Privacy policy

This English version is a translation. In case of any discrepancy, the Romanian version prevails.

This policy explains what personal data we process when you use the website, buy a voucher or fly with us, why we process it and what rights you have under Regulation (EU) 2016/679 (GDPR).

1. Who is responsible for your data

The controller of your data is:

• Waves Computer S.R.L., which operates the OneSky brand
• Registered office: Str. Dacia nr. 12, 500233 Brașov, jud. Brașov
• Trade Register number: J1996001123084
• Tax identification number: RO8728680
• Email: contact@onesky.ro · Phone: +40 750 445 778

For any question about your data, write to us at contact@onesky.ro.

2. In short

• We ask only for the data we need to sell vouchers, organise flights and send you your flight video.
• For traffic statistics we use Cloudflare Web Analytics, which sets no cookies and doesn't identify you. We use no advertising cookies.
• Your card details stay with the payment processor and do not reach us.
• We do not sell or rent your data to anyone.

3. What data we process, why, and on what legal basis

3.1. Ordering a voucher on the website

• Data: your name, email address and phone number; the name of the person who will fly and the message on the voucher; the flight chosen, the amount, the order number and date, and the payment status.
• Purpose: processing the payment, issuing and sending the voucher, communicating with you about the order and booking the flight.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal financial and accounting obligations (Art. 6(1)(c)). You give us the name of the person who will fly so that we can issue the gift you ordered; we process it on the basis of our legitimate interest in fulfilling your order (Art. 6(1)(f)).
• The website does not save your order in a database of its own: the data goes directly to the payment processor, and we see it in our merchant account so that we can issue the voucher.

3.2. Card payment

Payment is made on the secure NETOPIA Payments page. You enter your card details only there, and they do not reach us; we receive only the payment confirmation and the transaction ID. NETOPIA Payments' policy also applies to the data you enter on the payment page.

3.3. Booking your flight and messages to us

• Data: your name, phone number or email address, the content of your messages, your preferred date, the flight chosen and your weight (needed for the flight's safety limits).
• Purpose: to reply to you, book your flight and make sure it can be done safely.
• Legal basis: steps to enter into and perform the contract (Art. 6(1)(b)) and our legitimate interest in replying to the messages we receive (Art. 6(1)(f)).
• If you choose to tell us about a medical condition that could affect the safety of the flight, we use that information only to decide, together with the pilot, whether the flight can be done safely. The legal basis is your explicit consent (Art. 9(2)(a) GDPR). We do not ask you for medical documents.

3.4. Photos and videos from your flight

• Data: your image, recorded during the flight.
• Purpose: to send you the photos and videos, which are included in your flight.
• Legal basis: performance of the contract (Art. 6(1)(b)).
• The files are kept in a cloud storage service, and we send you a personal link to the Your flight footage page. The link contains, in encrypted form, your first name, the date of the flight, the download address and the expiry date; the website does not save them in a database.

3.5. Publishing photos of you

Photos or videos in which you appear are published on the website or on our social media only with your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by writing to us: we will remove them from the website and delete them from social media as far as the platforms allow.

3.6. Visiting the website

When you visit the website, our hosting provider, Cloudflare, processes technical data (IP address, browser type, pages requested, time of access) to deliver the pages and protect them from attacks. The legal basis is our legitimate interest in having a working and secure website (Art. 6(1)(f)). You can read more about data stored in your browser in our Cookie policy.

To know how many visits the website gets and how quickly its pages load, we use Cloudflare Web Analytics. It sets no cookies, stores nothing in your browser and doesn't follow you across other websites: we only see aggregated statistics, such as the pages visited, the country, the type of device and browser, the website you came from and loading times. The legal basis is our legitimate interest in understanding how the website is used and improving it (Art. 6(1)(f)).

The videos on the website come from our YouTube channel and load only when you press play. From that moment, YouTube (Google) receives technical data about the visit, such as your IP address, and processes it under its own privacy policy.

3.7. Legal obligations

We keep financial and accounting records and respond to requests from the authorities when the law requires us to (Art. 6(1)(c)).

4. Who we share your data with

We work with providers that process data only for the services they provide to us:

• Cloudflare, Inc.: hosting and securing the website, and forwarding emails sent to contact@onesky.ro to our mailbox;
• Google (Gmail): the mailbox in which we receive your messages and from which we send you your vouchers;
• NETOPIA Payments: card payment processing;
• Digi (cloud storage service): storage and download of the photos and videos from your flight;
• WhatsApp (Meta): when you write to us on WhatsApp or we send you the link to your video there; WhatsApp's policy also applies;
• accounting services and, where the law requires it, public authorities or courts.

5. Transfers outside the European Union

Cloudflare and Google may also process data in the United States. These transfers take place under the EU-US Data Privacy Framework and/or the standard contractual clauses approved by the European Commission.

6. How long we keep your data

• Order and voucher data: for as long as the voucher is valid, and then for the general limitation period of 3 years, in case of any complaints. We keep tax documents for as long as financial and accounting law requires.
• Booking messages: for as long as they are needed to organise the flight and to answer any later questions.
• Photos and videos: for a limited period after the flight, so that you can download them. The deadline is shown on your download page.
• Material published with your consent: until you withdraw your consent.
• The voucher basket in your browser: stays on your device until you empty it or clear the site's data.

7. Your rights

Under the GDPR, you have the right:

• to find out what data we hold about you and to receive a copy (access);
• to correct inaccurate data (rectification);
• to ask for your data to be erased (the “right to be forgotten”);
• to ask for the processing to be restricted;
• to receive your data in a structured format (portability);
• to object to processing based on our legitimate interest;
• to withdraw your consent at any time, without affecting the processing carried out before you withdrew it.

To exercise any of these rights, write to us at contact@onesky.ro. We will reply free of charge within one month at most (a period that can be extended by two further months for complex requests, in which case we will let you know). We may ask you for additional information to confirm your identity.

If you are not satisfied, you can lodge a complaint with Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, București, email anspdcp@dataprotection.ro.

8. Children's data

Flights for minors are booked by their parent or legal guardian, who gives us the necessary details (for example, the child's name and weight). We publish photos of minors only with the consent of their parent or guardian.

9. Data security

The website uses encrypted connections (HTTPS), payments are processed exclusively on the NETOPIA Payments page, and the personal links to your videos are encrypted and expire. Access to your data is limited to the people who need it to provide our services to you.

10. Automated decisions

We do not make decisions based solely on automated processing of data, and we do not carry out profiling.

11. Changes

We may update this policy when the way we process data changes. The date of the latest update appears at the top of the page.