Privacy Policy

SECTION 1. DATA CONTROLLER IDENTIFICATION

1.1. The Data Controller for personal data processed on the GoUpTower Platform is Aleksander Chomiński, conducting unregistered business activity (działalność nierejestrowana) in Poland (hereinafter: "Controller"). Tax identification number (NIP): 8513359590; VAT-EU number: PL8513359590.

1.2. For matters relating to personal data processing, data deletion, or exercising GDPR rights, contact the Controller at: gdpr@gouptower.com.

SECTION 2. SCOPE & CATEGORIES OF DATA COLLECTED

Data Category	Collected Data Fields	Collection Source
Account Identifiers	First Name, Last Name, Email, Password Hash, Google OAuth ID, and whether your e-mail address is confirmed. If you ask to set a new password, a hash of the one-hour link sent to you (the link itself is not stored).	User registration & SSO.
Career & Qualification Profile	GWO WINDA ID, GWO modules, OEM training, Medical certs, Expiration dates, turbine platforms, years of industry experience, list of projects, and custom certificate names.	Voluntary input in Dashboard.
Rotation & Location Data	Calendar inputs including planned rotation dates, days on project, home/vacation days, and geographical locations (city/country). In the Live Time Tracker, the city and country of each session; the "Use my location" button fills them in from your position (see Section 4.1).	Voluntary input in "My Rotation Plan".
Training Provider Directory Data	Facility Name, Business Address, Contact Details, Offered GWO/OEM Modules.	Publicly available sources (company websites, public business registries).
CV Builder Data	Professional headline, personal summary, phone number, city, country, LinkedIn address, spoken languages, education history, manually added work experience, chosen CV style, and every named CV document you save as a draft. Project history is assembled from entries you made in "My Rotation Plan". In the App you may start a CV before signing in: that draft stays on your device until you save it to your Account, and PDFs made in the App are generated on the device.	Voluntary input in CV Builder, plus data you already entered in Profile Details, My Certificates and My Rotation Plan.
Virtual CV Sharing	A randomly generated share token, an on/off sharing flag, and which of your saved CVs is currently shared.	Created only when you switch sharing on.
Device & Notifications (App)	Apple Push token for the device, which push environment it belongs to, the device model name shown against your sign-ins, and your on/off choices for job offers and platform updates.	Created when you allow notifications.
Location & Wind (App)	Your device's position rounded to roughly one kilometre, the name of the nearest town, the wind limit you set, and the state of your high-wind alert. The full-precision position is used on the device and is not stored on the server. When you sign out, the stored position is deleted; your alert switch and limit stay on the phone so alerts can resume at your next sign-in.	Only while you allow location; the stored copy only if high-wind alerts are on.
Travel & Reminders (App)	Whether you have ticked "I fly to work", so the day-before reminder can mention flight check-in.	Voluntary switch in the App.
Sign in with Apple (App and website)	The identifier Apple issues for you and the email address Apple passes on — which may be one of Apple's private relay addresses if you chose to hide your real one — and, for a sign-in in the App, a token that lets the Controller revoke that sign-in when you delete your Account.	Only if you sign in with Apple.
Referral Programme	Your invitation code, who invited you, who joined on your link and whether their points have been credited, your points balance, and what you have redeemed.	Created when you or someone else uses an invitation link.
Notices under the bell	The notices addressed to you, when you last read them, and which ones you deleted. Notices sent to everyone are shown to you only from the day your Account was created.	Automated system logging.
Emergency tools (App)	Defibrillator map: your device's position rounded to roughly one kilometre, sent to the Controller's server, which asks the OpenStreetMap database for defibrillators nearby. The position is not linked to your Account, not stored and not logged; only the search results, which contain no personal data, are kept for up to 7 days. Hospital map: searched by Apple Maps directly from your device; nothing is sent to the Controller. Call 112 and "Share my location": handled by your phone and sent only to the number you call or the person or app you choose; the Controller receives nothing.	Only when you open an Emergency map and allow location.
Kept on your device only (App)	Your packing checklist; rotation events you export to the iPhone's Calendar; CV drafts you have not saved to your Account and the PDFs you create in the App; your Safety Book progress; the offline copy of the Education Hub; the last emergency map results; the layout of your Home widgets and your light or dark appearance choice. None of these is stored by the Controller. The Controller never reads your calendar; the App asks only for permission to add events to it.	Stays on the device.
Usage & View Logging	Which job offers your account opened and when (used to meter the weekly allowance and to make re-reading an offer free), which airports a free account opened in the last 24 hours (to count the free airport details), views of each offer and clicks on Apply (offer statistics), CV Builder steps (building a CV, downloading a PDF), and whether you completed or skipped the introductory walk-through. A visitor without an Account is counted with a one-way hash instead of an identity (Section 3).	Automated system logging.
Job alerts & applications	The alerts you set in your Dashboard (onshore or offshore, turbine makers, countries, on or off), which offers were e-mailed to you and when, and the list of offers you went to apply for with the Apply button: the offer's title, company and place, the status you give it and your own note. To show how many of an offer's required certificates you already hold, the names of the certificates in your wallet are compared with the offer; they are not put in the e-mail. Alerts go only to a confirmed e-mail address. Nothing is sent to employers: you apply on the employer's own site.	Only if you switch alerts on, or use Apply while signed in.
Billing & Financials	Subscription Plan ID, transaction IDs (Stripe Payments Europe Limited), and for purchases made in the App: the App Store transaction and original transaction identifiers, the product bought, its renewal and expiry dates, and an anonymous token tying the purchase to your Account. For a purchase on the website, also the country of residence you state before paying and the billing country Stripe returns with the payment, and, when you ask for an invoice in your Account, your request and the invoice made from your name, or the name, address and VAT number you give for it, your country, e-mail address and these payment details (the invoice is sent to your e-mail address and cannot be downloaded in the Account). For a free trial on the website, the date it started (one trial per Account), whether a plan is billed monthly or yearly, and when you switched its renewal off. No card details reach the Controller by either route.	You, at checkout; payment gateway integration; Apple's App Store server notifications.
Company & partner data	Company accounts, their representatives, sponsored offers, tracked links and offer requests: see Sections 6A and 6B.	Employers and their representatives.
Wind Farm Builder (game)	Your saved game, career and score; a nickname, if you choose one, under which you then appear on the public top-100 leaderboard (choose one that does not identify you); Share & earn records: which of your share links brought a visit, each visitor counted once with a one-way hash of their IP address, and the bonuses credited.	Playing the game.
Contact form & e-mail	Your name, e-mail address, subject and message, and our replies.	What you send through the contact form or by e-mail.
Security logs	For a failed sign-in: the e-mail address typed and the IP address. For actions that could be abused (signing in, registering, sign-in codes, the contact form in the App, game saves and similar): the IP address and the action. The hosting provider's standard server logs: IP address, time, page requested and browser.	Automated, on every request.
Public mentions of GoUpTower (people who are not Users)	Public posts that mention GoUpTower on Reddit, Hacker News, Mastodon, Bluesky, YouTube or X, or found by Google Alerts: the post's address, the author's public name or handle, a short excerpt, the network and the date.	The public post itself (Art. 14 GDPR).

SECTION 3. LEGAL BASES & PURPOSES (GDPR ART. 6)

Purpose	GDPR Legal Basis	Retention Period
Service delivery, Account management & Offer viewing	Art. 6(1)(b) (Contract execution)	Duration of active account.
Internal Statistical Analysis Processing aggregated length of experience, platform types, project history, certificate types, rotation trends and CV usage to improve services. Data is strictly internal and never sold or shared.	Art. 6(1)(f) (Legitimate interest)	Duration of active account or until data is fully anonymized.
Public Training Center Directory Display Displaying certified training facilities on the interactive map for user convenience (Art. 14 GDPR - data obtained from public sources).	Art. 6(1)(f) (Legitimate interest)	Until an objection is raised or data is updated at source.
CV creation, storage and export Building, saving and exporting CV documents from data you have entered.	Art. 6(1)(b) (Contract execution)	Until you delete the CV, or until the account is deleted.
Job alerts and the list of your applications E-mailing new job offers that fit the alerts you set (weekly on the free plan, as soon as they are posted on PRO and Advanced), and keeping the list of offers you applied for. Every alert has a link that turns alerts off without logging in. A line about the paid plans is added to a weekly alert only if you agreed to news and offers.	Art. 6(1)(b) (Contract execution — you switch alerts on)	Alert settings and the list: until you change or delete them, or delete the account. Which offers were e-mailed: 90 days.
Publishing a Virtual CV Making a CV readable by anyone holding the share link. See Section 6.	Art. 6(1)(a) (Consent — you switch sharing on)	Until you switch sharing off, delete the CV, or delete the account.
Health data in certificates Medical fitness certificates and their expiry dates are data concerning health. You are never required to enter them, and you may record only an expiry date without naming the condition or examination.	Art. 9(2)(a) (Explicit consent), on top of Art. 6(1)(b)	Until you delete the entry or the account. Withdrawing consent means deleting the entry.
Offer view logging Recording which offers you opened so the weekly allowance can be counted and so re-reading an offer you already opened does not cost a second view.	Art. 6(1)(b) (Contract execution)	30 days, then automatically deleted. Only the last 7 days ever affect your allowance.
News, offers and reminders Only if you tick the optional box when registering, answer “Yes” when the App asks you once, or switch it on later in your Dashboard (Profile) or the App (Profile → Notifications). Occasional manually sent emails — a reminder to finish the introductory walk-through, or that a started upgrade was never completed — and platform announcements sent to all users as push notifications in the App. Every such email carries an unsubscribe link. Not agreeing has no effect on your account. Sending commercial information by email also requires this consent under the Polish Electronic Communications Law.	Art. 6(1)(a) (Consent)	Until you withdraw consent or delete the account. The date consent was given is kept as a record of it.
Wind readings and high-wind alerts (App) Reading the wind where your device is, and checking it periodically on the server so an alert can be sent while the App is closed.	Art. 6(1)(a) (Consent — you allow location, and switch alerts on)	The stored position is replaced each time it is refreshed and deleted when you switch alerts off, sign out, or delete the account.
Push notifications (App) Sending new job offers, platform announcements, referral points, and the reminder the day before a rotation starts or ends. An announcement sent to all users reaches your device only if you have also agreed to news and offers (above); otherwise it stays in the in-app notice list.	Art. 6(1)(a) (Consent — the iOS permission and the switches in the App)	The device token is kept until you sign out, turn notifications off, or Apple reports it as dead. Notices are deleted after 120 days.
In-App Purchases (App) Verifying with Apple that a subscription bought in the App is genuine, and keeping it in step when it renews, lapses or is refunded.	Art. 6(1)(b) (Contract) and Art. 6(1)(c) (Accounting)	Duration of the subscription; accounting records 5 years from the end of the fiscal year.
Referral programme Recording who invited whom, crediting points once both profiles are complete, and guarding against self-referral.	Art. 6(1)(b) (Contract execution)	Until either account is deleted.
Offer views and Apply clicks Counting how many times each offer was viewed and how many people went on to apply, for the offer statistics the Controller uses and, as totals only, for the employer (Section 6A). A signed-in view or click is recorded against the account; for visitors a one-way daily hash of IP address and browser is used, which cannot be turned back into either.	Art. 6(1)(f) (Legitimate interest)	60 days, then deleted; only daily totals without personal data remain. A member's entries are made anonymous when the account is deleted.
Airport details allowance Recording which airports a free Account opened, so that five airport details per 24 hours can be counted. PRO and Advanced Accounts are not counted.	Art. 6(1)(b) (Contract execution)	Deleted once a day old, 2 days at the latest.
CV Builder statistics Counting how many people build a CV and download it, with and without an Account. A member is recorded by account; a visitor by a salted one-way hash of the browser session or of the App installation. No CV content and no IP address is stored. Figures from before 1 September 2026 were taken from the hosting provider's server logs, with each IP address replaced by a salted hash.	Art. 6(1)(f) (Legitimate interest)	Kept as statistics. A member's entries are made anonymous when the account is deleted.
Wind Farm Builder Saving your game, showing the leaderboard, crediting Share & earn bonuses and counting each visitor to a share link once.	Art. 6(1)(b) (Contract) Art. 6(1)(f) for counting visitors	Until you delete the account. A visitor's hash is kept only with the bonus it produced.
Contact and correspondence Answering what you ask through the contact form or by e-mail.	Art. 6(1)(b) where it concerns your Account or a purchase; otherwise Art. 6(1)(f)	As long as needed to deal with it, then up to 3 years, or longer while a claim is pending.
Security and abuse prevention Slowing down password guessing and limiting repeated requests, and finding faults and attacks in the server logs.	Art. 6(1)(f) (Legitimate interest in a safe Platform)	Failed sign-ins: cleared at the next successful sign-in, 1 day at the latest. Request limits: 2 days. Server logs: kept by the hosting provider for its security and fault-finding.
Public mentions of GoUpTower Finding and answering public posts that mention GoUpTower, and seeing where it is discussed. Only what the post itself shows publicly is kept.	Art. 6(1)(f) (Legitimate interest)	2 years, then deleted. You may object at any time at gdpr@gouptower.com.
Your data protection requests, and data breaches Keeping a record of each request made under Sections 8 and 8.1a and how it was answered, and of any personal data breach and what was done about it, as the GDPR requires (Art. 5(2), 12 and 33(5)).	Art. 6(1)(c) (Legal obligation)	5 years after the matter is closed.
Company accounts, sponsored offers, tracked links and offer requests See Sections 6A and 6B.	As stated there	As stated there
Defibrillator map (App) Finding defibrillators near you. The App sends a position rounded to about a kilometre to the Controller's server, which queries OpenStreetMap on your behalf, so the map service never learns who is asking.	Art. 6(1)(a) (Consent — you allow location and open the map)	The position is used for that single search and not stored. Results, which contain no personal data, are cached per map area for up to 7 days.
Social media links Showing links to GoUpTower's own pages on social networks. Nothing is sent to those networks until you tap a link.	Art. 6(1)(f) (Legitimate interest)	No personal data is processed by showing the links.
Automated Certificate Expiration Reminders	Art. 6(1)(b) (Contract execution)	Active subscription duration.
Payment processing & Accounting compliance, including the buyer's country of residence, which VAT law requires the seller to establish and keep evidence of, and the check that website purchases are made by residents of the European Union	Art. 6(1)(c) (Legal obligation); for the EU-only check, Art. 6(1)(b) (the contract you ask for)	5 years from end of fiscal year.

SECTION 4. SUB-PROCESSORS & THIRD-PARTY RECIPIENTS

4.1. Personal data is shared only with the recipients below. Those that process it on the Controller's behalf (hosting, e-mail, payments) do so under data processing agreements (Art. 28 GDPR); the others receive it as independent controllers for their own service, under their own privacy policies:

Hosting Provider: SEOHOST Sp. z o.o., ul. Obornicka 330, 60-689 Poznań, VAT: PL9721323212
Payment Gateway: Stripe Payments Europe Limited (SPEL), The One Building, 1 Lower Grand Canal Street, Dublin 2, Ireland — card and bank transfer processing. Card details are entered on Stripe's hosted checkout and are never received or stored by the Controller. The country of residence you state before paying on the website is passed to Stripe with the payment.
Polish tax authorities (Krajowa Administracja Skarbowa, Ministry of Finance): invoices to businesses are issued in the National e-Invoice System (KSeF) where Polish law requires it, and accounting and tax records are made available to the tax authorities when the law requires. Invoices to private individuals are not sent to KSeF.
Google Ireland Limited: "Sign in with Google" (OAuth) for users who choose it, and — on the website only, and only after Accept All in the cookie banner — Google Analytics and Google Ads conversion measurement (see Section 7).
OpenStreetMap Foundation (United Kingdom): the map tiles of the training-centre map and the airports board, which your browser fetches from OpenStreetMap's servers (they see your IP address); and Nominatim, which turns your position into a town name when you press "Use my location" in the Time Tracker — your browser sends the coordinates straight to it, and only when you press that button.
Overpass API (overpass-api.de, Germany): the public service that answers searches of OpenStreetMap data. It is used only for the defibrillator map in the App, and only by the Controller's server: it receives a position rounded to about one kilometre, never your IP address, your device or your identity.
Apple Distribution International Ltd. (Hollyhill Industrial Estate, Cork, Ireland) and Apple Inc. — for the App only: distribution through the App Store and TestFlight, billing of In-App Purchases, delivery of push notifications through the Apple Push Notification service, the wind readings shown in the App (Apple Weather / WeatherKit), "Sign in with Apple" for users who choose it, and the nearby-hospital search on the App's Emergency screen, which Apple Maps performs from your device. Apple acts as an independent controller for its own purposes in respect of App Store transactions and account data; its privacy policy governs those.

4.2. Content delivery networks. Some page assets (scripts, icons and webfonts) are loaded from third-party networks. Doing so discloses your IP address and browser details to them, which is technically unavoidable when a browser fetches a file:

Cloudflare, Inc. (cdnjs): JavaScript libraries, including the QR code generator.
Google Ireland Limited (Google Fonts): Webfonts.
unpkg.com: Leaflet, the map library of the training-centre map and the airports board.

4.2a. Social media links. The App and the website may link to GoUpTower's pages on Instagram, Facebook, LinkedIn, TikTok, YouTube or X. Nothing is shared with those platforms until you tap a link; from then on you are on their service, and their privacy policy applies.

4.3. Recipients of a shared Virtual CV. If you switch on Virtual CV sharing, the recipients of that data are anyone who holds the link, including people you did not give it to directly. This is the intended purpose of the feature. See Section 6.

4.4. No sale of data. Personal data is never sold, rented, or supplied to advertisers, recruiters or data brokers.

SECTION 5. SECURITY

5.1. All database storage is encrypted at rest and in transit via TLS 1.3. Passwords are stored only as salted hashes and are never readable by the Controller.

5.2. Applications sent to employers. When you click an external apply link you leave the Platform. The Controller does not collect, receive, store or process the application you then submit to that employer, nor any CV file you upload on their system. What happens on the employer's site is governed by the employer's own privacy policy.

5.3. CV documents created on the Platform. Separately from the above, the Platform does store the CVs you build here, because that is what CV Builder is for. Those documents live in your account, are visible only to you, and are never sent to an employer by the Controller. They are described in Section 2 and Section 6.

SECTION 6. CV BUILDER & THE VIRTUAL CV SHARE LINK

6.1. What CV Builder does. It assembles a CV from data already in your account — profile details, certificates, and the project history recorded in "My Rotation Plan" — and lets you fill any gaps by hand. You may save any number of named drafts. Nothing is published anywhere by default.

6.2. Exports. Generating a PDF creates a file in your browser, or, in the App, on your device — the App builds the PDF itself and does not send it to the Controller. Once you download, email, share or print that file, it is outside the Controller's control.

6.3. The Virtual CV is a public link. If you switch sharing on, the Platform creates a long random address of the form gouptower.com/profile.php?t=…. Anyone who has that address can open your CV and download your contact details as a vCard, without logging in and without your further knowledge. Treat it as publishing, not as sending.

6.4. Controls you have. Sharing is off until you switch it on. The address is a random token, not a guessable number. The page instructs search engines not to index it (noindex, nofollow). The QR code is generated inside your own browser, so the address is never sent to a third-party QR service.

6.5. Limits of those controls. Switching sharing off disables the link immediately, and deleting your account disables it too. Neither can retrieve copies that were already opened, saved, screenshotted or forwarded. A search engine that ignores the no-index instruction cannot be forced to comply.

6.6. Sensitive content is your choice. A CV can contain medical certificate details. Consider whether you want health information on a link you may forward to people you do not know.

SECTION 6A. COMPANY ACCOUNTS, SPONSORED OFFERS & TRACKED LINKS

6A.1. Company accounts. When an employer asks for a company account, the Controller records the company's name and website, its invoicing details (the name on the invoice, VAT number and address) and which registered users represent it. A representative sees the company's job offers and their statistics at gouptower.com/partner. Legal basis: Art. 6(1)(b) GDPR (the agreement with the company and its representative). Kept while the company account exists; a representative is removed at the company's or their own request.

6A.2. Sponsored offers. Buying a sponsorship records the offer, the number of days, the price, when it runs, the Stripe Checkout session identifier and which representative paid. Card details are entered on Stripe's hosted checkout and never reach the Controller. Legal basis: Art. 6(1)(b) GDPR, and for invoices and accounting Art. 6(1)(c) GDPR. Kept 5 years from the end of the fiscal year, as Polish accounting law requires.

6A.3. What a company sees. A representative sees counts only: how many times the company's offers were viewed, how many people pressed Apply, and what its shared links brought. The Controller never discloses to a company who viewed its offers or who applied.

6A.4. Tracked links, QR codes and graphics. A company may share a link (gouptower.com/go/…), a QR code or a graphic that leads to one of its offers. When someone opens it, the Controller records which link was used and whether it was the link, the QR code or the graphic; the time; the website it was opened from (the domain only, for example linkedin.com); whether that visit was followed by pressing Apply; and a one-way hash of the IP address and browser, made with a secret key, used only to count how many different people came. The IP address itself is not stored, and the hash cannot be turned back into it. Automated link previews and robots are not counted. The company and the Controller see totals only. Legal basis: Art. 6(1)(f) GDPR (legitimate interest: showing employers what sharing their offers achieves). Kept while the company account exists and deleted with it.

6A.5. Your choice. An offer opened directly on gouptower.com, or in the App, is never counted this way. You may object to this processing at any time under Art. 21 GDPR by writing to gdpr@gouptower.com.

SECTION 6B. OFFER REQUESTS AND HELPDESK TICKETS FROM EMPLOYERS

6B.1. What is recorded. When a company's representative sends an offer request or a message from the partner dashboard, the Controller records its content (the facts of the vacancy, the link and any text sent), the messages exchanged about it, who sent each one and when, the status of the request and the offer published from it. A notification is e-mailed to the Controller's mailbox (admin@gouptower.com), and the Controller's answers are e-mailed to the company's representatives.

6B.2. Why, and on what basis. To handle the request and publish the offer: Art. 6(1)(b) GDPR (the partnership). To keep a record of what was agreed: Art. 6(1)(f) GDPR (legitimate interest in establishing and defending claims).

6B.3. How long. While the company's partner account exists, and afterwards for up to 3 years from the last message, unless a longer period is needed to establish, exercise or defend legal claims. Requests and messages are deleted with the company's partner account.

6B.4. Candidates' data. Representatives are asked not to send personal data of candidates or employees through the offer desk. A contact address for applications is published only as the company provides it, and the company is responsible for informing the person concerned.

6B.5. Helpdesk. When a representative opens a ticket in the helpdesk of the partner dashboard, the Controller records its number, topic and subject, the offer it concerns if one is chosen, the messages exchanged, who wrote each one and when, and its status. A notification of each new ticket and of each reply from the company is e-mailed to the Controller’s mailbox (admin@gouptower.com); the representative who opened the ticket receives a confirmation, each answer and each change of its status by e-mail, with a link to the ticket. Points 6B.2 to 6B.4 apply to tickets in the same way: the same purposes and legal bases, the same retention, deletion with the company’s partner account, and no personal data of candidates or employees.

SECTION 7. COOKIES, TRACKING & ADVERTISING

7.1. Strictly necessary. A session cookie keeps you logged in and carries the security token that protects forms against cross-site request forgery. It cannot be switched off without breaking the Platform, and it requires no consent.

7.2. Local storage and preference cookies. Small preferences are kept in your browser only and are never transmitted to the Controller: your light or dark theme, a dismissed App banner, Wind Farm Builder's language and 3D quality, and similar settings. Two small first-party cookies serve the same purpose: one remembers for 30 days that you hid the reminder about the introductory walk-through, and one tells the website's own scripts that you are signed in. The Cookies Policy lists them all.

7.2a. Visits from social networks. When a visit comes from a social network, or a network fetches a page to show a link preview, only a daily count is kept: the network, the language, the page and the campaign name. No IP address, cookie or Account is recorded.

Privacy Policy

We respect your privacy