LEGAL INFORMATION

Privacy Policy

Version: 2026-08-20 Effective date: 20 August 2026 Deutsch

1. Data controller

PawWings, Maya Apps operates this social responsibility project. The operator responsible for processing personal data is:

Mustafa Samet Sığırcı – Software- und App-Entwicklung
Sole proprietorship operating in Germany, not entered in the commercial register
Business address:Ulzburger Str. 136, 22850 Norderstedt, Deutschland
Privacy: info@pawwings.org
General contact: info@pawwings.org

No separate data protection officer has been appointed because the conditions requiring one currently do not apply. Privacy requests can be sent directly to the address above.

2. What does this policy cover?

This policy explains personal data processing in the PawWings web and Android applications, profiles, verification, flight listings, contact requests, notifications and support. PawWings is not an airline, transport company, veterinary service or emergency service.

3. Categories of data we process

Category	Examples	Purpose
Identity and account	External identity provider user key, email and email verification status	Secure sign-in and linking the account to the correct PawWings profile
Profile	First name, last name, phone, country, account type and age declaration	Creating profiles, managing permissions and communicating after approved matches
Legal records	Accepted document type and version, acceptance time and limited security evidence	Evidence of which notices and terms were accepted
Verification	Public rescue reference; organisation name, country, registration number and applicant role	Assessing the reliability of rescuer and organisation accounts
Flight and match	Route, date, availability, transport note, contact request and decision status	Finding suitable flights and enabling controlled matching between parties
Contact and notifications	Email address, phone number and notification delivery status	Notifying request outcomes and releasing contact details to approved parties
Security and operations	Pseudonymous PawWings IDs, action code, time, status and correlation ID	Preventing abuse, resolving errors and investigating security incidents

Within the MVP, we do not request Turkish ID numbers, ID or passport files, full dates of birth, home addresses or payment information. Passwords, access tokens, raw emails or phone numbers, raw IP addresses and full user agents must not be written to ordinary application or audit logs.

4. Purposes and legal bases

Providing the service and pre-contractual steps at the user's request: GDPR Article 6(1)(b) for account and profile management, flight listings, verification, contact requests and notifications.
Legitimate interests: GDPR Article 6(1)(f) for service security, fraud and abuse prevention, minimal audit records and technical troubleshooting. These interests are balanced against users' rights.
Legal obligation: GDPR Article 6(1)(c), where applicable law requires record retention or responses to authorities.
Future features requiring an explicit choice: if optional analytics, marketing or device access is added, it will be disabled by default and separate consent will be requested where necessary under GDPR Article 6(1)(a) and TDDDG §25.

The Privacy Policy checkbox is not blanket consent to all processing; it records that a specific version was read. Processing not based on consent is explained above with its own legal basis.

Required information and consequences of not providing it:Required profile fields are contractually necessary to create a profile and provide protected matching functions. Without them, profiles cannot be created and protected features such as publishing flights, verification and contact requests are unavailable. Optional fields can remain empty. Public flights can be viewed without a profile.

Automated decisions and profiling: PawWings does not make decisions with legal or similarly significant effects solely through automated processing. We do not use profiling, automated content moderation or personalised ranking. Verification and moderation decisions are reviewed by an authorised person.

5. Sharing contact details

Volunteers' emails and phone numbers are not shown in the public flight calendar or pending/rejected requests. When a verified rescuer or organisation requests contact, the volunteer sees only a limited summary needed for a decision. After the volunteer explicitly agrees, current emails and phone numbers are released only to each other.

PawWings does not sell user data or share it for behavioural advertising.

6. Recipients and service provider categories

Data may be processed with the following categories of recipients only as needed to operate the service:

Authentication through Microsoft Entra External ID,
Application hosting and technical logs on Microsoft Azure,
contracted PostgreSQL database hosting providers,
transactional email and, if enabled later, push notification providers,
competent authorities where legally required.

Providers processing data for PawWings are selected with appropriate processing agreements and access restrictions. Transfers outside the EEA will use an applicable adequacy decision, standard contractual clauses or another valid safeguard under GDPR Chapter V.

7. Cookies and device storage

The web application may use cookies or similar storage for strictly necessary functions such as secure sessions, sign-in redirects, request forgery protection and load balancing. The PawWings MVP does not use advertising, behavioural tracking or optional analytics cookies. If such technology is added, separate revocable consent will be offered before it runs.

Cookies used on Microsoft's sign-in page are subject to the Microsoft privacy information shown there.

8. Retention and deletion

Data is retained only as long as needed for the stated purpose. These are maximum product retention periods; records may be deleted earlier:

Direct profile identifiers after a verified account closure or deletion request: 30 days.
Accepted legal document versions and consent evidence after account closure: 1,095 days.
Completed, rejected or cancelled flight and contact process records: 365 days.
Rejected or withdrawn verification evidence and private references: 90 days.
Standard security audit records: 365 days; privileged administrator actions: 730 days.
Application logs: 30 days; encrypted backups: 35-day rotation.

Deletion request info@pawwings.org . After identity verification, direct identifiers are deleted or irreversibly anonymised. If limited records must be kept longer for legal obligations or defence of claims, they are separated from other uses, access is restricted and they are deleted when the reason ends. Deleted data is not restored from backups for active use.

9. Your rights

Where the conditions apply, you have rights of access, rectification, deletion, restriction, data portability, withdrawal of consent with future effect and objection to processing based on legitimate interests. Send your request info@pawwings.org . Reasonable identity verification may be requested to protect the requester.

You can also complain to a supervisory authority, particularly where you live or where the alleged infringement occurred. The authority responsible for the operator in Germany is: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD).

10. Security

PawWings uses transport encryption, least privilege, separate secret management, access controls, strong administrator authentication, state-based contact release and structured audit logs without personal data. No internet service can guarantee absolute security. Confirmed breach risks trigger the legally required assessment and notification processes.

11. Children

PawWings is for adults aged 18 and over only. We do not knowingly create children's accounts. If you believe a child's data is being processed, contact our privacy address.

12. Changes

Material changes lead to a new document version and, where needed, a request to accept the updated text. Earlier acceptance records are retained only with the relevant version and timestamp.