and safe categorical journey metadata. When server-side measurement is enabled, that record is sent to Google Analytics 4 through Measurement Protocol only while the current Analytics consent remains granted. It never contains customer contact data, booking references, exact locations, coordinates or journey schedules.

Analytics is optional and non-essential to quotes, bookings, payment, confirmation and transactional emails. Withdrawing Analytics consent clears the Google identifiers and cancels unsent measurement records without changing any booking or payment state. FlyKRK does not use a direct Google Ads API conversion upload in this process.