Privacy Policy

📋 Quick Overview

1. General Information

SkyFlight d.o.o. (hereinafter: "SkyFlight") respects your privacy and is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and relevant data protection laws.

Last updated: November 10, 2026

2. What Data Do We Collect?

2.1 Technical Data (Automatic)

When you visit our website, the following technical data is automatically collected:

• IP address - used for security, abuse prevention, and traffic analysis
• Browser information (type, version, operating system, user agent)
• Date and time of visit
• Pages accessed and URL referrers
• Browser language settings

Legal basis: Legitimate interests (system security, website optimization)

Retention period: Maximum 90 days (server logs)

2.2 Cookies

Our website uses only essential technical cookies necessary for proper functionality:

• PH_HPXY_CHECK - technical cookie from hosting provider for traffic routing (HttpOnly, Secure, SameSite=Strict)
• gdpr-accepted - locally stores your consent (localStorage, not sent to server)

We DON'T use:

• Marketing cookies
• Analytics cookies (Google Analytics, Facebook Pixel, etc.)
• Third-party tracking cookies

Legal basis: Necessity for service provision (Art. 6(1)(f) GDPR)

2.3 Contact Form

When you use our contact form, we collect:

• Name - as entered in the form
• Email address - to contact you
• Message - your message text
• IP address - automatically recorded (for security and spam prevention)
• User Agent - browser information (to prevent bots and abuse)
• Date and time of submission

Legal basis: Your consent (by submitting the form) and legitimate interest (spam prevention)

Retention period: Up to 2 years or until deletion request

3. How We Use and Store Data

3.1 MySQL Database

All contact form data is stored in a MySQL database:

• Data: Name, email, message, IP address, user agent, date/time
• Location: Hosting server (Croatia or EU)
• Access: Only authorized persons (administrators)
• Security: Encrypted transmission (HTTPS), password-protected access

3.2 Telegram API - Notifications

When you submit a contact form, your data is automatically sent via Telegram API as a notification to the administrator.

Note: Telegram (Telegram Messenger Inc.) is a third party that processes data. We cannot control how Telegram further processes data, but we use Telegram only for internal notifications, not marketing.

4. Purpose of Data Processing

We process your personal data exclusively for:

• Responding to your inquiry - processing and answering contact form
• Technical website operation - ensuring availability and security
• Spam and abuse prevention - protection from bots, hacking, and spam
• Legal obligations - retaining data required by law
• Internal notifications - team alerts about new inquiries (via Telegram API)

We DON'T use your data for:

• Marketing or selling to third parties
• Automated decision-making or profiling
• Web behavior tracking (analytics)

5. Data Sharing with Third Parties

Your personal data will NOT be sold, rented, or shared with third parties for marketing purposes.

We share data only in the following cases:

• Hosting provider - technical data stored on hosting servers for service provision
• Telegram (Telegram Messenger Inc.) - contact data sent as notification (name, email, message)
• Legal obligations - if required by law or court order

6. Your Rights Under GDPR

Under GDPR, you have the following rights:

• Right to access - request a copy of all data we hold about you
• Right to rectification - request correction of inaccurate data
• Right to erasure ("right to be forgotten") - request deletion from our database
• Right to restriction - request processing restrictions in certain cases
• Right to object - object to data processing
• Right to portability - request data transfer to another controller (machine-readable format)
• Right to withdraw consent - withdraw at any time

6.1 How to Exercise Your Rights?

To exercise your rights or delete data from the database, contact us:

Please include:

• Your name and email used in the contact form
• What you want (data access, deletion, correction, etc.)
• Approximate date of message submission (if you remember)

6.2 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority:

7. Data Security

Your security is our priority. We implement multi-layered technical and organizational protection measures:

7.1 Encryption and Data Transmission

• SSL/TLS encryption (HTTPS) - all data transmitted encrypted
• Strict Transport Security (HSTS) - browser forced to use HTTPS only

7.2 Database Protection

• Prepared statements (SQL injection protection)
• Password-protected access
• Limited permissions - database user has minimum necessary privileges
• Regular backups - daily data backup

7.3 Abuse Protection

• Rate limiting - max 1 message per minute per IP (prevents spam)
• Input validation - verification and sanitization of all form data
• HTML escaping - XSS attack prevention
• Spam filter - automatic rejection of spam keywords
• Length limits - name: 255, email: 255, message: 5000 characters

7.4 Web Application Security

• Content Security Policy (CSP)
• X-Frame-Options - clickjacking protection
• X-Content-Type-Options - MIME type sniffing prevention
• Referrer Policy

7.5 Data Access

• Limited access - only authorized administrators
• Access logging - all database changes logged
• Physical security - server in secure data center with 24/7 monitoring

8. Data Retention Periods

• Contact messages (database): Up to 2 years or until deletion request
• Server logs (IP addresses): Maximum 90 days
• Technical cookies: Until browser close or 30 days
• Local settings (localStorage): Until deleted by user
• Telegram notifications: Remain in Telegram chat until manually deleted

9. Links to External Sites

Our website may contain links to external websites (e.g., reservations.com.hr, fitep.eu, bastion-scan.eu). We are not responsible for their privacy policies. We recommend reading their privacy policies.

10. Transparency and Accountability

We believe in complete transparency. Here's additional information:

10.1 What We DON'T Collect

Unlike many websites, we do NOT use:

• ❌ Google Analytics or any analytics service
• ❌ Facebook Pixel or other marketing trackers
• ❌ Third-party advertising cookies
• ❌ Social media tracking (unless you click on our social links)
• ❌ Fingerprinting technologies
• ❌ Automated profiling or machine learning on your data

10.2 Technical Storage Details

10.3 Who Has Access to Data?

Your data is accessible to:

• Website administrator - receives Telegram notifications and database access
• Hosting provider - technical server access (but doesn't actively read data)
• Telegram - receives data via API (name, email, message)
• No one else - data not shared with third parties

11. Privacy Policy Updates

We reserve the right to update this privacy policy. All changes will be published on this page with the last update date.

If significant changes affect data processing, we will notify you via:

• Website notification (banner)
• Email notification (if you have active communication with us)

We recommend reviewing this page periodically for any changes.