1. General provisions

1.1. This Policy sets out how the personal data of users of the FLYWEE service, available at https://flywee.net (the "Service"), is processed and protected.

1.2. The operator of personal data is the FLYWEE project (https://flywee.net), e-mail support@flywee.net (the "Operator"). Questions about the processing of personal data are sent to the Operator at this address.

1.3. This Policy was drawn up in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27.07.2006 "On Personal Data", Federal Law No. 149-FZ of 27.07.2006 "On Information, Information Technologies and the Protection of Information" and Law of the Russian Federation No. 2300-1 of 07.02.1992 "On the Protection of Consumer Rights".

1.4. This Policy is a public document and is freely available on the Site in accordance with Part 2 of Article 18.1 of Federal Law No. 152-FZ.

2. Principles of processing

2.1. Personal data is processed lawfully and fairly and only for specific, predetermined and legitimate purposes.

2.2. Databases whose processing serves incompatible purposes are not combined.

2.3. Only the data that serves the purposes of processing is processed. Its content and volume are not excessive.

2.4. The Operator keeps the data it processes accurate and up to date.

2.5. Data is kept no longer than the purposes of processing require.

3. Categories of data subjects and the data processed

3.1. The Operator processes the personal data of two categories of data subjects: clients - users who have registered an account - and visitors of the Site.

3.2. At registration, the e-mail address and the password are processed. The password is stored as a cryptographic hash and is not available to the Operator in plain form.

3.3. The user may also give a game nickname. Giving a nickname is voluntary.

3.4. When the Service is used, information about flights is processed: the aircraft type, the departure and destination airports, the date, the duration of the flight, the participants of the flight, and the plan in force and its term.

3.5. The user may add other users to a friends list. Information about these connections is processed to show joint flights.

3.6. While the plugin works, technical session data is processed: the device's network address, the session identifier and the service parameters of the connection. Cockpit data is passed between the devices of the participants of a joint flight and is not stored by the Operator.

3.7. When a paid plan is paid for, information about the payment is processed: the amount, the date, the order identifier and its status. Full bank card details are not passed to the Operator and are not stored by it.

3.8. When the user contacts support, the e-mail address, the content of the request and the materials attached to it are processed.

3.9. When the Site is visited, the cookies needed for signing in and keeping the session are processed automatically.

3.10. The Operator does not process special categories of personal data or biometric personal data.

3.11. The Operator does not take decisions that produce legal consequences for the data subject solely on the basis of automated processing.

4. Purposes and legal grounds of processing

4.1. Preparing, concluding and performing a civil contract. For this purpose the Operator registers and keeps the account, authenticates the user, gives access to the functions of the Service within the plan, provides joint flights, keeps the history of flights and the friends list, checks the term of the plan, keeps sign-in and the user's session working, considers requests and claims, provides support, and sends service notices about changes of terms, technical works and the end of the paid period. Legal ground: clause 5 of Part 1 of Article 6 of Federal Law No. 152-FZ - processing is necessary to perform a contract to which the data subject is a party, and to conclude a contract on the data subject's initiative. Category of data subjects: clients. Service notices are not advertising and are sent as part of performing the contract.

4.2. Complying with the tax law of the Russian Federation. For this purpose information about payments is processed, the document confirming a payment is formed and sent, and accounting obligations are performed. Legal ground: clause 2 of Part 1 of Article 6 of Federal Law No. 152-FZ - processing is necessary to perform the functions, powers and duties imposed on the operator by law. Category of data subjects: clients.

4.3. Data necessary to perform the contract is processed without a separate consent of the data subject.

4.4. Consent to the processing of personal data, where it is required, is given separately from other information and documents that the data subject confirms or signs, in accordance with Part 1 of Article 9 of Federal Law No. 152-FZ as amended by Federal Law No. 156-FZ of 24.06.2025. Pre-ticked consent boxes are not used.

4.5. The personal data of persons aged fourteen to eighteen is processed with the consent of their legal representatives in the cases provided by law. Persons under fourteen may not register.

5. Procedure and conditions of processing

5.1. Processing consists of collecting, recording, systematising, accumulating, storing, clarifying (updating, changing), retrieving, using, transferring (providing, giving access), depersonalising, blocking, deleting and destroying personal data.

5.2. Processing is mixed - with and without automation - with transfer of the information over the Internet and without transfer over the Operator's internal network.

5.3. The Operator may not require the user to provide personal data unless this is provided by law or is connected with the performance of the contract.

6. Location of databases

6.1. Recording, systematising, accumulating, storing, clarifying and retrieving the personal data of citizens of the Russian Federation is done with databases located in the territory of the Russian Federation, in accordance with Part 5 of Article 18 of Federal Law No. 152-FZ. The databases of accounts, flights and payments are located in the territory of the Russian Federation.

6.2. Personal data is not passed to advertising systems, web analytics systems or other third-party platforms. For a payment made through the international payment page, the e-mail address, the account number, the order identifier and the amount are passed to the payment agent Tribute (TRBT Limited, Republic of Cyprus), and the payment itself is made on its page under its own privacy policy. This is a cross-border transfer to the Republic of Cyprus, a party to Council of Europe Convention 108, which provides adequate protection of personal data.

6.3. The Operator does not sell personal data and does not pass it on for advertising purposes.

7. Transfer of personal data to third parties

7.1. Personal data is passed to third parties only to the extent necessary to perform the contract and in the cases expressly provided by law.

7.2. Information about a payment is passed to the payment service that accepts it, to the extent necessary to make the payment and to send the document confirming it.

7.3. Information is passed to authorised state bodies on requests made in the cases and to the extent provided by law.

7.4. The user's nickname and information about the user's flights are available to other users only within the limits set by the settings of the Service: to the participants of a joint flight and to users added to the friends list.

7.5. Processing of personal data may be entrusted to third parties under a contract that obliges them to keep it confidential and to meet the requirements for its protection, in accordance with Part 3 of Article 6 of Federal Law No. 152-FZ. The Operator answers to the data subject for the actions of such persons.

8. Cookies

8.1. The Site uses only the technically necessary cookies that keep the user signed in and the session going. Without them signing in to the account is impossible, so these files are used without separate consent.

8.2. Analytics and advertising cookies, visitor counters and third-party web analytics are not used on the Site.

8.3. The user may switch cookies off in the browser settings. With them off, signing in to the account becomes impossible.

9. Storage periods and destruction of data

9.1. Account data is stored for as long as the account exists.

9.2. Information about payments is stored for the periods set by law for keeping documents confirming payments, and for no less than five years.

9.3. Information from requests is stored for three years from the date their consideration was completed.

9.4. Technical session data is stored for no more than twelve months.

9.5. When an account is deleted, personal data is destroyed within thirty days of receiving the request, except data that must be kept to perform obligations or is required by law.

9.6. When the purposes of processing are achieved, or there is no longer a need to achieve them, personal data is destroyed within thirty days. The destruction is confirmed by a statement, and for automated processing by a statement and an extract from the event log.

10. Rights of the data subject

10.1. The data subject has the right to receive the information about the processing of their personal data provided by Part 7 of Article 14 of Federal Law No. 152-FZ.

10.2. The data subject has the right to demand that their personal data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose.

10.3. The data subject has the right to withdraw consent to the processing of personal data, and to appeal against the actions or inaction of the Operator to Roskomnadzor or in court.

10.4. Requests are sent to support@flywee.net from the e-mail address given when the account was registered.

10.5. The answer is sent within ten working days of receiving the request. The period may be extended by no more than five working days, with a reasoned notice sent to the data subject.

11. Measures to protect personal data

11.1. The Operator applies the measures provided by Articles 18.1 and 19 of Federal Law No. 152-FZ, including appointing a person responsible for organising processing, issuing local acts, limiting the circle of persons with access to the data, storing passwords as cryptographic hashes, using a secure connection to transfer data, backups, and internal control that processing meets the requirements of the law.

11.2. The fourth level of protection of personal data processed in an information system is set in accordance with Decree of the Government of the Russian Federation No. 1119 of 01.11.2012. Cryptographic information protection tools subject to conformity assessment are not used by the Operator.

11.3. If personal data is unlawfully or accidentally transferred in a way that violates the rights of data subjects, the Operator notifies Roskomnadzor of the incident within twenty-four hours and of the results of its internal investigation within seventy-two hours.

12. Final provisions

12.1. The Operator may change this Policy. The edition in force is published at https://flywee.net/en/privacy with its date.

12.2. This Policy comes into force on the date given in its heading and is in force until replaced by a new edition.