StormAro Privacy Notice and GDPR

Project owners, hosting and contact

StormAro.com is the project and brand created, built and owned by the creators acting as StormAro Team. StormAro Team is the public name of the creators, not automatically a separate legal person. Hosting does not give an infrastructure provider ownership of the project or brand.

BOMEGA spółka z ograniczoną odpowiedzialnością (Bomega Sp. z o.o.), Długa 2B, 56-416 Twardogóra, Poland, KRS 0000841054, NIP 9112034523, REGON 386056613, provides hosting, server maintenance and technical operations for StormAro.com. Under the platform owner's designation, Bomega is the controller of personal data processed in connection with operating the platform, to the extent that it determines the purposes and means of processing. Technical infrastructure services alone do not transfer ownership of the brand or its content.

Contact for personal-data requests and rights, incidents and technical operation of the platform: [email protected]. Enquiries about data independently handled by third-party providers, including weather and mapping providers, may also need to be directed to the relevant independent controller. Questions about data processing or responsibilities for particular features may be directed to the contact address above.

The creators acting as StormAro Team own the StormAro project and brand. Rights in particular works, software, images, trademarks and external data sources follow actual authorship, agreements and licences. Bomega acquires no such rights merely by hosting the site.

International transfers and retention

If a function requires transfers of personal information outside the European Economic Area, the controller must apply a valid transfer mechanism and safeguards required by law. Account information is retained while needed to provide requested account services, subject to applicable obligations. Technical, security and support records are retained as necessary for their purposes and legal requirements. Information stored solely in a browser remains until removed by the user or browser. Further legally required retention details can be requested using the published contact channel.

Categories and scope

Depending on the features used, StormAro may process account identifiers, voluntarily provided contact details, session identifiers, technical browser details, IP addresses and security logs. Chosen location, map preferences, routes, alerts and workspace data can be stored locally in the browser and synchronized when the relevant features are used.

Location and notifications

Location selection is used to find places and display weather data for those places. Granting precise browser geolocation or notification access is not required simply to view the site. Browser notification permissions may be withdrawn.

Purposes and legal bases

Processing necessary to provide requested account and service functions may rely on GDPR Article 6(1)(b). Necessary security records and abuse prevention may rely on Article 6(1)(f), subject to an interests assessment. Specific legal duties may rely on Article 6(1)(c). Optional processing requiring consent may rely on Article 6(1)(a), with a right of withdrawal. The applicable basis depends on the activity.

Providers and recipients

Depending on the layers and integrations enabled, technical requests or location queries can reach weather, map and infrastructure providers. Naming a provider on the page does not mean the platform stores all of its data. Information is disclosed to authorities when legally required.

Retention and deletion

Browser-stored information can be removed via available StormAro privacy controls or browser settings. Removing local data does not by itself delete account records, synchronized content, security evidence or support reports. Those records follow the relevant service and legal retention requirements.

Individual rights

Subject to GDPR conditions, individuals can request access, rectification, erasure, restriction, portability, object to processing and withdraw consent. They can also complain to the competent supervisory authority, including the Polish UODO where appropriate. Available account and support tools can assist with requests.

Locations and device data

The Service may process a selected town, coordinates entered by a user, or device-derived location where browser permission has been granted. These data support forecast selection, weather warnings, mapping and route weather analysis. Users may manually choose a location and manage geolocation permission in browser settings.

Home, workplace and frequently visited locations can indirectly identify an individual, particularly when linked to an Account. Users should consider privacy before sharing stored places or route links.

Accounts, login and sync

Account features may involve user identifiers, login details, selected preferences and the technical records necessary to authorise and synchronise information. Credentials must be protected, and passwords should not be transmitted to other users or included in support reports.

Certain preferences and stored items may be synchronised to the server when the Account feature is used. Not all locally stored information must be synchronised automatically.

Local storage, dashboards and favourite places

Browser storage may contain language and unit preferences, the selected map mode, stored locations, routes, dashboard arrangements, map scenes and widget settings. Some items are retained only on the device and may not be sent to the server.

Local storage is not automatically anonymous. Another person with access to the same browser profile may discover locations and preferences. Clearing site data can remove those records.

Weather alert settings and notifications

Where enabled, the Service can process selected warning areas, weather event preferences and the notification permission state. Browser alerts may use technical subscription identifiers necessary to direct a notification.

Disabling notifications in StormAro, the operating system or the browser can prevent new alerts. Users should also rely on official weather warnings in dangerous situations.

Technical data and security

Normal requests can involve IP addresses, timestamps, resource paths, browser information, error messages, session-related identifiers and anti-abuse counters. Such data support connectivity, access control, operational diagnosis and security.

These records may be personal data when they can be combined with other information. Access to logs should be limited to personnel who need them for operation and security.

Support requests and error reports

Support forms may collect a contact name, email, reported issue, relevant time, page and location, and any screenshot submitted by the user. Data are used to investigate and respond to reports.

Users should not send passwords, identity papers or third-party personal information unnecessarily. Inappropriate material may require restricted access or deletion according to applicable law.

Purposes and legal bases

Data needed to provide an Account or a requested functionality may be processed to perform the relevant electronic service agreement where Article 6(1)(b) GDPR applies. Data for preventing fraud and protecting infrastructure or lawful claims may rely on a properly assessed legitimate interest where applicable.

Legal obligations may provide another lawful basis. Consent may be relevant for specific purposes, but device permission for geolocation or notifications is not necessarily GDPR consent for every other form of processing.

Recipients and technical suppliers

Information can be accessible to authorised support staff, technical infrastructure, email, backup and security suppliers, and relevant weather-data providers to the extent needed for their services. Bomega Sp. z o.o. supplies hosting and technical infrastructure support; hosting alone does not establish control of the project's brand or all processing decisions.

Requests may be referred to the team responsible for the relevant issue. Information is disclosed to competent public authorities when there is an appropriate legal requirement.

Weather and mapping data providers

Forecasts and maps may use datasets and APIs of weather and mapping providers, including coordinates, the displayed area, requested variable and forecast period. A highly specific recurring location may be relevant to privacy even without a person's name.

Using a weather data provider does not by itself imply that the complete user account profile is disclosed to that provider. The terms and privacy notices of the relevant suppliers may apply to their own services.

Transfers outside the EEA

Where a relevant supplier handles personal data outside the European Economic Area, an appropriate lawful transfer mechanism and safeguards are required under Chapter V GDPR. Not all requests for weather information necessarily involve a transfer of personal Account data.

People may request information about relevant recipients and safeguards via the contact channels provided by the Service as required by applicable law.

Retention

Account data are generally needed while the Account and its functions are maintained. Locally saved data may remain until the user deletes them, the browser clears them or the Service's local storage changes. Support records may be needed while an issue is handled and for justified legal claims.

Security logs and backups may be stored separately where necessary for protecting infrastructure, recovery and legal obligations. Different categories of data need not share the same retention criteria.

Individual rights

Depending on the circumstances, individuals may request access, correction, erasure, restriction, portability or object to processing. Consent-based processing may be withdrawn without affecting the lawfulness of prior processing.

Data-protection requests may be forwarded through the stated contact channel, including [email protected] for technical referral. Individuals can complain to the competent supervisory authority, including Poland's President of the Personal Data Protection Office where applicable.

Automated weather presentation

StormAro automatically adapts weather layers, warnings and forecasts to selected locations, times and display settings. Such information matching does not in itself constitute a solely automated decision with legal or similarly significant effects under Article 22 GDPR.

Should new automated decisions or advertising profiling requiring special notice be introduced, additional information and individual rights would need to be addressed under applicable law.

Cookies and browser permission

Cookies, local storage and offline caches can support sessions, interface preferences and the requested application functions. The separate Cookie Notice explains those technologies.

Where a non-essential technology requires consent, it should be deployed only with the necessary information and permission. Blocking storage required for authentication or saving settings may limit selected functionality.