GoUpTower processes personal data strictly adhering to Article 5 GDPR principles:

• Lawfulness, Fairness & Transparency: Data is collected under clear legal bases (Art. 6) with full user notice.
• Purpose Limitation: Collected solely for job aggregation, profile management, certificate tracking, internal statistical analysis, rotation planning, and, in the iPhone app, wind readings and notifications you have asked for, and platform security.
• Data Minimization: Only data strictly necessary for platform functions is requested.
• Accuracy: Users maintain direct control over profile data in their Account Dashboard.
• Storage Limitation: Data is purged upon account deletion or expiration of legal retention duties.
• Integrity & Confidentiality: Password hashing (bcrypt) and SSL/TLS encryption protect data against breach.
• Scope: These principles apply to the website and to the GoUpTower app for iPhone alike. The app additionally involves Apple as a processor and, for App Store transactions, as an independent controller — for distribution, in-app purchases, push notifications, wind data and "Sign in with Apple". Your packing list and any events exported to your iPhone's calendar stay on your device and never reach the Controller.

Under GDPR Articles 15-22, Users possess the following actionable rights:

• Right of Access (Art. 15): Obtain confirmation and a copy of all stored personal records.
• Right to Rectification (Art. 16): Modify inaccurate data instantly via the Dashboard.
• Right to Erasure (Art. 17): Request complete account deletion and data purge.
• Right to Restriction (Art. 18): Pause processing under contested accuracy or legal disputes.
• Right to Data Portability (Art. 20): Export account data in JSON/CSV format.
• Right to Object (Art. 21): Object to processing based on Controller legitimate interests.
• Automated Decision-Making (Art. 22): GoUpTower does not use fully automated profiling producing legal effects.

REQUEST PROCEDURE

3.1. Users can exercise any right, including data deletion, by emailing gdpr@gouptower.com from their registered email address. An Account can also be deleted directly, without writing to anyone: on the website from the Dashboard, or in the app under Account → Delete account.

3.1a. Consent given on a device — location and notifications in the app — is withdrawn in iOS Settings → GoUpTower, or from the switches in the app itself. Withdrawal takes effect immediately and does not affect processing already carried out.

3.2. Requests are processed free of charge within 30 calendar days. Identity verification may be performed prior to data disclosure.

RIGHT TO LODGE A COMPLAINT

4.1. If a User believes processing violates GDPR, they have the right to file a complaint with their local EEA supervisory authority. In Poland: President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw.