Privacy policy

The data will be deleted no later than 10 years after the warranty obligations have been fulfilled or the contract with you has ended. Due to the nature of our services, legal and regulatory requirements—including product liability, warranties, recalls, etc.—may necessitate the long-term storage of personal data.

Use of the Online Store

The Droniq online store is operated by the service provider Shopify International Limited (Shopify).

Shopify collects your name, email address, shipping and billing addresses, payment information, company name, phone number, IP address, information about orders you place, information about Shopify-supported merchant stores that you visit, as well as information about the device and browser you use.

Shopify uses this information to provide services to us. This includes order support and processing, risk and fraud screening, authentication, and payments. Shopify also uses this information to improve our services.

When you sign up for Shop Pay, Shopify stores and uses this information to pre-fill your checkout details. Shopify also uses this information to enhance your experience on the websites by presenting you with products and services that may be of interest to you.

Shopify uses some of the personal data you submit to Shopify for automated decision-making to a certain extent (e.g., IP addresses or payment data) to automatically block certain potentially fraudulent transactions for a short period of time. For more information about Shopify’s privacy practices, visit https://www.shopify.de/legal/datenschutz or contact Shopify directly:

Shopify International Limited
Attn: Data Protection Officer
c/o Intertrust Ireland
2nd Floor 1-2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
Email: hilfe@shopify.de

External Payment Service Providers

We use Shopify Payments as our payment service provider. As part of the ordering process, the information provided by the user, along with the order details (name, address, account number, bank routing number, credit card number if applicable, invoice amount, currency, and transaction number) are transferred to the payment service provider selected by the user in accordance with Article 6(1)(b) of the GDPR. The data is transferred exclusively for the purpose of processing the payment with the payment service provider and only to the extent necessary for this purpose. The respective privacy policies and contact information for the payment service providers can be found in the list below:

Shopify International Limited
Attn: Data Protection Officer
c/o Intertrust Ireland
2nd Floor 1-2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
Email: hilfe@shopify.de

If paid services of our TraX app are purchased through the Apple App Store or the Google Play Store (e.g., in-app purchases or subscriptions), payment processing is handled exclusively by the respective app store operator. In this context, payment and billing data (e.g., purchase amount, time of purchase, payment method used, transaction or subscription status) are processed directly by the respective payment service provider. We do not receive complete payment data, but only information regarding the successful completion of the transaction, to the extent necessary for the provision of paid content. Processing is carried out in accordance with Article 6(1)(b) of the GDPR.

The responsible payment service providers are:

• Apple Inc. 
• One Apple Park Way 
• Cupertino, CA 95014 
• USA

Contact the Data Protection Officer via Apple’s Data Protection Contact Form: https://www.apple.com/de/privacy/contact/

• Google Ireland Limited 
• Attn: Data Protection Officer
• Gordon House 
• Barrow Street 
• Dublin 4 
• Ireland
• Email: google-dpo@google.com

When using the Droniq contact form, the data entered may also be viewed in the backend by the provider WordPress. Their privacy policy can be viewed on their website:
https://automattic.com/de/Privacy/

3.4 Use of Data for Droniq Online User Management and Related Droniq Cloud Services

As part of providing our services, we use the identity management service Keycloak (https://www.keycloak.org/), which is operated by the company intension GmbH (https://www.intension.de/datenschutz/). Keycloak is Java-based open-source software that serves as an Identity and Access Management (IAM) system. It enables the centralized management of users, roles, and access rights, as well as secure authentication and authorization for various applications. To protect our users’ privacy, when logging in via Keycloak, we ensure that the connected systems receive only pseudonymized identifiers (e.g., a randomly generated ID). No plaintext data, such as a name or email address, is transmitted. Mapping to the actual identity is possible only within the Keycloak system and remains hidden from third-party systems.

This procedure prevents the receiving systems from having to store or process personal data. Pseudonymization serves to implement the principle of data minimization in accordance with Art. 5(1)(c) of the GDPR and protects users from de-anonymization by third-party applications. The output of pseudonymized data is automated and occurs exclusively within the scope of the intended access control.

For more information on data processing in connection with Keycloak, please refer to the privacy policy of the operator, intension GmbH, at: https://www.intension.de/datenschutz/

Purpose of Data Collection

The data is collected and processed for the following purposes:

• Unified user management across all Droniq Services, TraX, BOS, and over-the-air updates for selected hardware
• Secure storage of our customers’ user data
• Improvement of user-friendliness through a single sign-on integration
• Pseudonymized sharing of data with connected services enhances data security
• Required for billing the service
• Required to ensure compliance with the Droniq Terms and Conditions
• Communication regarding important product information (including maintenance, error reports, release changes, updates, versioning, changes to the Terms of Use, and changes to the Privacy Policy)

The legal basis is Article 6(1)(b) of the GDPR.

Type of data collected

When using the Droniq user management system, you are required to provide personal data. The following data is collected for the purposes listed above:

• User’s last name, first name, and email address
• User’s password
• Language preference (German or English)
• Information about the use of the app or website—such as browser type and version, IP address, or the date and time of login—is not collected when using the Droniq TraX Services.

When a user logs in, a technically pseudonymized identifier is transmitted to the service provider RevenueCat, Inc. (https://www.revenuecat.com/) for the purpose of verifying an existing subscription. In this context, Droniq can only determine that such a verification was performed and when it occurred (e.g., when the app is opened). No plaintext or content data is transmitted in this process.

For more information on data processing in connection with RevenueCat, please see Section 3.8 of this Privacy Policy.

3.5 Use of Data for UTM

As part of providing our UTM services (UTM—Unmanned Aircraft System Traffic Management), we rely on the services of DFS Deutsche Flugsicherung GmbH. As part of this service provision, we transmit to the service providers the data necessary for the execution of the services.

Purpose of Data Collection

The data is collected and processed for the following purposes:

• Promoting safety and traffic management,
• Raising safety awareness,
• Understanding traffic situations,
• Supporting safe drone flight through validation support for drone takeoffs.
• Required for billing the service
• Required to ensure compliance with the Droniq Terms and Conditions
• Communication regarding important product information (including maintenance, error messages, release changes, updates, versioning, changes to the Terms of Use, and changes to the Privacy Policy)

The legal basis is Article 6(1)(b) of the GDPR.

Type of data collected

Creating a personal account is required to use certain features. The following data is collected for the purposes listed above:

• User’s last name, first name, and email address (a pseudonym may be provided) as well as operator ID
• Drone parameters (manufacturer, name, type), if provided
• Log files of flight events with the drone (drone name, takeoff location, takeoff date, takeoff time, duration), provided that scheduled flights take place
• Settings related to service provision (language setting in German or English, geographic coordinates for providing warning services, voice output for warnings)
• Information about the use of the website, including browser type and version, IP address, and date/time of login
• Use of geolocation: Based on your consent, the geolocation API of your web browser or device is used. If you are using a device with GPS support, your current location can be determined more precisely using the GPS module. The collection and use of your location data via your web browser’s geolocation API occurs only if you initiate location tracking by clicking a button. This data is used to orient the map display and mark your location on it. You can disable this feature at any time on your device or in your browser.

To use certain features, the user may voluntarily provide additional information in accordance with Art. 6(1)(a) of the GDPR. This does not apply to “unregistered users”:

• Phone number
• Date of birth
• Address (street, ZIP code, city)
• IMSI (International Mobile Subscriber Identity)
• Remote Pilot ID
• Call Sign
• Vehicle Type Information

The data provided during registration may be pseudonyms and is not verified. Therefore, no personal identification can be established. In the event of an objection and the deletion of the data, the functionality of the application cannot be guaranteed, and service may be restricted.

Integration of BKG, Basemap, and Here Maps

To provide cartographic information and enable location searches, we use the services of the following third-party providers on our website:

• Federal Agency for Cartography and Geodesy (BKG)
• Basemap.de
• HERE Maps (HERE Global B.V.)

These services enable the display of interactive map content as well as the use of a search function for geographic locations.

When you visit pages that include map services, data is automatically transmitted to the respective providers. This includes, in particular:

• the information that you have visited our website (referrer URL),
• technical data such as IP address, browser type, operating system,
• the coordinates of the displayed map section,
• the search term entered when using the location search via HERE Maps.

The location data (map section) is transmitted anonymously. When using the HERE search function, the data you enter is transmitted directly to HERE. This transmission occurs regardless of whether you have a user account with one of the providers or are logged in there. If you are logged in to one of these providers while using the map feature, it cannot be ruled out that the data may be associated with your user account. To avoid this, we recommend that you actively log out of the respective providers’ services before using the map features.

The providers may use the transmitted data—including data from users who are not logged in—for their own purposes, such as advertising, market research, or tailoring their services to user needs. This may include, in particular, the creation of pseudonymous user profiles. You have the right to object to the creation of user profiles by the respective providers. To do so, please contact the respective service providers directly.

For more information on data processing, as well as your rights and settings options for protecting your privacy, please refer to the privacy policies of the services used:

• https://www.bkg.bund.de/DE/Service/Datenschutz/datenschutz.html
• https://legal.here.com/de-de/privacy
• https://basemap.de/datenschutz_impressum/

Access to Data / Recipients

Only Droniq GmbH and DFS Deutsche Flugsicherung GmbH have access to the data. These companies are contractually obligated to use the data exclusively for the purpose of fulfilling the contract with DFS. The data does not leave the European Economic Area (EEA). The use of the data is necessary for the provision of the services.

3.6 Use of Data for Droniq TraX

As part of the provision of our services (in particular, validation features as an essential component of the app, as well as services for tracking, Remote ID identification, and alerts), we rely on the services of DFS Deutsche Flugsicherung GmbH. As part of this service provision, we transmit the data necessary for the performance of the services to the service providers. In addition, mapping services from Mapbox are used.

When using the “Fly Here” feature within the Droniq TraX services, selected flight information is processed in a technically pseudonymized manner and—if expressly requested by the user—displayed to other users of the service. Users can choose at any time, via an opt-out setting, whether their mission should be publicly visible. If no consent is given, the corresponding flight information will not be displayed to other users. For missions marked as public, only general, non-identifying mission information is displayed to other users: the mission area, the specified maximum altitude of the mission, the specified start time, and an approximate end time. Identification of the user or the display of personal data is excluded in this context.

Purpose of Data Collection

The data is collected and processed for the following purposes:

• Promoting safety and traffic management,
• Raising safety awareness,
• to provide insight into traffic situations, and to display current or recent drone flights to improve situational awareness,
• Supporting safe drone flight (in particular through validation support for drone takeoffs),
• as required for billing the service,
• required to ensure compliance with Droniq’s Terms and Conditions,
• Communication regarding important product information (including maintenance, error messages, release changes, updates, versioning, changes to the Terms of Use, and changes to the Privacy Policy).

The legal basis is Article 6(1)(b) of the GDPR.

In addition, registered users may provide voluntary data on the legal basis of Article 6(1)(a) of the GDPR.

Type of Data Collected

Creating a personal account is required to use certain features.

Depending on the feature used, the following data is collected and processed for the purposes mentioned above:

• the user’s last name, first name, and email address,
• Usage and configuration settings in connection with the provision of services (e.g., language setting in German or English, geographic coordinates for the provision of warning services, voice output for warnings),
• Information about app usage, including device type and version, IP address, and date/time of login,
• Operational area or mission area, including any radius defined by the user, as well as the maximum altitude of the mission area in meters above ground level (AGL),
• Details about the drone being used, in particular the specified C-class and its classification into categories A1–A3 or the “Specific” category,
• technically pseudonymized flight identifiers,
• Information about the flight (e.g., departure location, departure time, flight duration, and the planned flight area, which can be defined as a geometric shape).
• Use of location data (geolocation): If you have given your consent, the geolocation API of your web browser or device will be used. For devices with GPS support, the location can be determined more accurately using the GPS module. Location data is collected and used only when you actively trigger location tracking by clicking a button. The collected location data—in particular, the user’s current position—is used to define the mission area, align the map view, and display the location accordingly. You can disable this feature at any time in the settings of your device or browser.

Display of pseudonymized flight information (“Fly Here”) in Droniq TraX

Processing is carried out using technical pseudonymization. It is impossible for other service users to identify the affected users. The association between pseudonymized identifiers and the stored user information is possible exclusively within the Droniq Identity Management System and remains protected there. Only selected and authorized Droniq employees have access to the management systems.

Server Log Files

Every time you access our website, usage data is transmitted by your internet browser and stored in log files (server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the amount of data transferred, and the requesting provider. This data is used to ensure the smooth operation of our service, to improve our offerings, for billing purposes, and to comply with the Terms and Conditions. It is possible to associate this data with a specific individual. It is not shared with third parties and is stored in anonymized form after the contractual relationship with Droniq ends.

Session Cookies

These are cookies that are stored on your computer only for the duration of an internet session. They are technically necessary.

Integration of Mapbox or OpenStreetMap

We use services from external providers to display geolocation-based information. These services enable the interactive display of map content within our application (e.g., to visualize locations, flight data/airspace, or geographic information). When you access map functions, technical information is automatically transmitted to the respective providers. This includes, in particular: the fact that you are using a corresponding page or function with an integrated map service, your IP address, technical access data (e.g., date, time, browser type), as well as the coordinates of the current map section and, consequently, the user’s approximate location, if applicable. This data transmission is technically necessary to display the map correctly. For more information on data processing, as well as your rights and privacy settings, please refer to the privacy policies of the services used: Mapbox Privacy and OpenStreetMap Privacy Policy.

Note on Data Transfer to Third Countries (U.S.): Some of the map services we use (e.g., Mapbox or OpenStreetMap) are based in the U.S. When using these services, personal data (e.g., IP address, location data) may therefore be transferred to servers in the U.S. The providers rely on so-called EU Standard Contractual Clauses pursuant to Art. 46 of the GDPR for these transfers. Please note that the level of protection in the U.S. is not equivalent to that provided by European data protection laws. In particular, there is a risk that U.S. authorities may access your data without you having effective legal remedies available to you.

Access to Data / Recipients

Access to personal data is restricted exclusively to Droniq GmbH and—to the extent necessary for the provision of the contractually agreed services—DFS Deutsche Flugsicherung GmbH. The participating companies are contractually obligated to process the data exclusively for the purpose of providing services and within the scope of existing contractual relationships.

Data processing generally takes place within the European Economic Area (EEA). If external service providers based in a third country are used in connection with specific functions (e.g., in connection with the integration of map services), personal data may be transferred to third countries to the extent necessary. In such cases, the transfer is based on appropriate safeguards in accordance with Article 46 of the GDPR, in particular through the use of EU Standard Contractual Clauses.

The processing of the data is necessary for the provision and operation of the Droniq TraX Services.

3.7. Use of Data for the Track Viewer

As part of the provision of our services, we rely on the services of DFS Deutsche Flugsicherung GmbH. As part of this service provision, we transfer to the service providers the data necessary to perform the services. In addition, the mapping services of the Federal Agency for Cartography and Geodesy (BKG) are used for display purposes.

Purpose of Data Collection

The data is collected and processed for the following purposes:

• Promoting safety and traffic management,
• Raising safety awareness,
• Understanding traffic situations,
• Necessary for billing the service,
• To ensure compliance with the Droniq Terms and Conditions
• Communication regarding important product information (including maintenance, error reports, release changes, updates, versioning, changes to the Terms of Use, and changes to the Privacy Policy)

The legal basis is Article 6(1)(b) of the GDPR.

Type of Data Collected

Creating a personal account is required to use certain features. The following data is collected for the purposes listed above:

• Last name, first name, email address, company/club/affiliation, address, area of operation, the user’s HOD (Hook-on-Devices) IDs, HOD-IMSI, and HOD version,
• Log files of flight events with the drone (drone name, takeoff location, takeoff date, takeoff time, duration), provided that scheduled flights take place
• Information about website usage, including browser type and version, IP address, and date/time of use.
• Use of geolocation: Based on your consent, the geolocation API of your web browser or device is used. If you are using a device with GPS support, your current location can be determined more precisely using the GPS module. The collection and use of your location data via your web browser’s geolocation API occurs only if you initiate location tracking by clicking a button. This data is used to orient the map display and mark your location on it. You can disable this feature at any time on your device or in your browser.

Integration of BKG Maps

To display geobased content, we optionally use the map function provided by the Federal Agency for Cartography and Geodesy (BKG). This integration enables the visual display of geodata within our service.

When you access features that contain BKG maps, certain technical information is automatically transmitted to the provider. This includes, in particular:

• the fact that you have used a corresponding feature within our service
• the IP address used
• technical access data (e.g., date and time, browser type)

This transmission is necessary to provide the technical functionality and display of the map.

Server Log Files

Every time you access our website, usage data is transmitted by your internet browser and stored in log files (server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the amount of data transferred, and the requesting provider. This data is used to ensure the smooth operation of our service, to improve our offerings, for billing purposes, and to comply with the Terms and Conditions. It is possible to associate this data with a specific individual. It is not shared with third parties and is stored in anonymized form after the contractual relationship with Droniq GmbH has ended.

Session Cookies

These are cookies that are stored on your computer only for the duration of an internet session. They are technically necessary.

Access to the Data / Recipients

Only Droniq GmbH and DFS Deutsche Flugsicherung GmbH have access to the data. These companies are contractually obligated to use the data exclusively for the purpose of fulfilling the contract with DFS. The data does not leave the European Economic Area (EEA). The use of the data is necessary for the provision of the service.

3.8 Use of Data for RevenueCat

RevenueCat is used as a data processor to enable the technical processing and administration of subscriptions and in-app purchases as part of the digital services offered. Personal data is processed exclusively for the purpose of providing the services offered by RevenueCat in accordance with the underlying contractual relationship.

Purpose of Data Collection

Personal data is processed to technically manage subscriptions and in-app purchases, to accurately reflect contract and usage statuses, and to synchronize subscription- and purchase-related events. In addition, the processing serves to ensure technical operation, error analysis and troubleshooting, and system security.

The legal basis is Article 6(1)(b) of the GDPR. The processing is necessary to fulfill the user or contractual relationship and to provide the services contractually owed. RevenueCat processes personal data exclusively in accordance with documented instructions within the framework of data processing on behalf of a client.

Types of Data Collected

When using RevenueCat, the following categories of personal data are processed:

• personal data entered into the services provided by RevenueCat by the data controller or its authorized users,
• in-app user IDs and other identifying characteristics,
• contract and subscription data, including information on purchase, renewal, cancellation, and expiration status,
• timestamps for subscription- and purchase-related events,
• technical usage, metadata, and log data necessary for operation, security, and error analysis.

Purpose	Categories of Personal Data	Applications/Product	Retention Period
Technical management of subscriptions and in-app purchases	In-app user identifiers, contract and subscription data, purchase, renewal, cancellation, and expiration status	RevenueCat	The duration of data retention depends on the necessity of retaining the data to fulfill the contract or user relationship. The data is generally stored for the duration of active use and deleted upon termination of the contractual or user relationship, unless there are statutory retention or documentation requirements or the data is necessary for the assertion, exercise, or defense of legal claims.
Synchronization of Subscription- and Purchase-Related Events	Synchronization of subscription- and purchase-related events	RevenueCat	Data is stored for as long as technically and contractually necessary to map, synchronize, and ensure the traceability of subscription- and purchase-related events. Data is retained beyond this period only if there are statutory retention obligations or if the data is required as evidence in the context of legal disputes.
Ensuring Technical Operations	Technical usage, metadata, and log data	RevenueCat	The retention period is determined by the need to ensure the proper technical operation of the systems. Log and metadata are regularly deleted as soon as they are no longer required for the stated purposes, provided that no overriding legitimate interests or legal obligations preclude such deletion.
Error Analysis and System Security	Log data, technical usage data	RevenueCat	The data is stored for the duration of the error analysis and resolution, as well as to ensure system security. Once the purpose no longer applies, the data is deleted, provided there are no legal retention obligations or further storage is necessary to prevent security incidents or for evidentiary purposes.

The processing of special categories of personal data within the meaning of Article 9 of the GDPR is excluded.

Access to the Data / Recipients

Droniq GmbH and RevenueCat, Inc. have access to the data in their capacity as data processors. RevenueCat is contractually obligated to process the data exclusively in accordance with instructions and for the purpose of providing the agreed-upon services. If sub-processors are used, they are also contractually obligated to comply with data protection requirements.

The use of RevenueCat is based on a Data Processing Addendum (DPA) entered into in accordance with Article 28 of the GDPR.

The DPA covers, among other things:

• Purpose and scope of data processing
• Data protection and security measures
• Provisions regarding data erasure and storage
• Rights and obligations of the parties

Personal data may be processed in countries outside the European Economic Area, particularly in the United States. Such transfers are made exclusively in compliance with the requirements of Articles 44 et seq. of the GDPR, based on appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses, which form an integral part of the Data Processing Agreement concluded with RevenueCat.

This agreement ensures that all data protection requirements are met and that users’ personal data is protected to the greatest extent possible.

The respective privacy policy and contact information for the service provider can be found in the list below:

• RevenueCat, Inc.
• 1032 E Brandon Blvd #3003
• Brandon, FL 33511
• USA
• Email: compliance@revenuecat.com
• Privacy Policy: https://www.revenuecat.com/privacy

Retention Period

Personal data will be stored for the duration of the contractual or user relationship. Upon termination of this relationship, the data will be deleted or returned in accordance with the contractual provisions, provided that no statutory retention requirements preclude this.

3.9 Use of Data for the Droniq Academy

As part of providing our Academy services, we utilize the services of Chemmedia GmbH (https://www.chemmedia.de/) and Aviationexam s.r.o. (https://www.aviationexam.com). As part of this service provision, we transmit to the service providers the data necessary for the performance of the services, or the data is collected by the user via our service providers’ web services. In addition, the data required for exams is collected in accordance with the documentation specified by the Federal Aviation Authority (Luftfahrt-Bundesamt) for testing centers for remote pilots and made available to the Federal Aviation Authority.

Purpose of Data Collection

The data is collected and processed for the following purposes:

• Use of the Learning Management Tool
• Registration for and administration of exams
• Use of online exam proctoring
• Registration of the remote pilot certificate with the Federal Aviation Authority
• Verification of the participant’s identity during exams
• Required for billing the service
• Required to ensure compliance with Droniq’s Terms and Conditions
• Communications regarding important product information (including maintenance, error messages, release changes, updates, versioning, changes to the Terms of Use, and changes to the Privacy Policy)

The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR in conjunction with NfL 2021-2-630 dated July 29, 2021, Section 4 (New NfL 2023-2-733 dated April 21, 2023 is available; the PstF certification is based on NfL 2021-2-630 dated July 29, 2021).

Type of Data Collected

Creating a personal account is required to use certain features. The following data is collected for the purposes mentioned above:

• Last name, first name, street, house number, ZIP code, city, country, email address
• Date of birth
• Reporting Authority for Remote Pilots (PStF) and its registration number
• ID number for EU Certificate of Competence A1A3
• Date of the theory exam
• Exam result (%)
• Validity period of ID card or passport
• Upload a copy (photo file) of your ID card or passport (redacted—only the identifying information [name, address, photo])
• For minors: Details of the legal guardians (last name, first name, date of birth) and the legal guardians’ written consent
• Information about the use of the website, including browser type and version, IP address, and date/time of login

Throughout the remote exam, the following data is collected and processed:

• Purpose: Transmission and processing of the exam assignment / transmission of the exam performance
• Categories of personal data: Objective exam data and individual (partial) exam performance / individual exam performance (answers)
• Applications/Product: Aviationexam exam system
• Retention period: The duration of data retention is determined by the necessity of data storage, unless there are overriding interests, and is generally 5 years. This data will be further processed beyond the periods described above if statutory retention obligations exist or if the data is required as evidence.

Access to the Data / Recipients

Droniq GmbH, aviationexam s.r.o., Chemmedia GmbH, and the German Federal Aviation Authority (Luftfahrt-Bundesamt) have access to the data. Droniq, aviationexam s.r.o., Chemmedia GmbH, and the German Federal Aviation Authority are obligated to use the data exclusively for the purpose of fulfilling the contract. The data does not leave the European Economic Area (EEA). The use of the data is necessary for the provision of the services.

In addition, a Data Processing Agreement (DPA) pursuant to Article 28 of the GDPR exists between Droniq and Chemmedia AG. This agreement governs the processing of personal data in connection with the training and ensures that Chemmedia AG processes the data exclusively in accordance with the organizer’s instructions.

The DPA covers, among other things:

• Purpose and scope of data processing
• Data protection and security measures
• Provisions regarding data erasure and storage
• Rights and obligations of the parties

This agreement ensures that all data protection requirements are met and that participants’ data is protected to the greatest extent possible.

The respective privacy policies and contact information for the service providers can be found in the list below:

Chemmedia AG
Parkstraße 35
09120 Chemnitz
Email: info@chemmedia.de

Aviationsexam s.r.o.
Kovarova 39/23
155 00 Prague 5
Czech Republic
Email: support@aviationexam.com

3.10 Use of Data for Droniq Academy – Online Exams

As part of providing online exam services, we utilize the services of Proctorio GmbH (https://proctorio.com/de-de) in addition to the exam systems. The data required for using Proctorio in connection with online exams is specified by the LBA in the Droniq Exam Handbook and can be viewed there by the examinee as needed.

Participants who do not wish to have their personal data processed by Proctorio or who lack the technical capabilities to use the software may book an alternative exam format on the Droniq website.

Purpose of Data Collection

The data is collected and processed for the following purposes:

• Ensuring exam integrity: Preventing attempts at cheating and the use of unauthorized aids.
• Identity verification: Ensuring that the exam is taken by the authorized person.
• Documentation and verifiability: Storing exam records to clarify irregularities.
• Compliance with legal and contractual requirements: Ensuring that exams are properly administered and graded in accordance with applicable regulations.

GDPR in conjunction with NfL 2021-2-630 dated July 29, 2021, Section 4 (New NfL 2023-2-733 dated April 21, 2023 is available; the PstF certification is based on NfL 2021-2-630 dated July 29, 2021).

Type of Data Collected

Creating a personal account is required to use certain features. The following data is collected for the purposes mentioned above:

• One-time capture of the exam room via a room scan using the user’s webcam
• Capture and recording of the upper body, including the face, via camera/webcam (video)
• Capture and recording of audio signals via microphone (audio)
• Consistent use of full-screen mode, including the hiding of control elements
• Capture and recording of the screen
• Capture and recording of the user’s physical location
• Capture and recording of internet usage
• Capture and recording of indications of potential hardware issues, operating system issues, or internet connection issues
• Capture and recording of a valid ID card

Throughout the remote exam, the following data is collected and processed:

Purpose	Categories of personal data	Applications/Product	Retention period
Submission and processing of the exam assignment / Submission of the exam work	Objective exam questions and individual (partial) exam results / individual exam result (solution)	Aviationexam examination system	The duration of data retention depends on the necessity of data storage, unless there are overriding interests, and is generally 5 years. This data will be further processed—beyond the periods described above—if statutory retention obligations exist or if the data is required as evidence.
(Remote) Monitoring	Video (upper body, including face) and audio (voice) of examinees; websites accessed	Proctorio	30 days (see also Retention Period / Data Deletion)
Scan of the exam room	Video recordings of the desk or workstation surface, room scan	Proctorio	30 days (see also Retention Period / Data Deletion)
Demo exam	Same as for (remote) proctoring	Proctorio	30 days (see also Retention Period / Data Deletion)
Authentication	ID card, i.e., last name, first name, and photo	Proctorio	30 days (see also Retention Period / Data Deletion)
Troubleshooting (First-Level Support for Proctorio)	Communication data (including voice and chat messages)	Proctorio	See the Proctorio® Privacy Policy
Securing data traffic	Inventory and traffic data, e.g., the IP address	Proctorio	30 days; see also pseudonymization, data security, data sharing

Access to Data/Recipients

With regard to participants, Proctorio pseudonymizes personal data upon receipt using a user identification number from the exam system. This ID is not accessible to either the participants or Droniq. All subsequent data processing by Proctorio involves only this user ID and is therefore not traceable by Proctorio. In addition, the collected data is encrypted. In the LMS exam room, when Proctorio recordings are retrieved, the IDs used by Proctorio are linked to the participants’ identities; therefore, authorized Droniq employees can view the Proctorio recordings on an exam-specific basis. Proctorio is prohibited from decrypting or viewing the encrypted data. The data processed directly by Proctorio is stored on cloud servers in Germany. The data transferred by Proctorio to Droniq is stored by Droniq in a data center with servers in Germany.
In individual cases, however—such as during system updates or support requests—data processing by companies outside the EU may be necessary.

Recipients may include:

• PROCTOR.IO INC. (USA)
• PROCTORIO D.O.O. (Serbia)
• Proctorio’s subcontractors in third countries

The following security measures have been implemented to protect the data:

• Execution of EU Standard Contractual Clauses (SCCs) with Proctorio® and the subprocessors
• End-to-end encryption of stored data
• Access restrictions to prevent unauthorized third parties from viewing the data

In addition, a Data Processing Agreement (DPA) has been entered into between Droniq and Proctorio GmbH in accordance with Article 28 of the GDPR. This agreement governs the processing of personal data in the context of exam proctoring and ensures that Proctorio processes the data exclusively in accordance with the organizer’s instructions.

The DPA covers, among other things:

• Purpose and scope of data processing
• Data protection and security measures
• Provisions regarding data deletion and storage
• Rights and obligations of the parties

This agreement ensures that all data protection requirements are met and that participants’ data is protected to the greatest extent possible.

Retention Period / Data Deletion

In accordance with the principle of data minimization, personal data processed in remote exams may not be stored for longer than is strictly necessary for the proper conduct of the remote exam, including grading. Proctorio recordings are therefore deleted by Droniq immediately upon completion of the grading. Unless the data is manually deleted after the exam, Proctorio automatically deletes the exam recording after 30 days.

The exam report generated in PDF format, which documents the respective exam and any irregularities observed during the exam, is stored by the organizer in a data center with servers located in Germany. This personal data is generally deleted when there is no longer a need for further storage. A need for retention may exist, in particular, if the data is still required to fulfill contractual obligations or to review, grant, or defend against warranty and, where applicable, guarantee claims. In the case of statutory retention obligations, deletion may only be considered after the respective retention period has expired.

The respective privacy policies and contact information for the service providers can be found in the list below:

Proctorio GmbH
Lindleystraße 8a
60314 Frankfurt am Main
Germany

3.11 Use of Data for Droniq Maps

As part of providing our UTM services—a key component of the app—we rely on the services of DFS. In connection with this service provision, we transmit to the service providers the data necessary to perform the services. Additionally, we use the mapping services of BKG, Basemap, and Here Maps.

Purpose of Data Collection

The data is collected and processed for the following purposes:

• Promotion of safety and traffic management
• Raising safety awareness
• Understanding traffic situations
• Supporting safe drone flight through validation support for drone takeoffs
• Required for billing the service
• Required to ensure compliance with Droniq’s Terms and Conditions
• Communication regarding important product information (including maintenance, error messages, release changes, updates, versioning, changes to the Terms of Use, and changes to the Privacy Policy)

The legal basis is Article 6(1)(b) of the GDPR.

In addition, registered users may provide voluntary data based on Article 6(1)(a) of the GDPR.

Type of Data Collected

Creating a personal account is required to use certain features. The following data is collected for the purposes listed above:

• The user’s last name, first name, and email address (a pseudonym may be provided) as well as the operator ID
• Drone parameters (manufacturer, name, type), if provided
• Settings related to service provision (language setting in German or English, geographic coordinates for providing warning services, voice output for warnings)
• Log files of flight events with the drone (drone name, takeoff location, takeoff date, takeoff time, duration), provided that scheduled flights take place
• Information about app usage, including device type and version, IP address, and date/time of login
• Use of geolocation: Based on your consent, the geolocation API of your web browser or device is used. If you are using a device with GPS support, your current location can be determined more accurately using the GPS module. The collection and use of your location data via your web browser’s geolocation API occurs only if you initiate location tracking by clicking a button. This data is used to orient the map display and mark your location on it. You can disable this feature at any time on your device or in your browser.

To use certain features, the user may voluntarily provide additional information in accordance with Art. 6(1)(a) of the GDPR. This does not apply to “unregistered users”:

• Phone number
• Date of birth
• Address (Street, ZIP Code, City)
• Remote Pilot ID
• Call sign
• Vehicle Type Information

The data provided during registration may be pseudonyms and will not be verified. Therefore, no personal identification can be established. In the event of an objection and the deletion of the data, the functionality of the application cannot be guaranteed, and the service may be restricted.

Integration of BKG, Basemap, and Here Maps

To display interactive map content and use geolocation features, our service utilizes the services of the following providers:

• Federal Agency for Cartography and Geodesy (BKG)
• Basemap.de
• HERE Maps

These services enable the visualization of geospatial content (BKG, Basemap) as well as the execution of location-based search queries (HERE Maps).

When you access features that incorporate map or search services, certain information is automatically transmitted to the respective providers. This includes, in particular:

• the fact that you have used a corresponding feature within our service
• Your IP address
• technical access data such as date and time, browser type/version, operating system
• the coordinates of the displayed map section (location data, if applicable)
• When using the HERE Maps search function: the data entered in the search field

Location data (map section) is transmitted anonymously. When using the HERE search function, the entered data is transmitted directly to HERE. This transmission occurs regardless of whether you have a user account with one of these providers or are logged in there. If you are logged in to one of these providers while using the map feature, it cannot be ruled out that the data may be associated with your user account. To avoid this, we recommend that you actively log out of the respective providers before using the map features.

Providers may use the transmitted data—including data from users who are not logged in—for their own purposes, such as advertising, market research, or tailoring their services to user needs. This may include, in particular, the creation of pseudonymous user profiles. You have the right to object to the creation of user profiles by the respective providers. To do so, please contact the respective service providers directly.

For more information on data processing, as well as your rights and privacy settings, please refer to the privacy policies of the services used:

• https://www.bkg.bund.de/DE/Service/Datenschutz/datenschutz.html
• https://legal.here.com/de-de/privacy
• https://basemap.de/datenschutz_impressum/

Access to Data/Recipients

Only Droniq GmbH and DFS Deutsche Flugsicherung GmbH have access to the data. These companies are contractually obligated to use the data exclusively for the purpose of fulfilling the contract with DFS. The data does not leave the European Economic Area (EEA). The use of the data is necessary for the provision of the services.

4. How long will my data be stored?

We process and store your personal data for as long as necessary to fulfill our contractual and legal obligations and as long as the purpose of the processing remains valid. If the data is no longer necessary for the fulfillment of contractual or legal obligations, or if the purpose of data storage no longer applies, it will be deleted in accordance with regulatory requirements, unless its continued—temporary—processing is necessary for the following purposes:

• All personal data stored in connection with Academy services is retained for 5 years. This corresponds to the validity period of the remote pilot certificate.
• Preservation of evidence within the framework of statutory limitation periods. According to Sections 195 et seq. of the German Civil Code (BGB), these limitation periods can be up to 30 years, with the standard limitation period being 3 years.

5. Where is my data processed?

Unless otherwise specified in this Privacy Policy, the actual data processing takes place within the EU. The websites are operated by Mittwald CM Service GmbH & Co. KG in Germany. The online store is hosted by Shopify International Limited on servers located outside the EU, in Canada. The provider is subject to the Canadian Privacy and Electronic Documents Act (PIPEDA), which has been deemed adequate by the European Commission.

In certain cases, we are legally obligated to disclose data to a government agency upon request.

6. How secure is my data?

Droniq GmbH employs technical and organizational measures to protect your personal data from unauthorized access and misuse. We keep these security measures up to date in line with technological developments and in accordance with the applicable legal regulations.

7. Technical and Organizational Measures for the Protection of Personal Data (TOMS)

We secure your data using state-of-the-art technology. Among other things, we apply the following security measures to protect your personal data against misuse or any other form of unauthorized processing:

• Access to personal data is restricted to a limited number of authorized individuals and to specific purposes
• Data is transmitted only in encrypted form, e.g., via “https:…”
• The IT systems used for data processing are physically separated from other systems to prevent unauthorized access, such as through hacking
• Access to the systems is continuously monitored to enable the early detection and reporting of any misuse

The legal basis for this is Articles 25 and 32 of the GDPR.

8. When do I need to consent to the Privacy Policy?

For certain features within the “UTM” and “Droniq App” services, you may voluntarily provide personal information. This processing is carried out in accordance with Article 6(1)(a) of the GDPR based on your voluntary decision.

The corresponding input fields are available exclusively to registered users.

By clicking “I have read and understood the Privacy Policy,” you confirm that you have been informed about the nature, scope, and purpose of the data processing. Active consent is not required. However, the use of optional features requires that you have read and understood the Privacy Policy.

You may object to the processing of your data at any time with future effect. In this case, you may only have access to the basic functionalities of the services. In individual cases, this may mean that certain services—particularly those subject to a fee—cannot be used.

9. Is my usage behavior analyzed?

In accordance with legal regulations, we—or companies commissioned by us—create usage profiles under a pseudonym in order to analyze and regularly improve the use of our website.

This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. If other legal bases are applied or if the aforementioned legal basis (Article 6(1)(f) of the GDPR) applies, this will be noted in the appropriate section. It is not possible to directly identify you through this process. The profile data is not linked to any other information about you. Below, we provide information about the procedures used on our websites and how you can object at any time.

9.1 Cookies

Our website uses cookies. Cookies are small text files that are stored in the web browser or by the web browser on a user’s device. When you visit our website, a cookie may be stored on your operating system. This cookie contains a unique string of characters that allows the browser to be uniquely identified when you revisit the website.

Technically Necessary Cookies (Session Cookies)

These cookies are necessary for the basic functions of our website and are stored only for the duration of a session. Without them, key functions—such as navigation or the use of forms—cannot be provided.

Legal basis: Storage is carried out in accordance with Section 25(2), Sentence 2 of the TDDDG and Article 6(1)(f) of the GDPR based on our legitimate interest in maintaining a functional and secure website.

Optional Cookies (Persistent Cookies)

In addition, we use cookies to make our website more user-friendly, analyze usage, and optimize our services. These cookies remain stored on your device beyond the duration of the session. The storage period for optional cookies varies depending on their function but is generally between 30 days and a maximum of 12 months. Once these periods have expired, the cookies are automatically deleted unless you remove them yourself beforehand via your browser settings.

Legal basis: These cookies are used only with your explicit consent in accordance with Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) of the GDPR.

You can revoke or adjust your consent at any time via the cookie settings in your browser. Please note that if you reject optional cookies, not all features of our website may be available.

You have full control over the use of cookies. Through your browser settings, you can:

• block cookies entirely or partially,
• be notified before cookies are set,
• delete stored cookies.

You can find information on managing cookies in the browser you are using.

Use of Google Tag Manager

We use Google Tag Manager from Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”) on our website. If you have your habitual residence in the European Economic Area or Switzerland, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the data controller responsible for your data. Google Ireland Limited is therefore the Google affiliate responsible for processing your data and ensuring compliance with applicable data protection laws. This application manages JavaScript tags and HTML tags used to implement tracking and analytics tools, among other things. The purpose of data processing is to tailor our website to your needs and to optimize it. Google Tag Manager itself does not store cookies, nor does it process personal data. However, it enables the triggering of additional tags that may collect and process personal data. For more information on terms of use and data protection, please visit https://www.google.com/intl/de/tagmanager/use-policy.html.

The legal basis is Art. 6(1)(a) of the GDPR.

Use of Google Analytics

We use the web analytics service Google Analytics, provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”), on our website. If you have your habitual residence in the European Economic Area or Switzerland, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the data controller responsible for your data. Google Ireland Limited is therefore the Google affiliate responsible for processing your data and ensuring compliance with applicable data protection laws. Data processing serves the purpose of analyzing this website and its visitors, as well as for marketing and advertising purposes. To this end, Google will use the information collected on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activity, and to provide the website operator with other services related to website and internet usage. The following information, among others, may be collected: IP address, date and time of the page visit, click path, information about the browser and device you are using, pages visited, referrer URL (the website from which you accessed our website), location data, and purchase activities. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google. Google Analytics uses technologies such as cookies, browser-based web storage, and web beacons, which enable an analysis of your use of the website. The information generated in this way regarding your use of this website is generally transmitted to a Google server in the United States and stored there. IP anonymization is enabled on this website. This means that your IP address is truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. Google has obtained certification under the U.S.-EU data protection agreement “TADPF” (dataprivacyframework.gov) and is thereby committed to complying with European data protection guidelines. Data processing, in particular the use of cookies, is carried out with your consent pursuant to Article 6(1)(a) of the GDPR. You may withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. For more information on terms of use and data protection, please visit https://marketingplatform.google.com/about/analytics/terms/de/ or at https://www.google.de/intl/de/policies/ and https://policies.google.com/technologies/cookies?hl=de.

Use of Google Web Fonts

To ensure a consistent and visually appealing display of fonts, we use so-called web fonts on our website, which were originally provided by Google. Unlike when using the Google Fonts API, however, these fonts are hosted locally on our server.

When a page is loaded, the required fonts are loaded directly from our website’s server into the browser cache. No connection is established with Google’s servers. Consequently, no data—in particular, no IP address—is transmitted to Google.

The local integration of the fonts ensures that no personal data is disclosed to third parties. This enhances data protection and prevents data transfers to third countries such as the United States.

Processing is based on Article 6(1)(f) of the GDPR, as there is a legitimate interest in a technically secure, visually consistent, and user-friendly presentation of our online content—while simultaneously complying with data protection requirements.

If your browser does not support the embedded fonts, a default font from your device will be used automatically.

9.2 Plug-ins and Integration of External Services

Use of Google invisible reCAPTCHA

We use the invisible reCAPTCHA service provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”) on our website. This serves the purpose of distinguishing between input by a human and automated, machine-based processing. In the background, Google collects and analyzes usage data, which is used by Invisible reCAPTCHA to distinguish regular users from bots. To this end, your input is transmitted to Google and processed there. In addition, your IP address and, if applicable, other data required by Google for the Invisible reCAPTCHA service are transmitted to Google. This data is processed by Google within the European Union and, if applicable, also in the United States. For data processing in the United States, Google has obtained certification under the U.S.-EU data protection agreement “TADPF” (dataprivacyframework.gov) and has thereby committed to complying with European data protection regulations.

Processing is carried out on the basis of Article 6(1)(f) of the GDPR, based on the legitimate interest in protecting our website from automated spying, misuse, and spam. You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) of the GDPR. For more information about Google reCAPTCHA and the associated privacy policy, please visit:

• https://www.google.com/recaptcha/intro/android.html and
• https://www.google.com/privacy.

Use of Social Plug-ins

Our pages on Facebook, LinkedIn, Twitter, Instagram, Xing, and YouTube serve to facilitate active communication with our customers and prospective customers. There, we provide information about our products and services, as well as special promotions and events.
We use social media plug-ins on our website. The integration of social plug-ins and the associated data processing serve the purpose of optimizing advertising for our products. When social plug-ins are integrated, a connection is established between your computer and the servers of the social network providers, and the plug-in is displayed on the page via a notification to your browser, provided you have expressly consented to this. In this process, both your IP address and information about which of our pages you have visited are transmitted to the provider’s servers. This applies regardless of whether you are registered with or logged into the social network. This transmission also occurs for users who are not registered or logged in. If you are simultaneously logged into one or more of your social network accounts, the collected information may also be associated with your corresponding profiles. When you use the plug-in features (e.g., by clicking a button), this information is also associated with your user account. You can prevent this association by logging out of your social media accounts before visiting our website and before activating the buttons.

Processing is based on Article 6(1)(a) of the GDPR with your consent. You may withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

The social networks listed below are integrated into our website via social plug-ins. For more information on the scope and purpose of data collection and use, as well as your rights in this regard and options for protecting your privacy, please refer to the providers’ privacy policies linked below.

• Facebook: https://www.facebook.com/about/privacy/
• YouTube (Google): https://policies.google.com/privacy
• Instagram: https://help.instagram.com/519522125107875
• Twitter: https://twitter.com/de/privacy
• LinkedIn: https://www.linkedin.com/legal/privacy-policy?_l=de_DE
• Xing: https://privacy.xing.com/de/datenschutzerklaerung

If you need assistance—for example, with requests for information—please feel free to contact us. However, please note that inquiries regarding data processing or the exercise of user rights should ideally be directed to the provider of the respective platforms, as only they have access to the data.

Embedding YouTube Videos

We have embedded YouTube videos in our online content that are stored on www.YouTube.com and can be played directly from our website. These are all embedded in “enhanced privacy mode,” meaning that no data about you as a user is transmitted to YouTube unless you play the videos. Only when you play the videos is the data mentioned in paragraph 2 transmitted. We have no control over this data transmission.

When you visit the website, YouTube receives the information that you have accessed the corresponding page of our website. In addition, the data listed in the next section, “Further Information,” of this policy is transmitted. This occurs regardless of whether you are logged in to a YouTube user account or do not have a user account. If you are logged in to Google, your data will be directly associated with your account. If you do not want this data to be associated with your YouTube profile, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for advertising, market research, and/or to tailor its website to user needs. Such analysis is carried out in particular (even for users who are not logged in) to deliver personalized advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact YouTube.

For more information on the purpose and scope of data collection and its processing by YouTube, please refer to the privacy policy. There you will also find further information about your rights and settings options for protecting your privacy: https://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the United States and has complied with the EU-U.S. Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

Integration of Google Maps

We use Google Maps on this website. This allows us to display interactive maps directly on the website and enables you to conveniently use the map feature.

When you visit the website, Google receives the information that you have accessed the corresponding page of our website. In addition, the data listed in the next paragraph under “Further Information” in this policy is transmitted. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not want this data to be associated with your Google profile, you must log out before clicking the button. Google stores your data as usage profiles and uses them for advertising, market research, and/or to tailor its website to user needs. Such analysis is carried out in particular (even for users who are not logged in) to deliver personalized advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact Google.

For more information on the purpose and scope of data collection and its processing by the plug-in provider, please refer to the provider’s privacy policy. There you will also find further information regarding your rights in this regard and settings options to protect your privacy: http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the United States and has submitted to the EU-U.S. TADPF (dataprivacyframework.gov).

Use of Google Ads Conversion Tracking

We use Google Ads conversion tracking on our website, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The purpose is to measure the effectiveness of our advertising campaigns on external websites and to optimize our online offerings.

If you arrive at our website via a Google ad, Google will store a so-called “conversion cookie” on your device. This cookie is typically valid for 30 days and is not used for personal identification. The cookie enables Google and us to recognize that a user has clicked on an ad and been redirected to a specific landing page (known as a “conversion page”). The following information may be collected and processed by Google:

• The user’s IP address (truncated if necessary)
• Time the page was accessed
• Information about the device and browser used
• Ads clicked and their placement (ad impressions, frequency)
• Opt-out information (indicating that tracking is not desired).

Each Google Ads customer is assigned a unique cookie. Cookies cannot therefore be tracked across the websites of multiple Ads customers.

We ourselves receive only aggregated statistical reports from Google, which we use to evaluate the effectiveness of our advertising campaigns. We are unable to personally identify users.

When Google Ads is integrated, your browser automatically establishes a connection to Google’s servers. This may also result in the transfer of personal data (in particular, your IP address) to the United States. Google uses standard contractual clauses in accordance with Article 46 of the GDPR and is also certified under the EU-U.S. Data Privacy Framework (see https://www.dataprivacyframework.gov).

If you are logged in to Google, this data may be associated with your Google account. Even users who are not logged in may be tracked by Google using pseudonymized data.

The use of Google Ads Conversion Tracking is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the statistical analysis and optimization of our advertising measures, as well as in the economically fair billing of advertising services.

If you have given your consent via our cookie banner, processing is additionally based on Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.

You can disable Google’s conversion tracking in several ways:

• by adjusting your browser settings to block third-party cookies
• by disabling cookies for conversion tracking via the domain https://www.google.de/settings/ads
• via the “Digital Advertising Alliance” platform: http://www.aboutads.info/choices
• by using the browser plugin to disable interest-based advertising (for Chrome, Firefox, Internet Explorer): http://www.google.com/settings/ads/plugin

Please note that if you disable these features, you may not be able to use all functions of our website to their full extent. For more information on Google’s privacy practices, please visit:

• https://policies.google.com/privacy
• https://services.google.com/sitestats/de.html
• https://www.networkadvertising.org

Use of Google Search Console

For the technical monitoring and optimization of our website, we use Google Search Console, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Search Console enables us to perform statistical analyses of the search behavior of visitors to our website as well as its visibility in Google Search. In particular, we receive information about which search terms are used to find our pages, which pages were accessed and how often, and whether there are any technical errors (e.g., crawling or indexing issues).

No personal data from website visitors is processed or stored in connection with the use of Google Search Console. The data is provided by Google exclusively in aggregated and anonymized form. It is not possible to link the data to individual users.

The use of Google Search Console is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in analyzing website performance, detecting errors, and optimizing our content for search engines.

It cannot be ruled out that, in the course of use, data may be processed on servers operated by Google LLC in the United States. Google is certified under the EU-U.S. Data Privacy Framework (see: https://www.dataprivacyframework.gov). In addition, Standard Contractual Clauses issued by the European Commission are in place to safeguard data transfers. For more information on data processing by Google, please visit:

• https://policies.google.com/privacy

Integration of Google Looker Studio

To visualize and analyze data, we use Google Looker Studio, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Looker Studio enables us to create interactive dashboards and reports that are fed from various data sources.

This may involve the processing of personal data, particularly if the underlying data sources contain information such as:

• IP addresses
• usage data
• email addresses, or
• other characteristics that directly or indirectly identify an individual

Processing is carried out exclusively for analysis, planning, or internal management purposes. No personal data analyses are published.

Data processing is based on Article 6(1)(f) of the GDPR, as there is a legitimate interest in the analysis and processing of company data. To the extent that data is transferred based on your consent, the legal basis is Article 6(1)(a) of the GDPR.

Google processes personal data as a data processor in accordance with Article 28 of the GDPR. Data is generally stored on servers within the EU. However, in certain cases, data may be transferred to third countries, particularly the United States. Google is certified under the EU-U.S. Data Privacy Framework (see: https://www.dataprivacyframework.gov) and additionally provides appropriate safeguards through standard contractual clauses pursuant to Article 46 of the GDPR.

For more information on data processing by Google, please visit:
https://policies.google.com/privacy?hl=de

The use of Google Looker Studio is optional and limited to internal purposes. No interactive reports containing personal data are made publicly available.

Integration of Microsoft Bookings

For appointment scheduling, we offer an online service via Microsoft Bookings, a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.

Using Microsoft Bookings allows you to schedule an appointment with us online. When making a booking, the following personal data is typically processed:

• Name
• Email address
• Phone number
• Selected appointment
• Optional information (e.g., inquiries or comments in the free-text field)

This data is processed exclusively for the purpose of scheduling, conducting, and confirming your appointment.

Your data is processed on the basis of Article 6(1)(b) of the GDPR, to the extent that booking the appointment is necessary for the implementation of (pre)contractual measures, as well as on the basis of Article 6(1)(f) of the GDPR, as we have a legitimate interest in the efficient handling of appointments. If you voluntarily provide additional information, this is based on your consent pursuant to Article 6(1)(a) of the GDPR.

Data processing is carried out by Microsoft as a data processor in accordance with Article 28 of the GDPR. Microsoft generally processes the data on servers located within the EU. In individual cases, however, data may be transferred to third countries (in particular the United States). Microsoft has submitted to the EU-U.S. Data Privacy Framework (see: https://www.dataprivacyframework.gov) and provides standard contractual clauses to safeguard these transfers. For more information on data processing by Microsoft, please visit:

• https://privacy.microsoft.com/de-de/privacystatement

Use of Microsoft Bookings is voluntary. Alternatively, you can schedule appointments with us by phone or email without using this service.

Use of Zoom

We use the video conferencing service Zoom, provided by Zoom Video Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA, to host webinars.

Participation in a webinar requires prior registration. Upon registration, a contractual relationship is established regarding the provision of and participation in the online event.

The purpose is to conduct digital informational events and webinars. Depending on your participation, the following personal data is processed during use:

• Registration data (name, email address),
• technical access data (e.g., IP address, browser type, client version),
• during active use: audio, video, and chat data (voluntarily shared by the user).

By default, the webinar is configured so that participants are not recorded with audio, video, or their names. Active participation via microphone or camera is voluntary and is within the user’s control.

The webinars are recorded and subsequently published, for example, on our YouTube channel. Before recording begins, we clearly inform all participants so that you can decide for yourself whether you wish to continue participating or leave the event.

Art. 6(1)(b) GDPR—for the purpose of conducting the webinar within the framework of the contractual relationship (following registration),

Zoom generally processes data on servers located within the European Union. The transfer of personal data to the U.S. cannot be ruled out in individual cases. Zoom is certified under the EU-U.S. Data Privacy Framework and also provides EU Standard Contractual Clauses in accordance with Art. 46 GDPR to safeguard international data transfers.

Further information:

• https://www.zoom.com/de/trust/privacy/privacy-statement/
• https://www.youtube.com/intl/ALL_de/howyoutubeworks/user-settings/privacy/

10. Who should I contact if I have questions about data protection at Droniq?

The data controller within the meaning of the General Data Protection Regulation and the Federal Data Protection Act is:

Droniq GmbH
Ginnheimer Stadtweg 88
60431 Frankfurt
Email: info@droniq.de

The contact information for our Data Protection Officer is as follows:

DFS Deutsche Flugsicherung GmbH
Am DFS-Campus 10
63225 Langen
Email: datenschutzbeauftragter@dfs.de

11. Your Rights as a Data Subject

As a data subject, you have the following rights:

• pursuant to Art. 15 of the GDPR, the right to request information about your personal data processed by us to the extent specified therein;
• pursuant to Article 16 of the GDPR, the right to request, without undue delay, the rectification of inaccurate personal data or the completion of your personal data stored by us;
• pursuant to Art. 17 of the GDPR, the right to request the erasure of your personal data stored by us, unless further processing
  • for the exercise of the right to freedom of expression and information;
  • to comply with a legal obligation;
  • for reasons of public interest; or
  • to assert, exercise, or defend legal claims;
• Pursuant to Article 18 of the GDPR, you have the right to request the restriction of the processing of your personal data to the extent that
  • you contest the accuracy of the data;
  • the processing is unlawful, but you object to its erasure;
  • we no longer need the data, but you need it to assert, exercise, or defend legal claims; or
  • you have objected to the processing pursuant to Article 21 of the GDPR;
• pursuant to Article 20 of the GDPR, the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller;
• pursuant to Article 77 of the GDPR, the right to lodge a complaint with a supervisory authority. As a general rule, you may contact the supervisory authority at your usual place of residence, your place of work, or our company’s registered office.

If you have any questions regarding the collection, processing, or use of your personal data, or if you wish to request information, correction, restriction, or erasure of data, as well as to withdraw consent or object to a specific use of your data, please contact us directly by mail or email:

Droniq GmbH
Ginnheimer Stadtweg 88
60431 Frankfurt
Phone: 069-509547-400
Email: info@droniq.de

In addition, pursuant to Article 21(1) of the GDPR, you have the right to object to processing based on Article 6(1)(f) of the GDPR, as well as to processing for the purposes of direct marketing.

The collection of data for the provision of the websites and the storage of data in log files is strictly necessary for the operation of the website. Consequently, the user has no right to object.

12. Changes to the Privacy Policy

We reserve the right to continuously update this Privacy Policy and any specific privacy policies to reflect changes in legislation or case law. We therefore recommend that you visit the relevant web pages regularly to stay informed about the protection and processing of your data.

13. Links to Other Websites

The Droniq GmbH website contains links to other websites that are neither operated by nor the responsibility of Droniq. Droniq is not responsible for the content or compliance with data protection regulations on these other websites.

Effective: May 2026