Privacy Policy

1. Who is responsible

Dronas is a Swiss sole proprietorship owned by Joshua Schmidt. I am the controller for all personal data described here.

Contact for privacy matters: privacy@dronas.ch

General contact: contact@dronas.ch or support@dronas.ch

Because I also serve customers in the EU, this policy is written to comply with both the revised Swiss Federal Act on Data Protection (revFADP) and the EU General Data Protection Regulation (GDPR).

2. What data I collect when you request a drone flight

When you send a non-binding request through the price calculator on my website, I store the following:

• The email address you enter, so I can contact you about the order.
• The message you write to me, describing what you would like to film.
• The technical details you selected in the calculator (occasion, date, approximate flight location including street, ZIP and city, shooting time, delivery format, etc.). These form the content of your request.
• The language you would like to be contacted in.
• A randomly generated order number and access token that let you view the order online.
• Timestamps of when the order was created and updated.

Later, if the order proceeds, I may add further information you provide to me (first and last name, phone number, company, billing address, notes). I only ask for what I actually need to fulfil the job and issue an invoice.

I do not ask for and do not want to receive any special categories of personal data (health, political views, etc.).

The fact that a visit led to a request is also counted anonymously in the visitor statistics (section 6).

The legal basis is the handling of your request and the preparation and performance of a contract (Art. 6(1)(b) GDPR).

3. What data I collect when you order an identification label

You can design the label in your browser without sending anything to me. The preview and the JSON and PNG export are created locally on your device. Data is only transmitted when you place an order.

When you place an order, I process the following:

• Your label design: the text to be printed, material, size and layout. The text can contain personal data that you enter yourself, for example your UAS operator number, your name, a phone number or an email address.
• A randomly generated order number and the reference of the associated payment session.
• After successful payment, the details you entered at checkout: name, email address, billing and delivery address, and a phone number if you provided one.
• The shipping method you chose, the shipping cost and the payment status of the order.

I use this data to produce your label, send it to you, confirm your order by email and answer questions about it. I also send myself an internal notification email containing the order, your contact details and the label design.

Labels are sent by letter mail within Switzerland. Swiss Post receives your name and delivery address on the envelope for this purpose.

If you cancel the checkout or do not complete the payment, the stored label design is deleted automatically as soon as the payment session expires, normally within 24 hours.

The legal basis is the performance of the contract with you (Art. 6(1)(b) GDPR) and, for the retention of accounting records, my legal obligations (Art. 6(1)(c) GDPR).

4. Payment

Label orders are paid through Stripe Checkout. The payment page is operated by Stripe Payments Europe, Limited (Dublin, Ireland), not by me.

On that page Stripe collects your name, email address, billing and delivery address and your payment details (for example the card number). I never see or store your full payment details. Stripe only passes on to me the contact and address details listed in section 3, the amount paid and the payment status.

Stripe processes this data on my behalf to handle the payment and, in addition, under its own responsibility, for example to prevent fraud and to meet its own legal obligations. In doing so Stripe may transfer data to the United States and other countries, and it sets its own cookies on its payment page. Details are in Stripe’s privacy policy at stripe.com/privacy.

After payment you are redirected to a receipt page that is also operated by Stripe.

5. Server logs

My web server is hosted in a data centre in Germany. Like almost every web server on the internet, it writes an access log for every request. In the default configuration this log contains:

• Your IP address
• The date and time of the request
• The URL you requested and the HTTP method
• The HTTP response code and the size of the response
• The referrer (the page you came from, if any)
• Your browser User-Agent string

In addition, my application writes technical log entries when an order is created, for example the order number, the email address of a request or the submitted label design. These entries are used only for troubleshooting.

These logs are used to keep the site running, to detect abuse, and to debug problems. They are rotated automatically and typically kept for a few weeks before being deleted.

The legal basis is my legitimate interest in operating a secure and functional website (Art. 6(1)(f) GDPR, Art. 31(1) revFADP).

6. Cookies and visitor statistics

I do not use advertising trackers, third-party analytics services or fingerprinting.

To see how the website is used and whether advertising such as my ads in the Anzeiger works, I count visits with my own simple statistics. They run entirely on my server; no data is passed on to third parties. For each visit I store:

• a random visit ID;
• the pages viewed and the time;
• a campaign code if the link contains one (for example ?ref=anzeiger-84 in the QR code of an ad);
• the domain of the website you came from (for example google.com, without the exact address);
• the language version of the website and the type of device (phone, tablet or computer).

I do not store your IP address, your browser or your operating system for this. If you send a request or start a label order, the statistics only note that the visit led to it, without your contact details or the order number.

To count a visit as one, I set the cookie "dronas_sid". It only contains the random visit ID with a signature, cannot be read by scripts and expires 30 minutes after your last page view. To stop anyone from inflating the numbers, I limit the number of new visits per connection. For this I use a hash of your IP address that changes daily, cannot be reversed and is only kept in memory, never stored.

If you open a link with a campaign code, I remove the code from the address straight away and keep it in the cookie "dronas_ref" for up to 30 minutes until the visit has been counted. The cookie is then deleted.

The statistics are deleted automatically after 13 months. The legal basis is my legitimate interest in improving my services and my advertising (Art. 31(1) revFADP, Art. 6(1)(f) GDPR).

You can object to the statistics at any time. If your browser sends the "Do Not Track" or "Global Privacy Control" signal, nothing is counted. Or use the button below: it sets the cookie "dronas_no_stats" for one year, and your visits are no longer counted.

Other cookies: when you open the link to your order, the access token from the link is stored in a cookie so that the order page can be displayed. This cookie is only valid for that order page, cannot be read by scripts and expires when your browser session ends. The Stripe payment page is operated by Stripe and uses its own cookies (see section 4).

7. Captcha

To protect the request form from bots, I use Private Captcha. The captcha service runs on my own server in Germany (captcha.hyper-tech.ch). To solve the captcha, your browser connects to this server, which thereby receives your IP address and technical request data. Private Captcha does not track users and does not set cookies.

8. Map and location lookups

When you type an address or postal code into the calculator, your input is sent from my server to OpenStreetMap (the Nominatim service operated by the OpenStreetMap Foundation) and to the OpenPLZ API to look up matching addresses, localities and coordinates. Only the text you type is transmitted, not your IP address.

The coordinates of the selected location are sent from my server to Nominatim, to the OSRM routing service (router.project-osrm.org) to estimate the travel distance, and to the geoportal of the Swiss Confederation (geo.admin.ch) to check for flight restrictions.

The map itself is loaded by your browser directly from OpenStreetMap servers (tile.openstreetmap.org). The software library used to display the map (Leaflet) is loaded from the content delivery network unpkg.com when you open my website; unpkg.com is delivered via Cloudflare, Inc. (USA). In both cases the respective operator receives your IP address and technical data such as your browser type.

The legal basis is my legitimate interest in offering a working price calculator (Art. 6(1)(f) GDPR).

9. Email delivery

Confirmation and notification emails are sent through Brevo (Brevo SAS, Paris, France). Brevo processes the recipient address and the content of these emails on servers in the European Union.

Brevo acts as my processor under a data processing agreement.

10. Where your data is stored

Application data (flight requests, label orders, messages, contact details, visitor statistics) is stored in my own database on the same server in Germany as the website. I do not use any third-party database service.

Payment data is stored by Stripe (section 4). Emails I send or receive are additionally stored in my mailbox and, for delivery, at Brevo (section 9).

11. How long I keep your data

Order-related personal data (flight requests and label orders) is kept as long as it is needed to run the order and afterwards for up to 10 years, to comply with Swiss accounting and retention obligations (Art. 958f Swiss Code of Obligations).

I only keep personal data because I need it for the order or because the law requires me to. If you ask me to delete your data earlier and there is no legal reason to keep it, I will.

Label designs from checkouts that were not paid are deleted as soon as the payment session expires (section 3).

Download links for delivered footage are time-limited. I keep the delivered material for 12 months after delivery (see the terms and conditions). If you would like it removed earlier, please contact me. See section 13.

Server access logs are kept only for the duration of the default log rotation, typically a few weeks.

Visitor statistics are deleted automatically after 13 months (section 6).

12. Who I share data with

I do not sell your data and I do not share it for advertising.

I share the minimum necessary data with the following recipients. Where they act as my processors, this is based on appropriate data processing agreements:

• Brevo SAS (France), sending transactional emails.
• Stripe Payments Europe, Limited (Ireland), payment processing for label orders.
• Swiss Post, delivery of label orders (name and delivery address).
• OpenStreetMap Foundation (United Kingdom), address lookups and map tiles.
• The OpenPLZ API and the OSRM routing service, postal code lookups and distance calculation (search text and coordinates only).
• Federal Office of Topography swisstopo (geo.admin.ch), flight restriction checks (coordinates only).
• unpkg.com / Cloudflare, Inc. (USA), delivery of the map library.
• My German hosting provider, providing the physical server and network.

Stripe and Cloudflare may also process data in the United States. These transfers are safeguarded by their certification under the Swiss–US and EU–US Data Privacy Framework and, where applicable, by standard contractual clauses.

I may also disclose data if I am legally required to (for example, to Swiss authorities in response to a valid legal request).

13. Your rights

You have the following rights over your personal data:

• Right to information and access. You can ask what data I hold about you.
• Right to rectification. You can ask me to correct wrong or outdated data.
• Right to erasure (right to be forgotten). You can ask me to delete your data.
• Right to restriction and to object to processing.
• Right to data portability. You can ask for your data in a machine-readable format.
• Right to withdraw consent, where processing is based on consent.

To have an order deleted (right to be forgotten) or to exercise any other right, please write to privacy@dronas.ch. This applies to flight requests as well as label orders. I will reply within 30 days. Data that I am legally required to keep (section 11) is deleted once the retention period has ended.

If you believe I am handling your data unlawfully, you also have the right to complain to a supervisory authority. In Switzerland this is the FDPIC (edoeb.admin.ch), or the data protection authority in your EU country of residence.

14. Security

Order pages are protected by a random, unguessable access token that I generate for each order. Please keep the link I send you private. If you think your access link has leaked, contact me and I can rotate it.

Traffic between your browser and my server is always encrypted with HTTPS.

15. Minors

My service is not directed to children. If you are under 16, please do not use this website or send me personal data.

16. Changes to this policy

I may update this policy from time to time, for example when I add a new tool or when the law changes. The date at the top always shows when it was last updated.