Data Processing Agreement (DPA)

1. Parties

Controller: the pilot or company that uses a Pilotio account and enters its passengers' data into it ("Controller").

Processor: Michal Stuchlík, self-employed individual (OSVČ), Company ID (IČO) 03868427, with its seat at Skřečoňská 1334, 735 53 Dolní Lutyně, Czech Republic, the operator of Pilotio ("Processor").

2. Subject and duration of processing

The subject is the processing of the Controller's passengers' personal data through the Pilotio booking and management software. Processing lasts for the duration of the Controller's Pilotio account and ends when the account is closed, subject to Section 13 (return and deletion).

3. Nature and purpose of processing

The nature of the processing is hosting, storing, displaying and technically processing data within the SaaS platform. The purpose is to let the Controller receive, manage and fulfil tandem-flight bookings, keep client records and communicate with passengers within the scope of Pilotio's features (e.g. a booking access link, a voucher extension).

4. Categories of data subjects

• passengers and other flight participants whose data the Controller enters into Pilotio.

5. Categories of personal data

• identification and contact data (first and last name, e-mail, phone),
• data needed for the flight (weight),
• booking data (offer, slot, takeoff site, status, history, voucher, payment status and voucher code for Company bookings),
• confirmation of the required declarations (incl. the binding booking confirmation for Company bookings) and their version, a timestamp and an IP address as evidence of confirmation,
• any note the Controller enters about a passenger in the app.

Pilotio is not designed to require or process special categories of data (e.g. diagnoses, medication, medical history) — the booking form does not ask for them. Bookings confirmed under the consent wording in effect up to version v1 may have carried a simple general confirmation of fitness to fly with no specific health data attached; from version v2 this was replaced by a non-medical duty to inform the pilot of relevant circumstances (see the Privacy Policy, section 4). If the Controller nonetheless enters more sensitive information into an optional free-text field, the Controller alone is responsible, as controller, for the lawfulness of that processing.

6. Processing only on instructions

The Processor processes personal data solely on the Controller's documented instructions, which consist in particular of this Agreement and Pilotio's features as used by the Controller. The Processor will not use the data for its own purposes incompatible with that purpose.

7. Confidentiality

The Processor ensures that persons authorised to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

8. Technical and organisational measures

• database-level access control (row-level security),
• separation of pilot and passenger roles,
• encrypted data transport,
• passwords stored as a secure hash, never in readable form,
• data access limited to necessary cases and personnel.

9. Subprocessors

The Controller grants general authorisation for the use of these subprocessors, which take part in running Pilotio and may come into contact with passenger data:

• Supabase — database hosting and authentication,
• Vercel — application hosting and operation,
• Resend — sending transactional e-mail (e.g. a booking access link).

The Processor contractually passes on corresponding data-protection obligations to these subprocessors. The Processor will inform the Controller of an intended change of subprocessor in an appropriate way (e.g. by updating this document); the Controller has the right to raise a reasoned objection to such a change.

Payments for the Controller's plan are processed by an external payment service provider — it does not process passenger data, only the Controller's own payment and billing data, and is therefore not a subprocessor with respect to passenger data under this Agreement.

10. Assistance with data subject rights

The Processor provides the Controller with reasonable technical and organisational assistance in responding to a passenger's request to exercise their rights (access, rectification, erasure, restriction, portability, objection), in particular by enabling access to the relevant data in the app or by assistance on request via support@pilotio.eu.

11. Personal data breach

The Processor will notify the Controller without undue delay after becoming aware of a breach of security of passengers' personal data processed on the Controller's behalf, and will provide information reasonably available to help the Controller meet its own notification obligations.

12. Assistance with GDPR compliance

The Processor provides the Controller with reasonable assistance in complying with its obligations under the GDPR, having regard to the nature of the processing and the information available to the Processor (e.g. in a data protection impact assessment, where relevant).

13. Return and deletion of data

After the Controller's account ends, the Processor will, at the Controller's choice, delete the passengers' data or make it available on request, except to the extent the Processor is required to retain it under applicable law (e.g. accounting and tax law) — the safeguards in this Agreement continue to apply to data retained on that basis.

14. Audit and compliance assistance

The Processor will make available information reasonably necessary to demonstrate compliance with this Agreement, and will allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable prior notice and confidentiality. For routine, recurring verification, the Processor may satisfy this obligation by providing corresponding documentation instead of an on-site audit; this does not, however, exclude the Controller's right to request a genuine audit or inspection where there is a reasonable need for one (e.g. a suspected breach of this Agreement or a supervisory authority's request) — documentation alone is not treated as satisfying this obligation in that case.

15. International transfers

Where a subprocessor processes data outside the EU/EEA, the transfer relies on appropriate safeguards under the GDPR, in particular the European Commission's Standard Contractual Clauses, or on an adequacy decision.

Where the Controller is a pilot/company established in Switzerland, processing may, alongside this Agreement and the GDPR, also be subject to the Swiss Federal Act on Data Protection (FADP), which is a separate legal regime with its own requirements — compliance with the GDPR does not by itself guarantee compliance with the FADP, and the Processor has not carried out a separate FADP compliance assessment. A Controller established in Switzerland to whom the FADP applies should assess its specific requirements themselves or with legal advice; this Agreement neither prevents that nor relieves them of their own obligations under the FADP.

16. Annexes (summary)

The following annexes summarise, in the format familiar from the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/915), what is already described in detail above — they are not separate obligations beyond Articles 1–15, only a structured recap.

Annex A — Parties: Controller = the pilot/company identified by their Pilotio account details. Processor = the operator of Pilotio (see Art. 1).

Annex B — Description of processing: subject matter, duration, nature and purpose under Art. 2–3; categories of data subjects under Art. 4; categories of personal data under Art. 5.

Annex C — Technical and organisational measures: as set out in Art. 8 (access control, role separation, encrypted transport, passwords as a secure hash, restricted data access).

Annex D — Subprocessors: the current list is publicly available at /subprocessors and is incorporated into this Agreement by reference; updates to it follow Art. 9.

17. Changes, version and language

We may update this Agreement in an appropriate way. The current internal version is v3.

This Agreement is drawn up in Czech and in English. In the event of a discrepancy between the language versions, the Czech text prevails.