This Privacy Notice explains how Digipa S.R.L. collects, uses, and processes your personal data when you use the DroneDB Hub platform (hub.dronedb.app). We are committed to protecting your privacy and handling your data in a transparent, lawful, and secure manner.
If you have questions about this notice or how we handle your personal data, please contact us at support@dronedb.app.
1. Data Controller
The data controller for the personal data described in this Privacy Notice is:
Digipa S.R.L.
Piazza Giuseppe Grandi 7
20129 Milano, Italy
CF / P.IVA: 10745180967
Contact: support@dronedb.app
Website: dronedb.app
As data controller, we determine the purposes and means of processing the personal data described in this notice.
2. What We Collect
When you use DroneDB Hub, we collect and hold the following categories of personal data:
Account and Registration Data
When you create an account or register for the Hub, we collect:
- Name and surname
- Email address
- Password (stored as a cryptographic hash; we never store plain-text passwords)
- Organization name and role (if applicable)
- Profile information you choose to provide
Billing and Subscription Data
Where you subscribe to a paid plan or purchase services, we collect:
- Payment method information (processed through our payment providers Stripe and/or PayPal; we do not store full credit card numbers on our servers)
- Billing address
- Subscription plan details
- Invoice history and transaction records
- Tax identification number or VAT number (if provided)
Technical and Usage Data
We automatically collect certain technical data when you access or use the Hub:
- IP address
- Browser type and version
- Device type and operating system
- Pages visited and features used within the Hub
- Timestamps and duration of sessions
- API access logs and authentication requests
- Error logs and system diagnostics
Support Communications
When you contact our support team or otherwise communicate with us, we may collect:
- The content of your messages and communications
- Any files or screenshots you attach
- Records of support tickets and case notes
- Call recordings or transcripts, where applicable and with notice
Marketing and Communications Data
Where you opt in to receive marketing communications from us:
- Newsletter subscription status
- Communication preferences
- Records of emails sent and opened (where tracking is enabled)
- Responses to marketing communications
Security Data
To protect the platform and your account, we collect and monitor:
- Failed login attempts
- Unusual or suspicious account activity
- Security event logs
- Information related to fraud prevention
3. Lawful Basis for Processing
We process your personal data on the following lawful bases under Article 6 of the GDPR:
| Data Category | Lawful Basis | Legal Reference |
|---|---|---|
| Account and registration data | Performance of a contract with you (your use of the Hub) | Article 6(1)(b) GDPR |
| Billing and subscription data | Performance of a contract and compliance with legal obligations (tax and accounting) | Articles 6(1)(b) and 6(1)(c) GDPR |
| Technical and usage data | Legitimate interest in operating, securing, and improving the Hub service | Article 6(1)(f) GDPR |
| Security data | Legitimate interest in protecting the platform, users, and our systems from abuse and unauthorized access | Article 6(1)(f) GDPR |
| Support communications | Performance of a contract and legitimate interest in providing effective customer support | Articles 6(1)(b) and 6(1)(f) GDPR |
| Marketing communications (where applicable) | Your consent, or our legitimate interest in communicating about services related to your existing subscription, subject to your right to opt out | Articles 6(1)(a) and 6(1)(f) GDPR |
Where we rely on consent, you have the right to withdraw it at any time by contacting us at support@dronedb.app. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.
4. How We Use Your Data
We use your personal data for the following purposes:
Service Delivery and Operation
- Creating, managing, and securing your Hub account.
- Providing access to DroneDB Hub features and functionality.
- Processing and managing your geospatial data within the platform.
- Sending service-related notifications, such as system maintenance, outages, or feature updates.
Billing and Payments
- Processing your payments and managing your subscription.
- Issuing invoices and maintaining financial records.
- Verifying your identity and payment information for fraud prevention.
Customer Support
- Responding to your support requests and inquiries.
- Resolving technical issues with your account or data.
- Following up on support cases to ensure satisfactory resolution.
Platform Security
- Monitoring and preventing unauthorized access, fraud, or abuse.
- Investigating security incidents and responding to threats.
- Maintaining audit logs for accountability and legal compliance.
Service Improvement
- Analyzing aggregated and anonymized usage data to improve the Hub's functionality, performance, and user experience.
- Developing new features and services.
- Conducting technical testing and quality assurance.
Legal Compliance
- Complying with applicable laws, regulations, and legal processes.
- Responding to lawful requests from public authorities.
- Enforcing our terms of service and other agreements.
5. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The following table summarizes our data retention periods:
| Data Category | Retention Period | Legal/Policy Basis |
|---|---|---|
| Account data | Duration of contract + 30-day retrieval period | Contractual obligations |
| Billing and invoice records | Duration of contract + 10 years after tax year end | Art. 2220 Codice Civile and Art. 22 D.P.R. 600/1973 |
| Technical logs and usage data | Up to 12 months | Security and operational needs |
| Support communications | Duration of case + 24 months | Quality assurance and legal claims |
| Backup data | Minimum 30 days per our backup rotation schedule | Disaster recovery |
| Consent records | Duration necessary to demonstrate consent | GDPR Article 7(1) |
| Marketing suppression list | Indefinite (to respect opt-out) | GDPR compliance |
| Legal claims data | Applicable limitation period (up to 10 years under Italian civil law) | Legal obligation |
Technical and security logs are retained for up to 12 months for operational and security purposes, after which they are deleted or anonymized.
Backup copies of production data are subject to our backup rotation schedule and are not accessible for regular processing purposes. For more information about our backup procedures, please refer to our Data Processing Addendum.
If you wish to know what personal data we hold about you or to request deletion of your data, please contact us at support@dronedb.app.
6. Data Sharing
We may share your personal data with the following categories of recipients:
Subprocessors
We engage third-party service providers ("subprocessors") to assist us in operating the Hub. These processors handle your data strictly on our instructions and are bound by data processing agreements that impose confidentiality and security obligations. Our subprocessors may include:
- Payment processors (Stripe, PayPal) - for processing subscription payments and billing. For fraud prevention and certain compliance-related activities, these providers act as independent controllers determining their own purposes for that subset of data.
- Hosting and infrastructure providers (Hetzner Cloud - Hetzner Online GmbH, Germany) - for hosting, storing, and processing data on the Hub platform at data centers in Falkenstein and Nuremberg.
- Content delivery networks - for delivering static content and improving performance. We use the following CDN services on dronedb.app: Cloudflare CDNJS (cdnjs.cloudflare.com), jsDelivr (cdn.jsdelivr.net), jQuery CDN (code.jquery.com), and Google Fonts (fonts.googleapis.com).
- Email delivery services (Amazon SES - Amazon Web Services, Inc., USA) - for sending transactional and service-related emails. Transfers to Amazon SES are protected by the EU Standard Contractual Clauses.
We do not sell your personal data to third parties.
Legal Requirements
We may disclose your personal data where we are legally obligated to do so, or where we believe in good faith that such disclosure is necessary to:
- Comply with a court order, warrant, subpoena, or other legal process.
- Protect the rights, property, or safety of Digipa S.R.L., our users, or the public.
- Detect, prevent, or address fraud, security, or technical issues.
Business Transfers
In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your personal data may be transferred as part of that transaction. We will notify you of any such change and ensure that the transferee is bound by equivalent data protection obligations.
7. International Data Transfers
Our production infrastructure is hosted at Hetzner Cloud data centers in Germany, and we take reasonable measures to ensure that your personal data is processed within the European Union or European Economic Area.
Subprocessor-Specific Transfer Details
The following subprocessors process data across jurisdictions:
- Stripe (Stripe Payments Europe, Limited, Ireland and Stripe, Inc., USA) processes payment-related data. Transfers to Stripe's US operations are protected by EU SCCs and, where applicable, the EU-US Data Privacy Framework.
- PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) processes payment data within the EEA. PayPal's processing as an independent controller for fraud prevention and compliance is governed by PayPal's own privacy policy. The statement that payment data is processed within the EEA applies to PayPal's role as our subprocessor for payment transactions, not to its independent controller activities. Data processed by PayPal in its capacity as an independent controller may be transferred to PayPal entities outside the EEA in accordance with PayPal's own data transfer mechanisms.
- Amazon SES (Amazon Web Services, Inc., USA) is used for email delivery, protected by EU SCCs.
- CDN services (Cloudflare CDNJS, jsDelivr, jQuery CDN, Google Fonts) serve static content from globally distributed servers. Access to these CDNs may involve transfers of your IP address and browser data to servers outside the EU/EEA, protected by the applicable Standard Contractual Clauses or adequacy decisions as applicable to each provider.
Where your personal data is transferred to or processed in a country outside the EU/EEA (for example, by a subprocessor with operations outside the EU/EEA), we ensure that appropriate transfer mechanisms are in place in accordance with Chapter V of the GDPR. These may include:
- The European Commission's Standard Contractual Clauses (SCCs).
- Adequacy decisions by the European Commission.
- Other legally recognized transfer mechanisms.
If you would like more information about the countries in which your data is processed and the safeguards applied, please contact us at support@dronedb.app.
8. Data Protection Officer
We have not appointed a Data Protection Officer (DPO) as this is not required under Article 37(1) of the GDPR for our processing activities. For data protection inquiries, you may contact us at support@dronedb.app.
9. Your Rights
Under the GDPR and applicable data protection law, you have the following rights with respect to your personal data:
Right of Access (Article 15)
You have the right to request confirmation as to whether we are processing your personal data, and, where applicable, to obtain a copy of the data being processed.
Right to Rectification (Article 16)
You have the right to request the correction of inaccurate or incomplete personal data.
Right to Erasure ("Right to Be Forgotten") (Article 17)
You have the right to request the deletion of your personal data, subject to certain exceptions (e.g., where we are legally required to retain the data for tax or legal reasons).
Right to Restriction of Processing (Article 18)
You have the right to request the restriction of processing of your personal data in certain circumstances, such as while we verify the accuracy of the data or the lawfulness of processing.
Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where the processing is based on consent or contract and is carried out by automated means.
Right to Object (Article 21)
You have the right to object, on grounds relating to your particular situation, to processing based on legitimate interest. Where we process your data for direct marketing purposes, you have the right to object at any time.
Right to Withdraw Consent (Article 7)
Where we process your data based on your consent, you have the right to withdraw your consent at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.
Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. In Italy, the supervisory authority is the Garante per la protezione dei dati personali (Italian Data Protection Authority), reachable at www.garanteprivacy.it.
How to Exercise Your Rights
To exercise any of your rights, please contact us at:
We will respond to your request within one month of receipt, which may be extended by two further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of your request.
Where requested, we may ask for additional information to verify your identity and process your request securely.
10. Your Uploaded Content - Processor Role
When you upload datasets, images, point clouds, or other materials to DroneDB Hub, that content may contain personal data (for example, individuals visible in aerial imagery, GPS coordinates associated with identifiable properties, or personally identifiable metadata).
With respect to personal data contained in your uploaded content, you are the data controller, and we act as your data processor.
Our processing of such data on your behalf is governed by our Data Processing Addendum (DPA), which sets out the obligations we have as a processor under Article 28 of the GDPR, including security measures, subprocessor management, data subject rights assistance, and deletion or return of data.
You remain responsible for ensuring that you have a lawful basis for collecting and uploading personal data to the Hub, and for providing appropriate notices to data subjects whose data may be included in your uploads.
11. Cookies and Tracking
The DroneDB Hub platform (hub.dronedb.app) and the DroneDB website (dronedb.app) use cookies and similar tracking technologies to enhance your experience, remember your preferences, analyze usage patterns, and deliver relevant advertising.
What Are Cookies
Cookies are small text files that are stored on your device when you visit a website. They help the website remember your preferences, understand how you use the site, and provide a better user experience. Similar technologies, such as web beacons and local storage, may also be used.
Categories of Cookies Used
We use the following categories of cookies and tracking technologies:
| Category | Technology | Provider | Purpose | Duration | Legal Basis |
|---|---|---|---|---|---|
| Strictly necessary | WordPress session cookies | First-party | Authentication, session management | Session | Art. 6(1)(b) GDPR |
| Strictly necessary | Security cookies (wp-settings, wp-admin) | First-party | CSRF protection, admin sessions | Session | Art. 6(1)(b) GDPR |
| Performance | Google Tag Manager | Google LLC | Tag orchestration for other trackers | Session | Art. 6(1)(f) GDPR |
| Performance | Cloudflare cookies | Cloudflare, Inc. | DDoS protection, CDN, performance | Varies | Art. 6(1)(f) GDPR |
| Functional | iubenda consent cookie | iubenda | Remembers consent preferences | 12 months | Art. 6(1)(c) GDPR |
| Functional | Google Fonts | Google LLC | Typography rendering | 1 year | Art. 6(1)(f) GDPR |
| Functional | Font Awesome | Fonticons, Inc. | Icon rendering | 1 year | Art. 6(1)(f) GDPR |
| Analytics | WooCommerce Order Attribution Tracking | First-party | WooCommerce order attribution | Varies | Art. 6(1)(f) GDPR |
| Analytics | Google Analytics 4 | Google Ireland Limited | Usage analytics, user behavior | ~2 months | Art. 6(1)(f) GDPR |
| Marketing | Google Ads conversion tracking | Google Ireland Limited | Conversion tracking for ad campaigns | ~3 months | Art. 6(1)(f) GDPR |
| Marketing | Google Conversion linker | Google Ireland Limited | Cross-device conversion linking | ~6 months | Art. 6(1)(f) GDPR |
Cookie Consent
We use the iubenda Cookie Solution to manage your cookie preferences and obtain your consent. When you first visit our website, you will see a cookie banner providing information about our use of cookies and asking for your consent. You can manage your cookie preferences at any time by clicking the cookie icon or "Cookie Settings" link on our website.
Third-Party Services
Some of the cookies and tracking technologies listed above are set by third-party service providers. These third parties may use the information they collect to:
- Understand and analyze how you use our website and services.
- Compile reports on website activity for us.
- Deliver and measure the effectiveness of advertising campaigns.
- Provide other services related to website activity and internet usage.
Third-party privacy policies:
Managing and Withdrawing Consent
You may manage your cookie preferences and withdraw consent as easily as you gave it:
- Cookie Preferences Control: Use the cookie icon or "Cookie Settings" link on our website to modify your cookie preferences at any time.
- Browser Settings: Most browsers allow you to block, delete, or restrict cookies through browser settings. Instructions for managing cookies vary by browser and are available in your browser's help section.
- Third-Party Opt-Out: Where third parties set cookies, you may use their respective opt-out mechanisms. For Google services, you can visit Google Ads Settings or use the Network Advertising Initiative Opt-Out tool.
- Consent Records: We maintain logs of consent given and withdrawn to demonstrate compliance with Article 7 of the GDPR.
Withdrawing consent does not affect the lawfulness of processing that occurred prior to withdrawal.
12. Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Network firewalls and TLS encryption for data in transit.
- Role-based access controls; multi-factor authentication for administrative systems is planned but not yet implemented.
- Regular security monitoring and incident response procedures.
- Secure hosting infrastructure at Hetzner Cloud data centers in Germany with physical access controls.
For a detailed description of our security measures, including current encryption practices, please refer to our Data Processing Addendum.
We are transparent about areas where our security posture is evolving. As of the date of this notice, data on our production server is not encrypted at rest. We are treating this as a priority item and are actively working to implement encryption at rest.
13. Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you through the Hub, via email, or by posting a prominent notice on our website before the changes take effect.
We encourage you to review this notice periodically. The "Last Updated" date at the top of this document indicates when it was most recently revised.
Your continued use of the Hub after the effective date of any modified Privacy Notice constitutes your acceptance of the changes.
14. Contact
If you have any questions, concerns, or requests related to this Privacy Notice or our data processing activities, please contact us:
Digipa S.R.L.
support@dronedb.app
We aim to respond to all inquiries within a reasonable timeframe and in accordance with applicable legal timeframes.