Privacy Policy
This policy explains how personal data is processed when you use DroneGallery, the discovery, comparison and lead platform for professional unmanned systems, and when DroneGallery lists information about companies and their representatives. It is written to meet the information duties in Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.
1. Who is responsible
The data controller is:
Cemco Consulting ApS, Denmark
Email: info@dronegallery.com
We have not appointed a data protection officer. Please send any question about personal data, or any request under this policy, to the email address above.
2. What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: name, email address, password (stored only as a one-way hash), role, email-verification status, one-time sign-in codes (stored hashed), trusted-device records (browser user agent) and the session cookie | Creating and running your account; protecting it with email verification and sign-in codes on new devices | Art. 6(1)(b) — performance of the contract with you; Art. 6(1)(f) — our legitimate interest in keeping accounts secure |
| Manufacturer workspace and claims: work email, job title, message, team membership, plan | Verifying that you represent a company and letting you manage its profile, products and leads | Art. 6(1)(b); Art. 6(1)(f) — preventing unauthorised claims |
| Enquiries and requests for quote (RFQs): name, organisation, work email, country, quantity, message, requirements and the products concerned | Sending your enquiry to the manufacturer(s) you choose and letting them respond. If a profile has not been claimed yet, the enquiry is sent to us and we pass it on to the manufacturer | Art. 6(1)(b) — steps taken at your request; Art. 6(1)(f) — facilitating B2B contact |
| Requests you send us (corrections, removal, copyright and privacy requests): name, email, organisation, message and the page concerned | Handling and documenting the request | Art. 6(1)(c) — legal obligations (e.g. answering data-protection requests); Art. 6(1)(f) — handling notices about our content |
| Newsletter (DroneGallery Radar): email address, where you signed up, dates | Sending the newsletter | Art. 6(1)(a) — your consent, which you can withdraw at any time |
| Payments (manufacturers): plan, boosts, amounts, Stripe customer and subscription references. Card details are handled by Stripe and never reach us | Billing, subscriptions, invoices and bookkeeping | Art. 6(1)(b); Art. 6(1)(c) — legal obligations under the Danish Bookkeeping Act |
| Usage statistics without identifiers: event type (e.g. a product view or search), the product or manufacturer concerned, country derived from the IP address, and search terms | Showing manufacturers aggregate interest in their products and improving the catalogue | Art. 6(1)(f) — operating and improving the service |
| AI Search: the text you type into the AI search box | Interpreting natural-language searches into filters. Please don't enter personal data in searches | Art. 6(1)(f) |
| Security data: IP addresses in short-lived rate-limit counters, an audit log of account and administrative actions, and hosting logs | Preventing abuse and fraud, investigating incidents | Art. 6(1)(f) |
| Analytics cookies (Google Analytics 4) — only if you accept them | Understanding how the site is used | Art. 6(1)(a) — consent; see the Cookie Policy |
Where we rely on legitimate interests we have weighed them against your interests and rights; you can ask us for more detail and you can always object (see section 7). Providing account, enquiry or claim data is voluntary, but without it we cannot provide those features. We do not use personal data for automated decisions that have legal or similarly significant effects on you.
3. Business contact data from public sources
Much of DroneGallery's catalogue is compiled automatically from publicly available sources — primarily manufacturers' own websites, press releases, datasheets, trade fair listings and public company registers (see the Crawler Policy and the Data Disclaimer). Besides company and product information, this can include personal data about people who represent a company in a professional capacity:
- name, job title or role and the company they work for;
- business contact details that the company has published, such as a work email address or phone number;
- the source (web address) and date the information was collected.
Purpose: to maintain a transparent directory of companies in the unmanned-systems industry, let buyers identify and contact the right supplier, and verify claims to company profiles. Legal basis: Art. 6(1)(f) — our legitimate interest, and the legitimate interest of buyers and suppliers, in a functioning B2B market directory. We consider this balanced because the data is professional, was published by or for the company itself, is limited to what is needed to reach the company, and can be removed on request. We do not collect special categories of data (Art. 9) or data about private life.
We do not use these contact details for unsolicited electronic marketing. If you are listed and don't want to be, email info@dronegallery.com or use the correction and removal options described in the Data Disclaimer. When you object, we stop the processing and remove or suppress your details, unless we have compelling legitimate grounds or need them for legal claims. Because we collect this data from sources other than you, this section is our information under Art. 14 GDPR; if we contact you directly we will also point you to this policy.
4. Who receives data
We do not sell personal data. It is shared only as follows:
- Manufacturers you contact receive your enquiry or RFQ. They process it as independent controllers under their own privacy policies.
- Service providers (data processors) acting on our instructions under data processing agreements: Vercel Inc. (hosting and file storage), Neon Inc. (database), Twilio SendGrid (transactional email, e.g. sign-in codes and enquiry notifications), Anthropic PBC (interpretation of AI Search queries, only if AI-assisted search is switched on — it is currently off) and, if you consent, Google Ireland Ltd. / Google LLC (Google Analytics).
- Stripe (Stripe Payments Europe Ltd.) processes payments, partly as an independent controller for its own fraud-prevention and regulatory obligations.
- Video providers: product videos from YouTube or Vimeo are loaded only when you press play, and the provider then processes data under its own policy.
- Public authorities, advisers or a buyer of the business, where required by law or necessary to establish, exercise or defend legal claims.
5. Transfers outside the EU/EEA
Some providers are based in, or may access data from, the United States. Where that happens, transfers rely on the EU–US Data Privacy Framework for certified providers, or on the European Commission's standard contractual clauses with supplementary measures where needed. Our database is hosted in [database region, e.g. EU (Frankfurt)]. You can ask us for a copy of the relevant safeguards.
6. How long we keep data
| Data | Retention |
|---|---|
| Account data | While your account exists. You can delete it yourself under Account & privacy; unconfirmed accounts are deleted after 30 days |
| Sign-in codes | Expire after 10 minutes and are deleted within a day |
| Session / trusted-device cookies | 30 days / 90 days (or until you log out or they are revoked) |
| Enquiries and RFQs | 24 months after submission, then deleted automatically. Copies held by manufacturers follow their own policies |
| Newsletter | Until you unsubscribe (link in every issue) |
| Payment and bookkeeping records | 5 years from the end of the financial year (Danish Bookkeeping Act) |
| Rate-limit counters (IP addresses) | Up to 1 day |
| Business contact data from public sources | While the company profile is listed and the data remains relevant; removed on objection |
| Audit log | 24 months, for security and accountability |
| Usage statistics (no identifiers) | 25 months |
| Correction, removal and privacy requests | 36 months after they are resolved |
| Google Analytics (with consent) | Cookies: 13 months. Reports: [GA retention setting, e.g. 14 months] |
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectification of inaccurate data;
- erasure ("right to be forgotten");
- restriction of processing;
- data portability for data you provided on the basis of contract or consent;
- object at any time to processing based on legitimate interests — including the listing of your business contact details — and always to direct marketing;
- withdraw consent at any time (for example to analytics cookies via Cookie settings, or to the newsletter), without affecting earlier processing.
Signed-in users can download their data and delete their account themselves under Account & privacy. For anything else, use the request form or email info@dronegallery.com to exercise a right. We reply within one month (extendable by two months for complex requests, in which case we tell you why). We may ask you to confirm your identity, for example from the email address associated with the data.
8. Complaints
Please contact us first so we can try to resolve the issue. You also have the right to complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark — dt@datatilsynet.dk, www.datatilsynet.dk — or to the authority in the EU/EEA country where you live or work.
9. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections (TLS), password hashing, email-based verification and sign-in codes for new devices, hashed tokens and codes, least-privilege access for machine integrations, rate limiting and audit logging of administrative actions.
10. Other information
Children
DroneGallery is a professional service and is not directed at children. Accounts are for people aged 18 or over.
Cookies
See the Cookie Policy for the cookies we use and how to manage your choice.
Changes
We may update this policy. The date at the top shows the latest version; we will notify account holders of material changes by email or on the site.