Privacy Policy

Version 1.1 · Effective 11 September 2026 · Operated by Dutch Aviation Services Sp. z o.o. (90-369 Łódź, Poland)

This Privacy Policy explains how Dutch Aviation Services Sp. z o.o. (“we”, “us”, “the Controller”) collects, uses, stores and protects personal data of users of the mywingman.eu website and recipients of MyWingman services.

This Policy is issued in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”, known in Poland as “RODO”) and the Polish Personal Data Protection Act of 10 May 2018.

1. What data we collect

We collect and process personal data in several contexts depending on how you interact with MyWingman and which services you use.

(a) When you visit our website

We may process standard technical and server-log data, including:

• IP address;
• browser and device type;
• pages visited;
• referring URL;
• date and time of access; and
• other technical information necessary for website security and operation.

This information is processed for website security, fraud prevention, troubleshooting and aggregate analytics purposes.

Standard server-log data is retained for up to 12 months.

Cookies and similar technologies are used as described in our Cookie Policy.

Analytics and advertising cookies. Only if you choose “Accept all” in our cookie banner, we use Google Analytics (Google Ireland Limited) to understand how the website is used, and the Meta Pixel (Meta Platforms Ireland Limited) to measure and improve our advertising on Facebook and Instagram, including showing our adverts to people who have visited the website. The legal basis is your consent under Article 6(1)(a) GDPR. If you choose “Essential only”, these tools are not loaded. For the collection and transmission of data through the Meta Pixel, we and Meta Platforms Ireland Limited act as joint controllers; Meta’s further processing is described in Meta’s own privacy policy. Google and Meta may process data outside the European Economic Area, as described in the section on international transfers. When you choose “Accept all”, your consent choice is also passed to Google as a consent signal covering advertising storage, advertising identifiers and personalised advertising, so that measurement respects your choice. If we begin advertising through Google Ads, Google Ireland Limited acts as joint controller with us for the resulting advertising measurement under Article 26 GDPR, on the terms Google publishes; no advertising cookie is set unless you have accepted advertising cookies. You can withdraw your consent at any time, as explained in our Cookie Policy.

(b) When you contact us or place an order

Depending on the service and method of contact, we may collect:

• your name and surname;
• email address;
• telephone number;
• nationality, where relevant to the requested service;
• billing and invoicing information;
• information about the service you have selected;
• information about your professional background, goals or timeline;
• information you voluntarily provide in correspondence or contact forms; and
• records of any consent or declarations provided by you, including relevant timestamps and technical information where applicable.

We process only information reasonably necessary to respond to your enquiry, administer your order and provide the requested service.

(c) When you receive a MyWingman service

The categories of data processed depend on the service.

For aviation psychology, psychological or psychometric assessment services, we may process:

• identification and contact information;
• professional and aviation background;
• pilot qualifications, licences, ratings and training information where relevant;
• employment and operational experience;
• psychometric assessment responses;
• psychometric scores and profiles;
• cognitive assessment results;
• personality and behavioural assessment information;
• competency-related information;
• information provided during an assessment interview;
• professional observations made by the psychologist;
• assessment notes;
• interview recordings or transcripts, where you consent to recording or transcription;
• assessment conclusions and recommendations;
• assessment certificates;
• assessment reports; and
• correspondence concerning the assessment.

Special category data – Article 9 GDPR

Certain MyWingman services, particularly psychological and psychometric assessments, may involve the processing of information concerning psychological characteristics, behavioural tendencies, wellbeing or other information that may constitute special category personal data within the meaning of Article 9 GDPR.

Where special category personal data is processed as part of a psychological or psychometric assessment, we rely primarily on your explicit consent under Article 9(2)(a) GDPR.

Where necessary, special category data may also be processed for the establishment, exercise or defence of legal claims under Article 9(2)(f) GDPR.

Before beginning an assessment involving special category personal data, you will be informed about the relevant processing and asked to provide explicit consent where consent is the applicable legal basis.

You may withdraw your consent at any time by contacting us.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Withdrawal may also not require deletion of information that we are required or permitted to retain under another applicable legal basis, including where necessary for the establishment, exercise or defence of legal claims.

Where withdrawal of consent makes it impossible to continue a psychological or psychometric assessment lawfully or professionally, we may be unable to complete the service or issue assessment documentation.

Recording and transcription of assessment interviews

Where a MyWingman service includes an online psychological or psychometric assessment interview, the interview may, with your consent, be recorded or transcribed to support:

• accurate note-taking;
• professional assessment;
• integration of interview evidence with psychometric results;
• interpretation of assessment findings;
• preparation of assessment documentation;
• quality assurance; and
• professional review where required.

Recording and transcription are used as auxiliary professional documentation tools. They do not replace the professional judgement of the aviation psychologist.

Assessment conclusions and recommendations are made by a qualified professional based on the assessment evidence as a whole.

Recordings and transcripts are used solely for purposes directly related to conducting, documenting, reviewing and quality-assuring the assessment. They are not used for training, marketing or advertising purposes.

Recordings and transcripts do not form part of the assessment certificate or final assessment report and are not provided to a current or prospective employer or to a flight school.

Recordings and transcripts may contain personal data and may contain special category personal data. They are therefore handled in accordance with the safeguards described in this Privacy Policy.

Access to recordings and transcripts is restricted to persons who require access for the purpose of conducting, documenting, reviewing or administering the assessment and to authorised technology providers acting on our behalf where technically necessary.

Before the interview, we explain by email that the interview may be recorded or transcribed and ask whether you consent. You are reminded of this at the start of the session. The interview is recorded or transcribed only with your consent. You may decline, or withdraw your consent at any time, without any negative effect on the assessment or its outcome.

Recordings and transcripts are retained only for as long as reasonably necessary to complete the assessment, prepare the relevant documentation, undertake appropriate quality assurance and address any immediate professional review requirements. They are subsequently securely deleted unless longer retention is necessary to establish, exercise or defend legal claims or is otherwise required by applicable law.

Psychometric assessment platform

Where psychometric assessment is delivered through the ADAPT platform, the platform is provided by Symbiotics Ltd, United Kingdom, an aviation assessment provider.

Symbiotics processes assessment data on our behalf under appropriate data-processing arrangements.

Personal data provided to the assessment platform is limited to information necessary to administer and complete the relevant assessment. Depending on the service, this may include your name, email address, assessment or licence code, assessment responses and generated assessment results.

Where personal data is transferred to the United Kingdom, such transfer is carried out in accordance with the applicable GDPR international-transfer mechanism, including an applicable adequacy decision where available.

2. Qualified Pilot Assessments and assessment documentation

Where a Qualified Pilot Assessment is purchased directly by an individual pilot, MyWingman conducts the assessment independently and provides the resulting assessment documentation directly to the assessed individual.

The assessment process may include psychometric assessment, cognitive assessment, personality assessment, competency assessment and a professional psychological interview, depending on the scope of the service.

Following completion of the assessment, the assessed individual receives or may be provided with:

• an Assessment Certificate; and
• a Full Assessment Report.

Where both documents are issued, the certificate and full assessment report are intended to be presented together to a current or prospective employer.

The certificate provides the formal assessment outcome, while the full report provides the context, interpretation and supporting assessment information. The certificate should therefore not be treated as a standalone representation of the complete psychological assessment where a corresponding full report has been issued.

Assessment documentation may have a limited validity period. The relevant assessment date and/or validity information is stated in the documentation.

Disclosure to current or prospective employers

Where an assessment has been purchased directly by an individual pilot for use in a current or future recruitment process, the assessment documentation is provided to the assessed individual.

The individual decides whether and to whom the assessment certificate and report are subsequently presented.

MyWingman does not routinely provide the individual’s assessment documentation directly to a current or prospective employer unless:

• the assessed individual requests or authorises such disclosure;
• direct disclosure forms part of a separately agreed assessment arrangement; or
• disclosure is otherwise required or permitted by applicable law.

A current or prospective employer who has received assessment documentation from the assessed individual may contact MyWingman to verify the authenticity of the documents or request professional clarification concerning the assessment.

We may confirm the authenticity of documentation issued by us and provide appropriate clarification concerning the methodology or interpretation of information already contained in that documentation.

We will not disclose additional personal or assessment information beyond the scope of the documentation already provided to the employer by the assessed individual unless an appropriate legal basis for such disclosure exists.

Assessments commissioned by flight schools, airlines or other organisations

Some assessments may be commissioned directly by a flight school, airline, training organisation or another organisation rather than purchased independently by the assessed individual.

In such cases, the organisation commissioning the assessment may receive the assessment outcome or other agreed assessment documentation where this forms part of the assessment arrangement and where an appropriate legal basis exists.

The individual will be informed of the relevant assessment process and intended recipients of the assessment outcome before or as part of the assessment process.

The respective data-protection roles of MyWingman and the commissioning organisation may depend on the nature of the particular arrangement.

Flight school entry assessments

Where you take a flight school entry assessment as part of an application to a flight school, the assessment is carried out so that the flight school you name when booking can decide on your application.

A few days after the interview, we share the initial outcome of the assessment with that flight school. The flight school then contacts you directly about its decision. Upon request, you may also receive a certificate.

We share the outcome with the flight school on the basis of your explicit consent under Article 9(2)(a) GDPR, which we ask for before the assessment begins. You are also informed of this in the interview confirmation email.

3. Why we process your data

Depending on the relevant activity, we process personal data for the following purposes and on the following legal bases.

Enquiries and pre-contractual communication

• Purpose: Responding to enquiries, providing information about services and taking steps requested before entering into a contract.
• Legal basis: Article 6(1)(b) GDPR – steps taken at the request of the data subject prior to entering into a contract.
• Typical retention: Up to 12 months from the last substantive contact where no service is purchased, unless longer retention is reasonably necessary.

Delivery of purchased services

• Purpose: Administering and providing the service you have requested, including assessment administration, communication, consultations, professional analysis and preparation of documentation.
• Legal basis: Article 6(1)(b) GDPR – performance of a contract.

Where special category personal data is involved, an additional Article 9 GDPR condition applies as described in this Privacy Policy.

Psychological and psychometric assessment

• Purpose: Conducting and documenting psychological or psychometric assessment, interpreting assessment evidence and preparing professional assessment conclusions and documentation.
• Legal basis for ordinary personal data: Article 6(1)(b) GDPR – performance of the service contract.
• Additional condition for special category data: Primarily Article 9(2)(a) GDPR – explicit consent; and, where applicable, Article 9(2)(f) GDPR for the establishment, exercise or defence of legal claims.

Invoicing, accounting and taxation

• Purpose: Issuing invoices and complying with accounting and tax obligations.
• Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation.
• Retention: In accordance with applicable Polish accounting and tax legislation.

Legal claims and regulatory enquiries

• Purpose: Establishing, exercising or defending legal claims and responding to legally valid regulatory or judicial requests.
• Legal basis: Article 6(1)(f) GDPR – our legitimate interest in protecting and enforcing our legal rights. Where special category data is necessary for legal claims, Article 9(2)(f) GDPR may also apply.
• Retention: For the applicable limitation period or for as long as reasonably necessary in connection with the relevant proceedings or claim.

Marketing communications

Where you have separately opted in to receive marketing communications:

Invoices are issued and stored through the accounting systems used by our accountants, and where Polish law requires it they are submitted to the National e-Invoicing System (Krajowy System e-Faktur, KSeF) operated by the Ministry of Finance. That submission is a legal obligation under Article 6(1)(c) GDPR, and the data sent is limited to what the invoice must contain.

• Legal basis: Article 6(1)(a) GDPR – consent.

You may withdraw your marketing consent at any time.

Withdrawal of marketing consent has no effect on your ability to purchase or receive MyWingman services.

4. Data retention

We do not retain personal data for longer than is reasonably necessary for the purposes for which it was collected, subject to applicable legal, contractual and professional requirements.

Different categories of data may therefore have different retention periods.

In particular:

Category of data	Retention
Website technical logs	generally up to 12 months.
Unsuccessful enquiries where no service is purchased	generally up to 12 months from the last substantive contact.
Invoices and accounting records	retained for the period required by applicable tax and accounting law.
Assessment certificates and final assessment reports	retained for a period reasonably necessary for professional documentation, verification of issued documentation, quality assurance and the establishment, exercise or defence of legal claims.
Psychometric results and essential assessment records	retained for a period reasonably necessary for professional assessment documentation, quality assurance and legal-claims purposes.
Interview recordings and transcripts	retained for a shorter period and only for as long as reasonably necessary to complete and quality-assure the assessment, unless longer retention is justified by a legal claim or legal requirement.
Consent records	retained for as long as reasonably necessary to demonstrate the lawful basis on which relevant processing was undertaken.
Marketing data	retained until consent is withdrawn, and in any event no longer than 36 months from your last engagement.

Where data is no longer necessary for the relevant purpose and there is no applicable legal or professional reason to retain it, it is securely deleted or anonymised.

5. Who has access to your data

Within our organisation, access to personal data is limited to individuals who require the information to perform their professional or administrative responsibilities.

Depending on the service, personal data may also be processed by the following categories of recipient or service provider:

• website hosting and IT infrastructure providers;
• email and document-storage providers;
• customer relationship management systems;
• psychometric and aviation assessment technology providers;
• videoconferencing providers;
• recording, transcription and related technology providers, where you consent to recording or transcription;
• payment and banking service providers;
• accountants and tax advisors;
• professional advisors, including legal advisors;
• airlines, flight schools, training organisations or other commissioning organisations where they are entitled to receive an assessment outcome under the applicable assessment arrangement;
• regulatory, judicial or public authorities where disclosure is required by law;
• analytics and advertising providers (Google and Meta), only where you have accepted analytics and advertising cookies; and
• other service providers necessary to deliver the requested service.

Where a service provider processes personal data on our instructions, we require appropriate data-processing arrangements in accordance with Article 28 GDPR where applicable.

The providers behind those categories are: Avantwerk, operated by Bennovate sp. z o.o., which supplies and administers our website, CRM, forms and email sending, and engages its own infrastructure providers as sub-processors, some of which are outside the EEA (see international transfers); Symbiotics Ltd for the ADAPT psychometric assessment; Zoom for assessment interviews and consultations; Stripe for card payments, where we never receive or store a full card number; Zoho for our own email; and Google and Meta for analytics and advertising, which load only after you choose “Accept all” in the cookie banner. This list is kept current; a provider may be replaced by another of the same kind.

Some recipients, such as banks, public authorities or certain professional advisors, may act as independent controllers for their own processing activities.

We do not sell personal data.

Where you have accepted analytics and advertising cookies, information about your use of the website is shared with Meta so that we can measure our advertising and show our adverts on Facebook and Instagram to people who have visited the website. We do not otherwise disclose personal data for advertising purposes.

A list of relevant processors or sub-processors is available on request, subject to reasonable confidentiality and security considerations.

The providers behind those categories are:

• Avantwerk, operated by Bennovate sp. z o.o. — Supplies and administers the website, CRM, forms and email sending, and engages its own infrastructure providers as sub-processors, some of which are outside the EEA. Established in Poland, with sub-processors outside the EEA. Transfers are made under Standard Contractual Clauses in the platform's data-processing terms.
• Symbiotics Ltd — The ADAPT psychometric assessment. Established in the United Kingdom. Transfers are made under the UK adequacy decision.
• Zoom — Assessment interviews, consultations and online meetings. Established in the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback.
• Stripe — Card payments. A full card number is never received or stored by the controller. Established in the United States / Ireland. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback.
• Zoho — The controller's own business email. Established in EU / India. Transfers are made under Standard Contractual Clauses.
• Google Ireland Limited — Analytics and advertising. Established in Ireland, with transfers to the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback. Loads only after you choose “Accept all” in the cookie banner.
• Meta Platforms Ireland Limited — Advertising measurement and audiences on Facebook and Instagram. Established in Ireland, with transfers to the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback. Loads only after you choose “Accept all” in the cookie banner.
• Cloudflare — Protects the website, forms and chat against automated abuse, and delivers the pages. Established in the United States. Transfers are made under the EU-US Data Privacy Framework, with Standard Contractual Clauses as fallback.
• Accountants and tax advisors — Invoicing and statutory accounting, including submission to the National e-Invoicing System (KSeF) where Polish law requires it, under Article 6(1)(c). Established in Poland.

This list is kept current; a provider may be replaced by another of the same kind.

6. Our brands

MyWingman is a brand operated by Dutch Aviation Services Sp. z o.o.

Dutch Aviation Services Sp. z o.o. also operates other aviation-related brands, including FlyEASA and Fly in Poland.

Where these brands are operated by the same legal entity and Controller, personal data may be processed across those brands where reasonably necessary to respond to an enquiry, administer a service or deliver a service involving more than one of those brands.

The Controller, applicable legal bases, retention principles and data-subject rights described in this Privacy Policy apply regardless of the brand through which the relevant service is delivered.

7. International transfers

Some of our service providers may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we ensure that an appropriate transfer mechanism is used as required by GDPR.

Depending on the recipient and destination, this may include:

• an adequacy decision adopted under Article 45 GDPR;
• Standard Contractual Clauses under Article 46 GDPR together with additional safeguards where required; or
• another lawful transfer mechanism permitted by GDPR.

For Google and Meta specifically, data transferred to the United States is protected by the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023); Google LLC and Meta Platforms, Inc. are both certified under it. If that Framework is annulled or suspended, we will move those transfers to Standard Contractual Clauses under Article 46 GDPR, or stop them, within 30 days of the decision.

Where a provider uses infrastructure located outside the EEA, we assess the applicable transfer arrangements as appropriate to the nature of the service and data involved.

Explicit consent under Article 49(1)(a) GDPR is relied upon for international transfers only in limited circumstances where legally appropriate and after the individual has been informed of the relevant risks.

8. Your rights

Subject to the conditions and limitations established by GDPR, you may have the following rights in relation to your personal data:

• Right of access – Article 15 GDPR: You may request confirmation of whether we process your personal data and obtain access to that data.
• Right to rectification – Article 16 GDPR: You may request correction of inaccurate personal data and completion of incomplete data.
• Right to erasure – Article 17 GDPR: You may request deletion of your personal data where the applicable legal conditions are met.
• Right to restriction – Article 18 GDPR: You may request restriction of processing in circumstances specified by GDPR.
• Right to data portability – Article 20 GDPR: Where applicable, you may receive personal data you provided to us in a structured, commonly used and machine-readable format and request its transmission to another controller.
• Right to object – Article 21 GDPR: You may object to processing based on legitimate interests, subject to the conditions established by GDPR.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint: You may lodge a complaint with the competent data-protection supervisory authority.

Not all rights apply in every situation. For example, the right to erasure does not require us to delete information that we are legally required to retain or that remains necessary for the establishment, exercise or defence of legal claims.

Requests concerning your personal data can be submitted using the contact information provided below.

Further information is also available on our GDPR Rights page.

9. Psychological assessment records and access requests

Psychological and psychometric assessment documentation may contain professional interpretations, assessment materials, psychometric outputs and information relating to assessment methodologies.

A request to exercise your GDPR rights will be assessed in accordance with applicable data-protection law.

Where providing particular information would adversely affect the rights and freedoms of another person, disclose protected intellectual property, compromise confidential assessment materials or otherwise fall within an applicable legal restriction, access may be limited to the extent permitted by law.

Nothing in this section is intended to restrict rights granted to you under GDPR.

10. Automated decision-making and psychometric profiling

MyWingman does not make decisions about individuals based solely on automated processing where those decisions produce legal effects or similarly significantly affect the individual within the meaning of Article 22 GDPR.

Psychometric assessment systems may generate scores, profiles, indicators or other automated outputs.

These outputs are treated as sources of assessment evidence.

They are not used as the sole basis for the final psychological assessment outcome.

Where a professional psychological assessment is provided, psychometric results are interpreted by a qualified human professional together with other relevant assessment information.

The aviation psychologist exercises independent professional judgement when interpreting the assessment evidence and preparing the final assessment documentation.

We use artificial-intelligence tools to help prepare and format assessment documentation and written correspondence. Any such draft is reviewed, corrected and approved by the aviation psychologist before it is issued, and the professional conclusion is always the psychologist’s own. These tools are not used to decide an assessment outcome, and personal data given to them is processed under a written data-processing agreement, on the same basis and with the same safeguards as the rest of your assessment information.

11. Security

We implement technical and organisational measures appropriate to the nature and risk of the personal data we process.

These measures may include:

• encryption of data in transit;
• encryption at rest where supported by the relevant system;
• access controls;
• role-based permissions;
• secure authentication;
• restricted access to psychological assessment information;
• appropriate contractual arrangements with processors;
• regular review of access permissions;
• confidentiality obligations;
• secure deletion procedures; and
• incident-response procedures.

No method of electronic storage or transmission can guarantee absolute security. We therefore regularly review our safeguards and adapt them where appropriate to the risks associated with the processing.

Where a personal-data breach occurs, we follow the notification requirements established by Articles 33 and 34 GDPR, including notification to the competent supervisory authority and affected individuals where required.

12. Confidentiality of psychological assessment information

Information obtained through psychological or psychometric assessment is treated as confidential professional information.

Assessment information is used only to the extent reasonably necessary for:

• providing the assessment service;
• preparing the assessment outcome and documentation;
• quality assurance;
• professional review;
• verification of issued documentation;
• responding to authorised enquiries concerning the assessment; and
• complying with applicable legal obligations or protecting legal rights.

Where an individual independently purchases a Qualified Pilot Assessment, MyWingman does not routinely disclose the assessment outcome to a current or prospective employer.

The assessed individual controls the initial disclosure of the certificate and full assessment report unless a different arrangement has been expressly agreed or disclosure is otherwise required by law.

Where an employer contacts us after receiving assessment documentation from the assessed individual, we may verify the authenticity of documentation and provide appropriate professional clarification concerning information already contained in the documentation.

Additional confidential information will not be disclosed without an appropriate legal basis.

13. Children

MyWingman aviation psychology and pilot assessment services are generally intended for adults.

Where a service is provided to a person under the age of 18, we will apply appropriate safeguards and, where required, obtain authorisation or consent from a parent or legal guardian in accordance with applicable law.

We do not knowingly collect children’s personal data through services intended exclusively for adults except where necessary and legally permitted.

14. Contact us about privacy

For questions about this Privacy Policy, the processing of your personal data or the exercise of your GDPR rights, please contact:

Please use the subject line “Privacy request” where possible.

We respond to data-subject requests without undue delay and normally within one month of receipt.

Where permitted by GDPR, this period may be extended by up to a further two months where necessary, taking into account the complexity and number of requests. If an extension is required, we will inform you within the initial one-month period.

15. Supervisory authority

You have the right to lodge a complaint with a competent data-protection supervisory authority.

Our lead supervisory authority in Poland is:

Where permitted under GDPR, you may also contact the competent supervisory authority in another EU or EEA Member State, particularly in the country of your habitual residence, place of work or the place of the alleged infringement.

16. Changes to this Privacy Policy

This Privacy Policy is Version 1.1, effective 11 September 2026.

We may update this Policy where our services, technologies, data-processing practices or legal obligations change.

The current version and effective date will always be displayed on this page.

Where a change materially affects the way we process personal data of active customers, we will provide additional notice where required by applicable law.