Airly respects the personal data of its customers and users of Airly products and services, and complies with the data protection requirements of generally applicable laws, in particular the Regulation (EU) 2016/679 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR). Airly takes care of the security of the data of users of Airly products and services, using appropriate technical, logistical, administrative, and physical protection measures for this purpose. Airly ensures that Airly employees and associates are trained in data protection.

This Privacy Policy (hereinafter referred to as the “Privacy Policy”) sets out the rules for Airly’s processing of personal data in the use of Airly products and services, in particular on the airly.org platform, the Airly mobile application and the Airly AI Word Plugin.

The controller of your personal data is Airly sp. z o.o. with its registered office in Kraków, ul. Mogilska 43, 31-545 Kraków.

You can contact us through:

• postal address: 43 Mogilska St., 31-545 Krakow;
• e-mail address: rodo@airly.org

1. Conclusion, execution and settlement of a contract for the provision of services and/or sale of products

To conclude, execute and clear the contract, we may process the following personal data: identification data (name, surname, business name), address data, data on professional entitlements, job title, tax ID, REGON, e-mail address, telephone number, bank account number, signature.

Legal basis: With regard to data necessary for performance or to take action at the request of the data subject prior to entering into a contract, e.g. identification data or data necessary to verify whether a person is authorized to represent the Customer – the legal basis is necessity for performance of the contract or to take action at the request of the data subject prior to entering into a contract [Article 6(1)(b) GDPR].
With regard to data that are not necessary, but facilitate communication with the customer in connection with the conclusion, execution and settlement of the contract – the legal basis is the administrator’s legitimate interest in maintaining contact with customers [Article 6(1)(f) GDPR].
With regard to the fulfillment of Airly’s obligations under the law, including, but not limited to, tax and accounting regulations – the necessity to fulfill the controller’s legal obligation (Article 6(1)(c) GDPR].

Storage period: For the purpose of entering into, executing and settling the contract, your data will be processed for the duration of the contract, and thereafter until the statute of limitations for claims related to the performance of the contract (as a rule, the statute of limitations expires at the end of the calendar year after three years from the due date of the claim).
In order to comply with our tax and accounting obligations, your data will be kept for five years after the end of the fiscal year from which the invoice in question originated.

2. Creation and maintenance of ADP Account (Airly Data Platform) in Airly Platform

In order to create and maintain an ADP Account on the Airly Platform, we may process the following personal data: first name, last name, email address, login, temporary password, access information for certain sensors, IP address.

Legal basis: Necessity for the performance of the contract [Article 6(1)(b) GDPR].

Storage period: Your data will be processed for the duration of the contract, and thereafter until the statute of limitations for claims related to the performance of the contract (as a rule, the statute of limitations expires at the end of the calendar year after three years from the due date of the claim).

3. Purchase, recording and monitoring of sensor operation

For the purpose of purchasing, registering and monitoring sensor performance, we may process the following personal data: first name, last name, email address, telephone number, job title, business, and address.

Legal basis: Necessity for the performance of the contract [Article 6(1)(b) GDPR].

Storage period: Your data will be processed for the duration of the contract, and thereafter until the statute of limitations for claims related to the performance of the contract (as a rule, the statute of limitations expires at the end of the calendar year after three years from the due date of the claim).

4. Creation and maintenance of an API Account

In order to create and maintain an API Account, we may process the following personal data: email address, when logging in with Facebook: first name, last name, gender profile photo; when logging in with Google: first name, last name, profile photo, email address; when logging in with Github: username, email address.

Legal basis: Necessity for the performance of the contract [Article 6(1)(b) GDPR].

Storage period: Your data will be processed for 7 days after you request to delete your account.

5. Using the Airly AI for Word

In order to use the Airly AI for Word, we may process your personal data in the form of your email address and the data you enter into the application.

Legal Basis: Data obtained to enable you to use the Airly AI Word Plugin application is processed on the basis of necessity for the performance of the digital service contract that is the Airly AI Word Plugin application [Article 6(1)(b) GDPR].

Storage period: Your data will be processed for the duration of the contract, i.e. for the period during which you have the Airly AI Word Plugin app installed on your device, and after that period until the statute of limitations for any claims related to the provision of the app to you and your use of its functionality (as a rule, the statute of limitations expires at the end of a calendar year after three from the date the claim is due).

6. Creating and maintaining an Airly AI app account on Airly Platform

In order to create and maintain an Airly AI app account on Airly Platform, we may process the following personal data: first name, last name, email address, login, temporary password, information you entered into the Airly AI app, IP address.

Legal basis: Necessity for the performance of the contract [Article 6(1)(b) GDPR].

Storage period: Your data will be processed for the duration of the contract, and thereafter until the statute of limitations for claims related to the performance of the contract (as a rule, the statute of limitations expires at the end of the calendar year after three years from the due date of the claim).
To the extent that your data is processed by OpenAI Ireland Ltd to enable you to use Airly AI app, the information you enter into the Airly AI app will be processed by OpenAI Ireland Ltd for a period of 30 days after you enter it into the app, unless OpenAI is legally required to retain it.

7. Marketing of Airly products and services

In order to advertise our products and services, we may process the following personal data: name, surname, email address, telephone, job title, business name, other data obtained from publicly available sources.

Through Google Analytics: Google Analytics cookies (data related to your device and browser and your actions on the website or application), advertising identifiers (cookies related to Google ads).

If you use the Airly mobile app, upon your request, we may send you PUSH messages informing you of current Airly promotions, products and services. At your request, Airly may also send you PUSH messages informing you of current Airly promotions, products and services dedicated to your location. In any of the above cases, the sending of messages and the processing of location data is voluntary and is done upon your consent, which can be withdrawn at any time, without prejudice to the use of other features of the application.

If you use our social media (Facebook, Instagram, Twitter, LinkedIn, YouTube), we process the data you have shared while using these social media (e.g. your ID, photo, posts, comments, likes).

The rules for the processing of personal data by the controllers of the aforementioned social networks can be found at the following links:

• for Facebook and Instagram: https://www.facebook.com/privacy/center/ 

• for Twitter: https://twitter.com/en/privacy 

• for Linkedin: https://pl.linkedin.com/legal/privacy-policy 

• for YouTube: https://policies.google.com/privacy

Legal basis: The controller’s legitimate interest in marketing its own products and services [Article 6(1)(f) GDPR].

Storage period: Your data will be processed for a period of 14 months after collection, unless you have earlier objected to the processing of your data.

8. Using the mobile app

In order to use the mobile application, we may process the following personal data: email address, data you provided in an email sent to Airly, location data, information regarding your request to receive marketing notifications, information regarding your request to receive job offers and current recruitments.

At your request, Airly may:

• process location data to allow you to check the air quality status at your location in the app,
• send PUSH messages on the air quality condition at your location,
• enable you to use a widget service that keeps you updated on the air quality condition at your location including when the app is not active or running in the background
• send PUSH messages on Airly job openings and Airly’s current recruitments specific to your location.

Airly processes information that may (but need not) be considered personal data, using third-party-provided tools that perform similar functions to cookies, to maintain, improve and develop the app and customize some of the content you see in the app to your preferences.

Provision of the above data is completely voluntary, but necessary for all purposes mentioned above. You can change your location sharing settings at any time and withdraw your consent to receive marketing information or information about job openings (and current recruitments).

Legal basis: Data obtained to enable you to use the mobile application is processed on the basis of necessity for the performance of the contract for the provision of a digital service that is the Airly app [Article 6(1)(b) GDPR].

Data obtained for the purpose of providing information about job offers and current recruitments conducted by Airly is processed on the basis of your consent [Article 6(1)(a) GDPR].

Storage period: Your data will be processed for the duration of the contract, i.e. for the period during which you have the Airly app installed on your device, and after that period until the statute of limitations for any claims related to the provision of the app to you and your use of its functionality (as a rule, the statute of limitations expires at the end of a calendar year after three from the date the claim is due).

9. Contact by phone, through contact forms, email and traditional correspondence and social media, among others

In order to respond to the questions you ask in the contact form, conduct email or traditional correspondence, and contact you via telephone, we may process the following personal data: first name, last name, job title, business name, address, email address, telephone number, and message content.

If you use our social media (Facebook, Instagram, Twitter, LinkedIn, YouTube) to contact us or keep in touch with us, we process the data you have shared while using these social media (e.g. your ID, photo, message content).

Legal basis: the controller’s legitimate interest in maintaining contact with customers [Article 6(1)(f) GDPR].

Storage period: Your data will be processed for the period of carrying out the correspondence, and after its completion until the statute of limitations for any claims related to the correspondence (as a rule, the statute of limitations expires at the end of a calendar year after three from the date the claim is due).

10. Determination, prosecution or defense of claims

In order to protect our interests if a dispute arises between us and you, we may process your personal data indicated in the points above.

Legal basis: The controller’s legitimate interest in protecting our interests in the event of a potential dispute at the court or pre-court stage [Article 6(1)(f) GDPR].

Storage period: Your data will be processed until the statute of limitations for claims (as a rule, the statute of limitations expires at the end of a calendar year after three from the date the claim is due).

1. Airly has direct access only to the personal information you have provided. Some of the information about you, which may (or may not) be considered personal data, is processed by Airly through the use of tools with similar functions to cookies, provided to Airly by third-party providers.
2. Airly may also be the controller of your personal data that you have provided to the operator of the system you use to use the Airly application, e.g. Android (Google Ireland Limited). This may include data such as your IP address or device ID. Despite having administrator status, Airly does not have direct access to this data i.e. it is not visible to Airly. However, the processing of this data is necessary to enable you to use the Airly mobile application.
3. Airly may also have access to data that may (though not necessarily) be personal information. In order to maintain, improve and develop the app and customize some of the content you see in the app to your preferences, Airly uses information received through tools with similar functions to cookies, provided by third parties. This may include information such as the identifiers of the mobile devices you use, the language of your device, the time you open the app, and other data you have provided to the entity that owns such a tool (see below for more details on tracking tools). Provision of this data is voluntary and does not affect your ability to use the Airly mobile application. The rules for sharing the data in question are set by the entities that own such tools (see below for more details regarding tracking tools).

Airly uses the Google Analytics tool provided by Google Ireland Limited, which performs similar functions to cookies. In order to maintain, improve and develop the Airly app and to tailor some of the content you see in the app to your preferences, Airly uses information provided by Google Analytics. The information in question may be the identifiers of the mobile devices you use, the language of your device, the time you open the app and other data you have provided to Google.

Airly uses HotJar provided by Hotjar Limited, which allows us to track traffic to our website and thus see which features are more appealing and which are not popular. Through HotJar, we have access to information such as the operating system and web browser you use, the sub-pages you view within Airly’s website, your browsing time, the source from which you go to our website, the buttons you click on.

Airly is not able to identify your identity from the data provided by the tracking tools indicated above.
Information about Google Analytics and HotJar and how these tools work can be found here:

• Google Analytics: https://policies.google.com/technologies/ads
• HotJar: https://www.hotjar.com/legal/policies/privacy/

Your personal data will not be used for automated decision-making affecting your rights, obligations or freedoms within the meaning of the GDPR. We use tracking technologies by which your personal data may be subject to profiling that allows us to personalize the advertisements we target to you, but this does not affect your legal position.

For the purposes mentioned above, and in particular to enable you to use the Airly mobile application, your data may be shared with Airly’s trusted partners.

Airly shall only share data that is necessary to achieve the processing purposes indicated above and only for the fulfillment of such purposes. Airly ensures that the sharing of your data with third parties is carried out in compliance with the security rules provided by law (in particular the GDPR) as well as in accordance with the provisions of this Privacy Policy.

Your personal data may be processed by entities such as:

• legal and/or accounting services providers;
• postal operators and delivery companies;
• hosting and/or cloud services providers;
• e-mail services providers;
• payment services providers;
• Software as a Service services providers enabling Airly internal communication, project and task management and maintain and maintain contact with you;
• providers of tools that perform functions similar to cookies.

Your personal data may be transferred by Airly to recipients outside the European Economic Area (so-called third-country recipients) under the terms of Chapter V of the GDPR.

In connection with the purposes mentioned above, Airly may share your personal information with its trusted Partners such as:

• Airly Air Quality Services Ltd. based in Derby, England, which is an affiliate of Airly, with which Airly cooperates to handle certain projects of an international nature, particularly projects in the United Kingdom;
• Airly, Inc. based in Dover, Delaware, USA, which is the sole shareholder of Airly;
• Amazon Web Services EMEA SARL, based in Luxembourg, whose hosting services are used by Airly. Amazon Web Services EMEA SARL, in connection with the provision of hosting services, may transfer data to its partners outside the EEA, including, in particular, companies with equity affiliates of Amazon Web Services EMEA SARL, including, in particular, Amazon Web Services, Inc. headquartered in Seattle, Washington USA. A full list of entities that may be recipients of data processed in connection with Airly’s use of AWS hosting services can be accessed at the following link: https://aws.amazon.com/compliance/sub-processors/;
• GitHub, Inc. based in San Francisco, USA, whose services, with regard to the provision of the GitHub tool (i.e. the tool used to host application code), are used by Airly, and (possibly) other entities to which GitHub, Inc. transfers data in connection with the provision of the Github tool. A full list of entities that may be recipients of data processed in connection with Airly’s use of the GitHub tool can be accessed at the following link: https://github.com/privacy/subprocessors;
• Google Ireland Limited, based in Dublin, Ireland, whose services, with regard to the provision of the GA4 tool (i.e. the tool used to monitor and maintain the stability of the Airly website and application, as well as to conduct other marketing activities), are used by Airly. In connection with the provision of the GA4 tool, Google Ireland Limited may transfer data to its partners outside the EEA, including, in particular, Google LLC, headquartered in Mountain View, California, USA, which is its affiliate. A full list of entities that may be recipients of data processed in connection with Airly’s use of the GA4 tool can be accessed at the following link: https://business.safety.google/adssubprocessors/;
• Hubspot, Inc. based in Cambridge, Massachusetts, USA, whose services, with regard to the provision of the Hubspot tool (i.e., a CRM-type tool for storing information about concluded contracts, contractors, current sales, sending mailings and managing the shipment of Arily products, etc.), are used by Airly and (possibly) other entities to which Hubspot, Inc. transfers data in connection with the provision of the Hubspot tool. The full list of entities that may be recipients of data processed in connection with Airly’s use of the Hubspot tool can be accessed at the following link: https://legal.hubspot.com/sub-processors-page;
• OpenAI Ireland Ltd, based in Dublin, Ireland, whose services, with regard to the provision of the OpenAI API Platform tool used by Airly for the provision of the Airly AI services and the Airly AI Word Plugin, and (possibly) other entities to which OpenAI Ireland Ltd transfers data in connection with the provision of the OpenAI API Platform tool. A full list of entities that may be recipients of data processed in connection with Airly’s use of the OpenAI API Platform tool can be accessed at the following link: https://platform.openai.com/subprocessors;
• Rollbar, Inc. based in San Francisco, USA, whose services, with regard to the provision of the Rollbar tool [i.e., a tool for the detection, reporting, analysis and subsequent repair of software bugs that may occur in certain Airly products provided to customers and users (e.g., APIs, ADPs)], are used by Airly and (possibly) other entities to which Rollbar, Inc. transfers data in connection with the provision of the Rollbar tool. A full list of entities that may be recipients of data processed in connection with Airly’s use of the Rollbar tool can be accessed at the following link: https://docs.rollbar.com/docs/data-subprocessors;
• Slack Technologies Limited, based in Dublin, Ireland, which provides Airly with services consisting of access to the Slack tool (i.e. an internal communication and project management tool). In connection with the provision of the Slack tool, Slack Technologies Limited may transfer data to its partners outside the EEA, including, in particular, companies affiliated with Slack Technologies Limited. A full list of entities that may be recipients of data processed in connection with Airly’s use of the Slack tool can be accessed at the following link: https://www.salesforce.com/company/legal/trust-and-compliance-documentation/;
• Stripe Payments Europe, Ltd. with headquarters in Dublin, Ireland, whose services, in terms of providing the Stripe tool (i.e. an online payment processing tool), are used by Airly. In connection with the provision of the Stripe tool, Stripe Payments Europe, Ltd. may transfer data to its partners outside the EEA, including, in particular companies affiliated with Stripe Payments Europe, Ltd., in particular Stripe, Inc. headquartered in San Francisco, California, USA. A full list of entities that may be recipients of data processed in connection with Airly’s use of the Stripe tool can be accessed at the following link: https://stripe.com/en-pl/legal/service-providers;
• The Rocket Science Group, LLC, with headquarters in Atlanta, Georgia, USA, whose services, in terms of providing the Mailchimp tool (i.e. the tool used to send mailings to Airly API users), are used by Airly, and (possibly) other entities to which The Rocket Science Group, LLC transfers data in connection with the provision of the Mailchimp tool. A full list of entities that may be recipients of data processed in connection with Airly’s use of the Mailchimp tool can be accessed at the following link: https://shorturl.at/dosGY.

Therefore, the transfer of your personal data to a third country may be based on the following legal mechanisms:

• the European Commission’s decision finding adequate protection of personal data by a third country – Airly transfers your personal data to entities based in the United Kingdom, where, in accordance with the mentioned European Commission’s decision, an adequate level of protection of personal data is ensured. The European Commission’s decision finding adequate protection of personal data by the United Kingdom, i.e. Decision 2021/1772 of June 28, 2021, is currently in force. The aforementioned decision is available in the database of European Union legislation (Access to European Union Law) at http://eur-lex.europa.eu;
• the European Commission’s decision finding adequacy of protection for safe and trusted data flows between the EU and the US – Airly transfers personal data to entities, based in the US, that have committed to participate in the EU-US Data Privacy Framework. According to the European Commission’s decision, personal data can safely flow from the EU to entities participating in the Data Privacy Framework, and no additional data protection safeguards are required. The European Commission’s Implementing Decision of July 10, 2023, issued on the basis of the Regulation (EU) 2016/679 of the European Parliament and of the Council, stating the adequate level of personal data protection provided by the EU-US Data Protection Framework, is currently in force. The text of the decision is available in the Database of European Union legislation at http://eur-lex.europa.eu. A list of entities enrolled in the Data Protection Framework can be found at https://www.dataprivacyframework.gov/s/participant-search;
• standard contractual clauses – Airly transfers personal data to entities outside the EEA that have committed themselves to use standard contractual clauses and provide an adequate level of security for the personal data received. The standard contract clauses indicated in European Commission decision 2021/914 of June 4, 2021, shall apply. The aforementioned decision is available in the database of European Union legislation (Access to European Union Law) at http://eur-lex.europa.eu;
• performance of the contract – in certain exceptional cases where a data recipient from a third country has not committed itself to the application of standard contractual clauses, your data may be transferred where this is necessary to perform the contract between you and Airly or to implement pre-contractual measures taken at your request;
• your consent – if none of the above grounds for data transfer to a recipient outside the EEA apply, Airly will only transfer your data to a recipient from a third provided you have given your explicit consent. Nevertheless, we would like to inform you that in such a case there is a risk that your personal data will not be adequately protected when transferred to a recipient outside the EEA.

In connection with the processing of your personal data, you have the following rights:

1. 1. Right of access to personal data – you have the right to obtain information about, among other things, what personal data is processed by Airly, for what purposes, to whom it is shared, for how long it is processed (or based on what criteria this time is determined), etc.
   2. Right to rectification and completion of personal data – you can request rectification of your data if it is incorrect and completion of incomplete personal data.
   3. Right to erasure of personal data – you can demand immediate erasure of your personal data when:
      • the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
      • your consent to process your personal data has been effectively withdrawn;
      • you have objected to the processing of personal data for marketing purposes;
      • you have objected to the processing (including through profiling) of your personal data based on a third-party legitimate interest pursued by the controller, unless there are valid, legitimate grounds on the part of the controller for the processing of your personal data that override your interests, rights and freedoms, or there are grounds for establishing, asserting or defending claims.
   4. Right to restrict the processing of personal data – you can request to restrict the processing of personal data when:
      • you question the accuracy of your personal data – for a period of time to allow you to verify the accuracy of the questioned data;
      • in your opinion the processing is unlawful, and you object to the deletion of the personal data, requesting instead the restriction of its use;
      • your personal data are no longer needed for the purposes of processing, but you need them to establish, assert or defend claims;
      • you have raised an objection [under Article 21(1) GDPR] to the processing – until it is determined whether the controller’s legitimate interests prevail over the basis of your objection.

        If you have requested a restriction of the processing of your personal data, we will refrain from processing your data except for storage or in order to determine, prosecute or defend claims, or to protect the rights of another natural or legal person, or for compelling reasons of public interest of the European Union or a Member State. You will be informed before the restriction of processing is lifted.

   5. Right to data portability – you may request that your personal data be released in a structured, commonly used, machine-readable format and sent to another controller. The above applies when data is processed on the basis of consent [Article 6(1)(a) GDPR] or on the basis of a contract [Article 6(1)(b) GDPR] and when processing is carried out by automated means.
   6. Right to object to processing – if the legal basis for the processing of your data is the legitimate interest of the controller [Article 6(1)(f) GDPR], you may object to the processing of your personal data.
   7. Right to withdraw consent – you may withdraw your consent to the processing of personal data at any time, which will not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal.
   8. Right to lodge a complaint with the President of the Office for Personal Data Protection – if Airly commits a violation in connection with the processing of your personal data, you may lodge a complaint with the relevant authority. Details on how to file a complaint with the President of the Office for Personal Data Protection (Prezes Urzędu Ochrony Danych Osobowych) can be found at: https://uodo.gov.pl/pl/p/kontakt.

You may submit any requests to Airly for the exercise of your rights to the email or postal address indicated at the beginning of this document, or by any other means of your choice.

You can find all the information on how we use cookies in our Cookies Policy.

This Privacy Policy may be subject to updates and changes. In such case, Airly will take steps to inform you of any updates or changes that occur, e.g. by sending you appropriate notifications. Notwithstanding the foregoing, Airly recommends that you review this page as often as possible.

This Privacy Policy was last amended on 6.03.2024.