Privacy Policy

1. Introduction

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our drone operations management platform, our mobile application, and our website.

The service is provided by DroneBundle Oy, a company registered in Finland under Business ID 3562593-2, with its registered office at Sturenkatu 26 LT 36, 00510 Helsinki, Finland. In this policy, DroneBundle, we, our, and us refer to DroneBundle Oy.

2. Our Role in Handling Data

Our platform is provided to organizations. Where an organization uses DroneBundle to manage its operations, that organization decides what information is entered into the platform and why. In relation to that content, which includes projects, jobs, flight records, uploaded files, messages, and details of the organization's personnel and clients, the organization is the data controller and we act as a data processor on its instructions.

We act as the data controller for information we determine the purposes of ourselves. This includes account and authentication records, billing and subscription information, support correspondence, and information collected through our marketing website. If you are a member of an organization that uses DroneBundle and you wish to exercise rights over operational content, please contact your organization's administrator in the first instance.

3. Information We Collect

Account Information

We collect information provided when an account is created, including name, email address, job title, organization details, and subscription information. Accounts are normally created by an administrator within your organization rather than by you directly.

Flight and Operational Data

We process information related to drone operations entered into the platform by your organization, including:

• Flight plans and mission details
• Pilot information and certifications
• Aircraft and equipment data
• Flight logs and operational records
• Location data related to flight operations
• Risk assessments and compliance documentation
• Files, photographs, and documents uploaded to projects and jobs
• Messages posted in project discussions

Technical and Usage Information

When you use our web platform or visit our website, we and our service providers collect technical information such as IP address, device and browser characteristics, pages visited, and interactions with features. This is used to operate the service, keep it secure, and understand how it is used. Our mobile application does not collect usage analytics or device advertising identifiers, and does not track you across other companies' apps or websites.

4. Mobile Application

Our mobile application is a companion to the web platform for people who already hold an account. It requests the following permissions, each only at the point you use the related feature, and you may decline or later revoke them in your device settings:

• Camera: to capture site photographs and attach them to a job or project
• Photo library: to select existing photographs to attach to a job or project
• Files: to select documents you choose to upload

Photographs and documents are uploaded only when you explicitly choose to attach them. The application does not access your camera or photo library in the background, and does not scan or index your library.

The application does not request access to your device location, contacts, calendar, microphone, or health data. Authentication tokens are stored in the secure keystore provided by your operating system and remain on your device. Signing out removes them.

5. How We Use Your Information and Our Legal Bases

Where the General Data Protection Regulation applies, we rely on the following legal bases:

• Performance of a contract: to provide and maintain the platform, process flight planning and compliance requirements, generate reports, administer accounts and subscriptions, and provide support
• Legitimate interests: to keep the service secure and reliable, prevent misuse, understand how the service is used, and improve and develop features, balanced against your rights and interests
• Legal obligation: to meet accounting, tax, and other obligations that apply to us, and to respond to lawful requests from authorities
• Consent: where we ask for it, such as certain website cookies and optional marketing communications. You may withdraw consent at any time

6. Data Sharing and Disclosure

We do not sell your personal data and we do not use it for advertising. We share information with the following categories of recipients:

• Service providers: providers of cloud hosting and storage, email delivery, payment processing, mapping, product analytics, customer support, and artificial intelligence features used within the platform. These providers act on our instructions under written data processing agreements
• Within your organization: content you enter is visible to other members of your organization's workspace according to the permissions your administrator sets
• Legal requirements: when required by law or to establish, exercise, or defend legal claims
• Aviation authorities: when necessary for regulatory compliance or safety investigations
• Business transfers: in connection with mergers, acquisitions, or asset sales

A current list of the sub-processors we use is available to customers on request by contacting us at the address below.

7. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit and at rest, role-based access controls, and regular security assessments. Our internal controls are aligned to the SOC 2 framework. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

8. Data Retention

We retain information for as long as an account is active or as needed to provide the service. Flight and operational data may be retained longer where required for regulatory compliance or safety purposes. Billing records are retained for the period required by accounting and tax law. When a customer relationship ends, data is deleted or anonymized within a reasonable period, subject to those requirements.

Because accounts are created and managed by an administrator within your organization rather than through self registration, requests to remove an individual account or its associated content are handled by that administrator. You may also contact us directly using the details below and we will assist.

9. Your Rights

Depending on your location, you may have the right to:

• Access your personal information
• Correct inaccurate data
• Request deletion of your data
• Request restriction of processing
• Object to processing of your data
• Data portability
• Withdraw consent where applicable

To exercise these rights, contact us using the details below. If your request concerns content held in an organization's workspace, we will refer it to that organization as the controller. If you are in the European Economic Area and believe we have not handled your information properly, you may lodge a complaint with your local supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

10. Children's Privacy

Our services are intended for business use and are not directed at individuals under 18 years of age. We do not knowingly collect personal information from children under 18.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on our website and updating the "Last updated" date.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at privacy@dronebundle.com or by post at DroneBundle Oy, Sturenkatu 26 LT 36, 00510 Helsinki, Finland.