Privacy

1. general

The protection of your personal data is a high priority for Droniq GmbH. It is important to us to inform you about what personal data we collect during your visit to our website, how it is used and what options you have. This data protection notice provides you with answers to the most important questions.

2. legal basis

Art. 6 para. 1a, b and f of the General Data Protection Regulation (GDPR) is the legal basis for the processing and protection of personal data. The specific legal bases are listed individually in the respective chapters.

3. what data is collected and how is it used?

Your data will not be used for automated decision-making, including profiling (Art. 22 GDPR).
You can register to receive information and withdraw your consent by sending an email to info@droniq.de.

3.1 Personal data

Personal data, such as your name, address, telephone number or e-mail address, is not collected unless you explicitly provide this information, for example in web forms. We delete the data collected in this context after storage is no longer required, or restrict processing if there are statutory retention obligations.

Registration may be required to use individual services on our website. This also applies if you wish to receive up-to-date information from us in future, e.g. on events, current studies, services, product information, etc. Your consent is required for this. Your consent is required for this. Your personal data will be processed on the basis of your consent in accordance with Art. 6 para. 1a of the GDPR. You can revoke your consent at any time by sending an email to info@droniq.de.

We use Typeform (https://www.typeform.com) for this purpose.

E-Mail Newsletter

With your consent, you can subscribe to our newsletter, with which we inform you regularly about current topics. We use the so-called double opt-in procedure for registration: After you have registered, you will receive an e-mail to the address provided in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 48 hours, your data will be blocked and automatically deleted after seven days.

For legal protection, we store your IP address and the times of registration and confirmation. This data processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR (consent) and Art. 6 para. 1 lit. f GDPR (legitimate interest in verifiability of consent).

Further data is not collected or is only collected on a voluntary basis. We use this data exclusively for sending the requested content and do not pass it on to third parties - subject to the processing by our service provider described below.

You can revoke your consent to the sending of the newsletter at any time - e.g. via the unsubscribe link in every email, by email to info@droniq.de or via the contact details provided in the legal notice. This does not affect the lawfulness of the processing carried out before you withdraw your consent.

After you unsubscribe, your e-mail address will be added to a blacklist to prevent future mailings. The storage takes place on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR) in avoiding unwanted mailings and to comply with legal requirements. The blacklist is used exclusively for this purpose and is not merged with other data. The storage is limited to a period of three years and is then automatically deleted. You can object to the storage if your interests outweigh our interests.

We use the "Campaign Monitor" service, operated by Campaign Monitor Holdings (UK) Limited, Northern and Shell Building, 10 Lower Thames Street, London, United Kingdom, to send and analyze our newsletter. A legally required data processing agreement has been concluded with the provider in accordance with Art. 28 GDPR. The processing takes place in a so-called third country (UK), for which an adequacy decision of the EU Commission pursuant to Art. 45 GDPR exists.

When Campaign Monitor sends the newsletter, so-called web beacons (tracking pixels) may be used. These enable us to analyze user behavior, such as whether and when an email was opened and which links were clicked on. This information may be linked to your e-mail address and therefore be personal. The analysis is used exclusively to improve our newsletter service.

Tracking only takes place with your express consent, which is obtained as part of the registration process (Art. 6 para. 1 lit. a GDPR). You can object to this analysis at any time - for example by unsubscribing from the newsletter or sending us an informal message.

Server log files

When our website is accessed, our system automatically collects data and information from the computer system of the accessing end device. This data is stored in so-called server log files.

The data collected are in particular

• the website or file accessed,
• Date and time of access,
• amount of data transferred,
• Message about successful retrieval (HTTP status code),
• Browser type and version,
• the user's operating system,
• the previously visited website (referrer URL),
• the requesting Internet service provider,
• the IP address in anonymized form.

Purpose of processing:
This data is processed to ensure a smooth connection setup, for the technical stability and security of the website (e.g. for error analysis or attack detection) and for statistical evaluation in anonymized form to improve our website.

Legal basis:
The processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR in conjunction with § 25 para. 2 no. 2 TDDDG. Our legitimate interest lies in the technically error-free presentation and optimization of our website.

Storage period:
The server log files are automatically deleted after seven days at the latest, unless storage is required for security reasons (e.g. to track attacks).

No merging:
No personal evaluation or merging with other data sources takes place. The data is not used to identify individual users and is not passed on to third parties.

3.2 For applications

If you apply to us, we process your personal data exclusively for the purpose of carrying out the application process. The processing is carried out on the basis of Art. 6 para. 1 lit. b and Art. 88 GDPR in conjunction with. § Section 26 BDSG (data processing for the purposes of the employment relationship) and - if consent has been given - on the basis of Art. 6 para. 1 lit. a GDPR.

In the case of voluntary communication of personal data or special categories of personal data, their processing is carried out on the basis of Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR. Insofar as special categories of personal data within the meaning of Art. 9 para. 1 GDPR are requested from applicants as part of the application process, the data is processed on the basis of Art. 9 para. 2 lit. b and h GDPR.

Duration of storage:
Your application data will be stored for the duration of the application process. After completion of the procedure, your data will be deleted within six months, unless there is a statutory retention obligation or you have expressly consented to longer storage (e.g. for an applicant pool).

Withdrawal of consent:
You have the right to withdraw your consent at any time with effect for the future. In the event of revocation, your data will be deleted in whole or in part - depending on the scope of your revocation - unless there is another legal basis for processing.

Note:
A rejection by the applicant or by us (Droniq GmbH) ends the application process, which leads to the deletion of your data in accordance with the above specifications.

3.3 For the purchase of services

Processing of orders

If you register on our website for a service that requires registration or for future information, personal data will be stored in our Customer Relationship Management System (CRM) after the consent procedure has been completed.

The personal data will be used in the context of contract preparation, billing and servicing of the services purchased by you in accordance with Art. 6 para. 1b of the General Data Protection Regulation (GDPR). This also includes the provision of personal data for shipping services as part of order processing.

The data will be deleted after completion of the warranty obligations or termination of the contract with you after 10 years at the latest. Due to our services, there may be legal and regulatory requirements, including product liability, warranties, recalls, etc. for longer-term personal data storage.

Use of the online store

The Droniq online store is operated by the service provider Shopify International Limited (Shopify).

Shopify collects your name, email address, shipping and billing address, payment details, company name, phone number, IP address, information about your outgoing orders, information about the merchant stores supported by Shopify that you visit, and information about the device and browser you are using.

Shopify uses this information to provide us with services. This includes support and processing of orders, risk and fraud checks, authentication and payments. Shopify also uses this information to improve our services.

When you sign up for Shop Pay, Shopify stores and uses this information to pre-fill the checkout information. Shopify also uses this information to improve your visit to the websites by presenting you with goods and services that may be of interest to you.

Some of the personal data you send to Shopify is used by Shopify to make automated decisions to a certain extent (e.g. IP addresses or payment data) so that certain, possibly fraudulent transactions are automatically blocked for a short period of time. Further information on Shopify's data protection can be found at https://www.shopify.de/legal/datenschutz or directly from Shopify:

Shopify International Limited
Attn: Data Protection Officer
c/o Intertrust Ireland
2nd Floor 1-2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
Email: hilfe@shopify.de

External payment service providers

We use Shopify Payment as our payment service provider. As part of the ordering process, the information provided by the user together with the information about the order (name, address, account number, bank code, possibly credit card number, invoice amount, currency and transaction number) is passed on to the payment service provider selected by the user in accordance with Art. 6 para. 1b GDPR. The data is passed on exclusively for the purpose of payment processing with the payment service provider and only to the extent necessary for this purpose. The respective privacy policies and contact details of the payment service providers can be found in the following list:

Shopify International Limited
Attn: Data Protection Officer
c/o Intertrust Ireland
2nd Floor 1-2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
Email: hilfe@shopify.de

When using the Droniq contact form, the data entered in the backend can also be viewed by the provider WordPress. Their privacy policy can be viewed on their website:
https://automattic.com/de/Privacy/

3.4 Use of data for Droniq Online User Management and the associated Droniq Cloud Services

As part of the provision of our services, we use the identity manager Keycloak (https://www.keycloak.org/), which is operated by the company intension GmbH (https://www.intension.de/datenschutz/). Keycloak is a Java-based open source software that serves as an Identity and Access Management (IAM) system. It enables the central administration of users, roles and access rights as well as secure authentication and authorization for various applications. To protect the privacy of our users, when they log in via Keycloak, we ensure that the connected systems only receive pseudonymized identifiers (e.g. a randomly generated identifier). No clear data such as name or e-mail address is transmitted. The assignment to the actual identity is only possible within the Keycloak system and remains hidden from third-party systems.

This procedure prevents the receiving systems from having to store or process personal data. Pseudonymization serves to implement the principle of data minimization in accordance with Art. 5 para. 1 lit. c GDPR and protects users from de-anonymization by third-party applications. The output of pseudonymized data is automated and exclusively within the scope of the intended access control.

Further information on data processing in connection with Keycloak can be found in the data protection information of the operator intension GmbH at: https://www.intension.de/datenschutz/

Purpose of data collection

The data is collected and processed for the following purposes:

• Uniform user management across all Droniq services, Trax, BOS, over-the-air update use for selected hardware
• Secure storage of our customers' user data
• Improved user-friendliness through a single sign-on connection
• Pseudonymized dissemination of data for connected services leads to an increase in data security
• Required for billing the service
• Required for securing the Droniq GTCs
• Communication on important product information (e.g. maintenance, error messages, release changes, updates, versioning, changes to the terms of use, changes to the privacy policy)

The legal basis is Art. 6 para. 1b DSGVO.

Type of data that is collected

When using Droniq User Management, you are required to provide personal data. The following data is collected for the above-mentioned purposes:

• Surname, first name and e-mail of the user
• Password of the user
• Information about the use of the app or website, including browser type and version, IP address and date/time of login

Access to the data / recipient

Only Droniq GmbH has access to the data. The data does not leave the European Economic Area (EEA). The use of the data is necessary for the provision of the services.

3.5 Use of the data for the UTM

As part of the provision of our UTM services (UTM-Unmanned aircraft system Traffic Management), we use the services of DFS Deutsche Flugsicherung GmbH. As part of this service provision, we transmit the data required to perform the services to the service providers.

Purpose of data collection

The data is collected and processed for the following purposes:

• Promote safety and traffic management,
• Generating security awareness,
• Understanding traffic situations,
• Support safe drone flight through validation support for drone ascents.
• Required for billing the service
• Required for securing the Droniq GTCs
• Communication on important product information (e.g. maintenance, error messages, release changes, updates, versioning, changes to the terms of use, changes to the privacy policy)

The legal basis is Art. 6 para. 1b DSGVO.

Type of data that is collected

The creation of a personal account is required for the use of some functions. The following data is collected for the above-mentioned purposes:

• Surname, first name and e-mail address of the user (pseudonym possible) and operator ID
• Parameters of the drone (manufacturer, name, type), if these were specified
• Log files of flight events with the drone (name of the drone, start location, start date, start time, duration), if flights are planned
• Settings as part of the service provision (language setting in German or English, geo-coordinates for the provision of warning services, voice output for warnings)
• Information about the use of the website, including browser type and version, IP address and date/time of login
• Use of geolocation: Based on your consent, the geolocation API of your internet browser/device is used. If you use a device with GPS support, the current location can be determined more precisely with the help of the GPS module. The collection and use of your location data by means of the geolocation API of your internet browser only takes place if you initiate a localization by clicking on it. This data is used to align the map display and mark your location on it. You can deactivate this functionality at any time on the end device or in the browser.

For the use of some functionalities, the user can add voluntary information in accordance with Art. 6 para. 1a GDPR. This does not apply to "non-registered users":

• Phone number
• Date of birth
• Address (street, zip code, town)
• IMSI (International Mobile Subscriber Identifier)
• Remote Pilot ID
• Call Sign
• Details of the vehicle type

The data provided during registration may be pseudonyms and will not be verified. Therefore, no personal reference can be established. In the event of an objection and the deletion of the data, the functionalities of the application cannot be guaranteed and the service may be restricted.

Integration of maps from the BKG, Basemap and Here Maps

We use the services of the following third-party providers on our website to provide cartographic information and to enable location searches:

• Federal Agency for Cartography and Geodesy (BKG)
• Basemap.com
• HERE Maps (HERE Global B.V.)

These services enable the display of interactive map content and the use of a search function for geographical locations.

When accessing pages on which map services are integrated, data is automatically transmitted to the respective providers. This includes in particular

• the information that you have visited our website (referrer URL),
• technical data such as IP address, browser type, operating system,
• the coordinates of the displayed map section,
• the search term entered when using the location search via HERE Maps.

The location data (map section) is transmitted anonymously. When using the HERE search function, the data entered is transmitted directly to HERE. This transmission takes place regardless of whether you have a user account with one of the providers or are logged in there. If you are logged in with one of these providers while using the map function, it is possible that the data may be associated with your user account. To avoid this, we recommend that you actively log out of the respective providers before using the map functions.

The providers may use the transmitted data - even from users who are not logged in - for their own purposes such as advertising, market research or the needs-based design of their services. This may include, in particular, the creation of pseudonymous user profiles. You have the right to object to the creation of user profiles by the respective providers. To do so, please contact the respective service provider directly.

Further information on data processing and your rights and settings options to protect your privacy can be found in the privacy policies of the services used:

• https://www.bkg.bund.de/DE/Service/Datenschutz/datenschutz.html
• https://legal.here.com/de-de/privacy
• https://basemap.de/datenschutz_impressum/

Access to the data / recipient

Only Droniq GmbH and DFS Deutsche Flugsicherung GmbH have access to the data. The companies are contractually obliged to use the data exclusively in the context of fulfilling the contract with DFS. The data does not leave the European Economic Area (EEA). The use of the data is necessary for the provision of the services.

3.6 Use of the data for the Droniq app

As part of the provision of our UTM services as an essential component of the app, we use the services of DFS and Unifly. As part of this service provision, we transmit the data required to perform the services to the service providers. We also use the map services of OpenStreetMap Deutschland (https://openstreetmap.de/) and MapBox (https://www.mapbox.com/maps).

Purpose of data collection

The data is collected and processed for the following purposes:

• Promoting safety and traffic management
• Creating safety awareness
• Understanding traffic situations
• Support for safe drone flight through validation support for drone ascents

The legal basis is Art. 6 para. 1b DSGVO.

In addition, registered users can provide voluntary data on the legal basis of Art. 6 para. 1a GDPR.

Type of data that is collected

The creation of a personal account is required for the use of some functions. The following data is collected for the above-mentioned purposes:

• Surname, first name and e-mail address of the user (pseudonym possible)
• Parameters of the drone (manufacturer, name, type), if these were specified
• Settings as part of the service provision (language setting in German or English, geo-coordinates for the provision of warning services, voice output for warnings)
• Log files of flight events with the drone (name of the drone, start location, start date, start time, duration), if flights are planned
• Information about the use of the app, including device type and version, IP address and date/time of login
• Use of geolocation: Based on your consent, the geolocation API of your internet browser/device is used. If you use a device with GPS support, the current location can be determined more precisely with the help of the GPS module. The collection and use of your location data by means of the geolocation API of your internet browser only takes place if you initiate a localization by clicking on it. This data is used to align the map display and mark your location on it. You can deactivate this functionality at any time on the end device or in the browser.

For the use of some functionalities, the user can add voluntary information in accordance with Art. 6 para. 1a GDPR. This does not apply to "non-registered users":

• Phone number
• Date of birth
• Address (street, zip code, town)
• IMSI (International Mobile Subscriber Identifier)
• Remote ID identifier
• Call Sign
• Details of the vehicle type

The data provided during registration may be pseudonyms and will not be verified. Therefore, no personal reference can be established. In the event of an objection and the deletion of the data, the functionalities of the application cannot be guaranteed and the service may be restricted.

Integration of OpenStreetmap maps and Mapbox

For display map functions we use the services of:

• OpenStreetMap
• Mapbox

These services enable the visual display of geographical information within our application.

When a function with map content is called up, data is automatically transmitted to the respective providers. This includes in particular

• the information that you use a corresponding function within our service,
• the IP address of your end device,
• technical access data (e.g. date, time, browser type),
• the coordinates of the current map section - and thus the approximate location of the user, if applicable.

This transmission is technically necessary in order to provide and correctly display the map.

Further information on data processing and your rights and settings options to protect your privacy can be found in the privacy policies of the services used:

• https://www.openstreetmap.de/impressum/datenschutz/
• https://www.mapbox.com/legal/privacy

Note on data transfer to third countries (USA):

Some of the map services we use (e.g. Mapbox) are based in the USA. When using these services, personal data (e.g. IP address, location data) may therefore be transferred to servers in the USA. The providers base these transfers on so-called EU standard contractual clauses in accordance with Art. 46 GDPR. We would like to point out that there is no level of protection equivalent to European data protection in the USA. In particular, there is a risk that US authorities may be able to access your data without you having any effective legal remedies against this.

Access to the data / recipient

Only Droniq GmbH and DFS Deutsche Flugsicherung GmbH have access to the data. The companies are contractually obliged to use the data exclusively in the context of fulfilling the contract with DFS. The data does not leave the European Economic Area (EEA). The use of the data is necessary for the provision of the services.

3.7 Use of the data for the Trackviewer

As part of the provision of our services, we use the services of DFS Deutsche Flugsicherung GmbH. As part of this service provision, we transmit the data required to perform the services to the service providers. In addition, the services of the map service of the Federal Agency for Cartography and Geodesy (BKG) are used for the presentation.

Purpose of data collection

The data is collected and processed for the following purposes:

• Promote safety and traffic management,
• Generating security awareness,
• Understanding traffic situations,
• Required for billing the service,
• Required for securing the Droniq GTCs
• Communication on important product information (e.g. maintenance, error messages, release changes, updates, versioning, changes to the terms of use, changes to the privacy policy)

The legal basis is Art. 6 para. 1b DSGVO.

Type of data that is collected

The creation of a personal account is required for the use of some functions. The following data is collected for the above-mentioned purposes:

• Name, first name, e-mail, company/club/affiliation, address, area of operation, HOD (Hook-on-Devices) IDs, HOD-IMSI and HOD version of the user,
• Log files of flight events with the drone (name of the drone, start location, start date, start time, duration), if flights are planned
• Information about the use of the website, including browser type and version, IP address and date/time of use.
• Use of geolocation: Based on your consent, the geolocation API of your internet browser/device is used. If you use a device with GPS support, the current location can be determined more precisely with the help of the GPS module. The collection and use of your location data by means of the geolocation API of your internet browser only takes place if you initiate a localization by clicking on it. This data is used to align the map display and mark your location on it. You can deactivate this functionality at any time on the end device or in the browser.

Integration of maps from the BKG

We optionally use the map function of the Federal Agency for Cartography and Geodesy (BKG) to display geo-based content. This integration enables the visual representation of geodata within our service.

When functions containing BKG cards are called up, certain technical information is automatically transmitted to the provider. This includes in particular

• the information that you have used a corresponding function within our service
• the IP address used
• technical access data (e.g. date and time, browser type)

This transmission is necessary to provide the technical function and display of the map.

Server log files

Every time you access our website, usage data is transmitted by your internet browser and stored in log data (server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the amount of data transferred and the requesting provider. This data is used to ensure the trouble-free operation of our service, to improve our offer and for billing and compliance with the terms and conditions. It is possible to assign this data to a specific person. They are not passed on to third parties and are stored anonymously after the end of the contractual relationship with Droniq GmbH.

Session cookies

These are cookies that are only stored on your computer for the duration of an Internet session. They are technically necessary.

Access to the data / recipient

Only Droniq GmbH and DFS Deutsche Flugsicherung GmbH have access to the data. The companies are contractually obliged to use the data exclusively in the context of fulfilling the contract with DFS. The data does not leave the European Economic Area (EEA). The use of the data is necessary for the provision of the service.

3.8 Use of data for Droniq Online Services, including Droniq TraX

As part of the provision of our services for tracking, remote ID identification and warnings, we also use the services of DFS Deutsche Flugsicherung GmbH. As part of this service provision, we transmit the data required to perform the services to the service providers. We also use the map services of OpenStreetMap Deutschland (https://openstreetmap.de/), OpenTopoMap (https://opentopomap.org/about) and Carto (https://carto.com/about-us).

Purpose of data collection

The data is collected and processed for the following purposes:

• Promoting safety and traffic management
• Creating safety awareness
• Understanding traffic situations
• Required for billing the service
• Required for securing the Droniq GTCs
• Communication on important product information (e.g. maintenance, error messages, release changes, updates, versioning, changes to the terms of use, changes to the privacy policy)

The legal basis is Art. 6 para. 1b DSGVO.

Type of data that is collected

The creation of a personal account is required for the use of some functions, see section 3.4. In addition, further necessary data is collected in the individual applications for the above-mentioned purposes:

• Area of operation, HOD (Hook-on-Devices) IDs, HOD-IMSI and HOD version of the user
• Parameters of the drone (manufacturer, name, type), if these were specified
• Settings as part of the service provision for the respective applications (language setting in German or English, geo-coordinates for the provision of warning services, voice output for warnings)
• Use of geolocation: Based on your consent, the geolocation API of your internet browser/device is used. If you use a device with GPS support, the current location can be determined more precisely with the help of the GPS module. The collection and use of your location data by means of the geolocation API of your internet browser only takes place if you initiate a localization by clicking on it. This data is used to align the map display and mark your location on it. You can deactivate this functionality at any time on the end device or in the browser

Integration of OpenStreetmap maps, Opentopomap and CARTO

We optionally use the services of the following external providers to display geo-based information:

• OpenStreetMap
• OpenTopoMap
• Carto
• Mapbox,

These services enable the interactive display of map content within our application, e.g. for the visualization of locations, airspaces or geographical information.

When calling up map functions, technical information is automatically transmitted to the respective providers. This includes in particular

• the information that you are using a page or function with an integrated map service
• Your IP address
• technical access data such as date, time and browser information
• the coordinates of the currently displayed map section - and thus the approximate location of the user, if applicable

The data transfer is technically necessary in order to provide the map display correctly.

Note on data transfer to third countries (USA):

Some of the map services we use (e.g. Mapbox or Carto) are based in the USA. When using these services, personal data (e.g. IP address, location data) may therefore be transferred to servers in the USA. For these transfers, the providers rely on so-called EU standard contractual clauses in accordance with Art. 46 GDPR. We would like to point out that there is no level of protection equivalent to European data protection in the USA. In particular, there is a risk that US authorities may be able to access your data without you having effective legal remedies against this.

• https://www.openstreetmap.de/impressum/datenschutz/
• https://opentopomap.org/about
• https://carto.com/privacy
• https://www.mapbox.com/legal/privacy

Server log files

Every time you access our website, usage data is transmitted by your internet browser and stored in log data (server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the amount of data transferred and the requesting provider. This data is used to ensure the trouble-free operation of our service, to improve our offer, for billing purposes and to comply with the terms and conditions. It is possible to assign this data to a specific person. They are not passed on to third parties and are stored anonymously after the end of the contractual relationship with Droniq.

Session cookies

These are cookies that are only stored on your computer for the duration of an Internet session. They are technically necessary.

Access to the data / recipient

Only Droniq GmbH has access to the data. The data does not leave the European Economic Area (EEA). The use of the data is necessary for the provision of the services.

3.9 Use of data for the Droniq Academy

In providing our Academy services, we utilize the services of Chemmedia GmbH (https://www.chemmedia.de/) and Aviationexam sro (https://www.aviationexam.com). As part of this service provision, we transmit the data necessary to perform the services to the service providers, or the data is collected by the user on our service providers' web services. In addition, the data required for examinations is collected and made available to the Federal Aviation Office in accordance with the documentation for remote pilot testing centers specified by the Federal Aviation Office.

Purpose of data collection

The data is collected and processed for the following purposes:

• Use of the Learning Management Tool
• Registration and conduct of examinations
• Use of an online examination supervisor
• Registration of the remote pilot certificate with the Federal Aviation Office
• Identity verification of the participant during exams
• Required for billing the service
• Required for securing the Droniq GTCs
• Communication on important product information (e.g. maintenance, error messages, release changes, updates, versioning, changes to the terms of use, changes to the privacy policy)

The legal basis is Art. 6 (1b) GDPR and Art. 6 (1c) GDPR in conjunction with NfL 2021-2-630 of July 29, 2021, Section 4 (new NfL 2023-2-733 of April 21, 2023 available, the PstF certification is based on NfL 2021-2-630 of July 29, 2021).

Type of data that is collected

The creation of a personal account is required for the use of some functions. The following data is collected for the above-mentioned purposes:

• Name, first name, street, house number, postal code, city, country, e-mail address
• Date of birth
• Reporting test center for remote pilots (PStF) and its registration number
• ID number EU certificate of competence A1A3
• Theory exam date
• Audit result in %
• Period of validity of identity card or passport
• Upload copy (photo file) identity card or passport (blackened - only the identity features (name, address, photo).
• For minors: Details of the legal representatives (surname, first name, date of birth) and the consent given by the legal representatives.
• Information about the use of the website, including browser type and version, IP address and date/time of login

The following data will be collected and processed throughout the entire remote examination:

• Purpose: Transmission and processing of the examination task/transmission of the examination performance
• Categories of personal data: Objective examination information and individual (partial) examination performances / individual examination performance (solution)
• Applications/Product: Aviationexam examination system
• Storage period: The storage period depends on the necessity of data retention/storage, unless there are overriding interests, and is generally five years. This data will be further processed beyond the periods described above if statutory retention periods apply or the data is required as evidence.

Access to the data / recipient

Droniq GmbH, aviationexam s.r.o, Chemmedia GmbH and the Luftfahrt-Bundesamt have access to the data. Droniq, aviationexam s.r.o, Chemmedia GmbH and the Luftfahrt-Bundesamt are obliged to use the data exclusively within the scope of the fulfillment of the contract. The data will not leave the European Economic Area (EEA). The use of the data is necessary for the provision of the services.

In addition, there is an order processing agreement (AVV) between Droniq and Chemmedia AG in accordance with Art. 28 GDPR. This regulates the processing of personal data in the context of the training and ensures that Chemmedia AG processes the data exclusively in accordance with the instructions of the organizer.

The AVV includes, among other things:

• Purpose and scope of data processing
• Data protection and security measures
• Regulations on data deletion and storage
• Rights and obligations of the parties

This contract ensures that all data protection regulations are complied with and that participants’ data is protected as best as possible.

The respective privacy policies and contact options of the service providers can be found in the following list:

Chemmedia AG
Parkstraße 35
09120 Chemnitz
E-mail: info@chemmedia.de

Aviationsexam s.r.o.
Kovarova 39/23
155 00 Praha 5
Czech Republic
E-mail: support@aviationexam.com

3.10 Use of data for Droniq Academy – Online Exams

As part of the provision of online examination services, we use the services of Proctorio GmbH (https://proctorio.com/de-de) in addition to the examination systems. The necessary data for the use of Proctorio in the context of online examinations are stored by the LBA in the Droniq examination manual and can be viewed there by the examinee if required.

Participants who do not wish to have their personal data processed by Proctorio or who do not have the technical means to use the software can book an alternative form of examination on the Droniq website.

Purpose of data collection

The data is collected and processed for the following purposes:

• Ensuring exam integrity: preventing cheating and unauthorized aids.
• Identity verification: Ensuring that the exam is taken by the authorized person.
• Documentation and traceability: Storage of audit records to clarify irregularities.
• Compliance with legal and contractual requirements: Ensuring the proper conduct and assessment of audits in accordance with applicable regulations.

GDPR in conjunction with. NfL 2021-2-630 dated 29.07.2021, point 4 (New NfL 2023-2-733 dated 21.04.2023 available, the PstF certification is based on NfL 2021-2-630 dated 29.07.2021).

Type of data that is collected

The creation of a personal account is required for the use of some functions. The following data is collected for the above-mentioned purposes:

• One-time recording of the examination room by the user via room scan via webcam
• Capturing and recording the upper body including the face via camera/webcam (video)
• Capturing and recording sound signals using a microphone (audio)
• Consistent FullScreen mode including hiding of controls
• Screen capture and recording
• Recording and recording of local location
• Recording and recording of internet usage
• Collecting and recording indications of potential hardware problems, operating system problems, or internet connection issues
• Capture and recording of the valid identity card

The following data will be collected and processed throughout the entire remote examination:

Access to the data/recipients

With regard to participants, Proctorio pseudonymizes the personal data after receipt using a user identification number from the examination system. This ID is accessible neither to the participants nor to Droniq. All subsequent data processing at Proctorio exclusively involves this user ID and is therefore not assignable by Proctorio. Furthermore, the collected data is encrypted. When the Proctorio recordings are retrieved in the LMS exam room, the IDs used by Proctorio are linked to the participant identities. This means that authorized Droniq employees can view the Proctorio recordings for specific exams. Proctorio is prohibited from decrypting and viewing the encrypted data. The data processed directly by Proctorio is stored on cloud servers in Germany. The data passed on by Proctorio to Droniq is stored by Droniq in a data center with servers in Germany.
However, in individual cases, for example for system updates or support requests, data processing by companies outside the EU may be necessary.

Affected recipients may be:

• PROCTOR.IO INC. (USA)
• PROCTORIO DOO (Serbia)
• Proctorio's subprocessors in third countries

The following security measures have been taken to protect your data:

• Conclusion of EU standard contractual clauses (SCCs) with Proctorio® and the subcontractors
• End-to-end encryption of stored data
• Access restrictions so that no unauthorized third parties can view the data

In addition, there is an order processing agreement (AVV) between Droniq and Proctorio GmbH in accordance with Art. 28 GDPR. This regulates the processing of personal data in the context of examination monitoring and ensures that Proctorio processes the data exclusively in accordance with the instructions of the organizer.

The AVV includes, among other things:

• Purpose and scope of data processing
• Data protection and security measures
• Regulations on data deletion and storage
• Rights and obligations of the parties

This contract ensures that all data protection regulations are complied with and that participants’ data is protected as best as possible.

Storage period / data deletion

In accordance with the principle of data minimization, personal data processed in remote examinations may not be stored for longer than is absolutely necessary for the proper conduct of the remote examination, including assessment. The Proctorio recordings are therefore deleted immediately after completion of the assessment by Droniq. If the data is not deleted manually after the exam, Proctorio automatically deletes the exam recording after 30 days.

The examination protocol generated in pdf format, in which the respective examination with the examination abnormalities are documented, is stored by the organizer in a computer center with servers in Germany. This personal data is generally deleted when there is no need for further storage. A requirement may exist in particular if the data is still needed to fulfill contractual services, to check and grant or defend against warranty and guarantee claims. In the case of statutory retention obligations, deletion will only be considered after the respective retention obligation has expired.

The respective privacy policies and contact options of the service providers can be found in the following list:

Proctorio GmbH
Lindleystraße 8a
60314 Frankfurt am Main
Germany

3.11 Use of data for Droniq Maps

As part of the provision of our UTM services as an essential component of the app, we use the services of DFS. As part of this service provision, we transmit the data required to perform the services to the service providers. We also use the map services of BKG, Basemap and Here Maps.

Purpose of data collection

The data is collected and processed for the following purposes:

• Promoting safety and traffic management
• Creating safety awareness
• Understanding traffic situations
• Support for safe drone flight through validation support for drone ascents
• Required for billing the service
• Required for securing the Droniq GTCs
• Communication on important product information (e.g. maintenance, error messages, release changes, updates, versioning, changes to the terms of use, changes to the privacy policy)

The legal basis is Art. 6 para. 1b DSGVO.

In addition, registered users can provide voluntary data on the legal basis of Art. 6 para. 1a GDPR.

Type of data that is collected

The creation of a personal account is required for the use of some functions. The following data is collected for the above-mentioned purposes:

• Surname, first name and e-mail address of the user (pseudonym possible) and operator ID
• Parameters of the drone (manufacturer, name, type), if these were specified
• Settings as part of the service provision (language setting in German or English, geo-coordinates for the provision of warning services, voice output for warnings)
• Log files of flight events with the drone (name of the drone, start location, start date, start time, duration), if flights are planned
• Information about the use of the app, including device type and version, IP address and date/time of login
• Use of geolocation: Based on your consent, the geolocation API of your internet browser/device is used. If you use a device with GPS support, the current location can be determined more precisely with the help of the GPS module. The collection and use of your location data by means of the geolocation API of your internet browser only takes place if you initiate a localization by clicking on it. This data is used to align the map display and mark your location on it. You can deactivate this functionality at any time on the end device or in the browser.

For the use of some functionalities, the user can add voluntary information in accordance with Art. 6 para. 1a GDPR. This does not apply to "non-registered users":

• Phone number
• Date of birth
• Address (street, zip code, town)
• Remote Pilot ID
• Call Sign
• Details of the vehicle type

The data provided during registration may be pseudonyms and will not be verified. Therefore, no personal reference can be established. In the event of an objection and the deletion of the data, the functionalities of the application cannot be guaranteed and the service may be restricted.

Integration of BKG, Basemap and Here Maps

We use the services of the following providers in our service to display interactive map content and to use geo search functions:

• Federal Agency for Cartography and Geodesy (BKG)
• Basemap.com
• HERE Maps

These services enable the visualization of geo-based content (BKG, Basemap) and the execution of location-based search queries (HERE Maps).

When calling up functions with integrated map or search services, certain information is automatically transmitted to the respective providers. This includes in particular

• the information that you have used a corresponding function within our offer
• Your IP address
• technical access data such as date and time, browser type/version, operating system
• the coordinates of the displayed map section (location data if applicable)
• when using the HERE Maps search function: the input data from the search field

The location data (map section) is transmitted anonymously. When using the HERE search function, the data entered is transmitted directly to HERE. This transmission takes place regardless of whether you have a user account with one of the providers or are logged in there. If you are logged in with one of these providers while using the map function, it is possible that the data may be associated with your user account. To avoid this, we recommend that you actively log out of the respective providers before using the map functions.

The providers may use the transmitted data - even from users who are not logged in - for their own purposes such as advertising, market research or the needs-based design of their services. This may include, in particular, the creation of pseudonymous user profiles. You have the right to object to the creation of user profiles by the respective providers. To do so, please contact the respective service provider directly.

Further information on data processing and your rights and settings options to protect your privacy can be found in the privacy policies of the services used:

• https://www.bkg.bund.de/DE/Service/Datenschutz/datenschutz.html
• https://legal.here.com/de-de/privacy
• https://basemap.de/datenschutz_impressum/

Access to the data/recipients

Only Droniq GmbH and DFS Deutsche Flugsicherung GmbH have access to the data. The companies are contractually obliged to use the data exclusively in the context of fulfilling the contract with DFS. The data does not leave the European Economic Area (EEA). The use of the data is necessary for the provision of the services.

4. how long will my data be stored?

We process and store your personal data as long as this is necessary for the fulfillment of our contractual and legal obligations and the purpose of the processing exists. If the data is no longer required for the fulfillment of contractual or legal obligations or if the purpose of data storage no longer applies, it will be deleted in accordance with regulatory requirements, unless its - temporary - further processing is necessary for the following purposes:

• All personal data stored as part of Academy services is stored for 5 years. This corresponds to the validity of the remote pilot certificate.
• Preservation of evidence within the framework of the statutory limitation periods. According to §§ 195 ff. of the German Civil Code, these limitation periods can be up to 30 years, whereby the regular limitation period is 3 years.

5. where will my data be processed?

The actual data processing, unless a specific regulation is listed in this privacy policy, takes place within the EU. The websites are operated by Mittwald CM Service GmbH & Co. KG in Germany. The webshop is hosted by Shopify International Limited on servers outside the EU, in Canada. The provider is subject to the Canadian Data Protection Act (PIPEDA) which has been declared adequate by the European Commission.

In certain cases, we are legally obliged to transmit data to a requesting government agency.

6. how secure is my data?

Droniq GmbH uses technical and organizational means to protect your personal data from access and misuse. We keep these security precautions up to date in line with technological developments and in accordance with the relevant legal provisions.

7. technical and organizational measures for the protection of personal data (TOMS)

We secure your data using state-of-the-art technology. For example, we use the following security measures to protect your personal data against misuse or any other form of unauthorized processing:

• access to personal data is restricted to a limited number of authorized persons and to specific purposes
• the data is only transmitted in encrypted form, e.g. "https:..."
• the IT systems used for data processing are technically separated from the other systems in order to prevent unauthorized access, for example through hacking
• Access to the systems is continuously monitored so that any misuse can be detected and reported at an early stage

The legal basis is Articles 25 and 32 of the GDPR.

8. when do I have to consent to the privacy policy?

For certain functionalities within the "UTM" and "Droniq App" services, you can voluntarily provide personal data. This processing is carried out in accordance with Art. 6 para. 1 lit. a GDPR on the basis of your voluntary decision.

The corresponding input fields are only available to registered users.

By clicking on "I have read the privacy policy", you confirm that you have been informed about the type, scope and purpose of data processing. Active consent is not required. However, the use of voluntary functions requires that you have taken note of the privacy policy.

You can object to the processing of your data at any time with effect for the future. In this case, only the basic functionalities of the services may be available to you. In individual cases, this may mean that certain services - especially those subject to a charge - cannot be used.

9. is my usage behavior evaluated?

Within the framework of legal regulations, we, or companies commissioned by us, create user profiles under a pseudonym in order to analyze and regularly improve the use of our website.

This constitutes a legitimate interest within the meaning of Art. 6 (1f) GDPR. If other legal bases are applied or the aforementioned legal basis (Art. 6 (1f) GDPR) applies, this is noted at the appropriate point. It is not possible to draw any direct conclusions about you. The profile data is not linked to any other information about you personally. Below we inform you about the procedures used on our websites and how you can object at any time.

9.1 Cookies

Our website uses cookies. Cookies are short pieces of text information that are stored in the Internet browser or by the Internet browser on the user's end device. When our website is accessed, a cookie may be stored on the operating system. This contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.

Technically necessary cookies (session cookies)

These cookies are required for the basic functions of our website and are only stored for the duration of a session. Without them, central functions - such as navigation or the use of forms - cannot be provided.

Legal basis: The storage takes place in accordance with § 25 para. 2 sentence 2 TDDDG and Art. 6 para. 1 lit. f GDPR from our legitimate interest in a functional and secure website.

Optional cookies (persistent cookies)

We also use cookies to make our website more user-friendly, to analyze usage and to optimize our services. These cookies remain stored on your end device beyond the session. The storage period for optional cookies varies depending on the function, but is generally between 30 days and a maximum of 12 months. After these periods have expired, the cookies are automatically deleted unless you remove them yourself beforehand via your browser settings.

Legal basis: The use only takes place with your express consent in accordance with § 25 para. 1 TDDDG i.V.m. Art. 6 para. 1 lit. a GDPR.

You can revoke or adjust your consent at any time via the cookie settings in your browser. Please note that if you reject optional cookies, not all functions of our website may be available.

You have full control over the use of cookies. Via your browser settings you can:

• Block cookies completely or partially,
• be notified before cookies are set,
• Delete stored cookies.

Information on managing cookies can be found in the browser you are using.

Use of the Google Tag Manager

On our website, we use the Google Tag Manager of Google LLC. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google") on our website. If you have your habitual residence in the European Economic Area or Switzerland, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the controller responsible for your data. Google Ireland Limited is therefore the company affiliated with Google that is responsible for processing your data and complying with the applicable data protection laws. This application is used to manage JavaScript tags and HTML tags that are used to implement tracking and analysis tools in particular. The data processing serves the purpose of designing and optimizing our website in line with requirements. The Google Tag Manager itself neither stores cookies nor does it process personal data. However, it enables the triggering of other tags that can collect and process personal data. You can find more information on terms of use and data protection at https://www.google.com/intl/de/tagmanager/use-policy.html.

The legal basis is Art. 6 para. 1 lit. a GDPR.

Use of Google Analytics

On our website we use the web analysis service Google Analytics from Google LLC. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). If you have your habitual residence in the European Economic Area or Switzerland, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the controller responsible for your data. Google Ireland Limited is therefore the company affiliated with Google that is responsible for processing your data and complying with the applicable data protection laws. The data processing serves the purpose of analyzing this website and its visitors as well as for marketing and advertising purposes. For this purpose, Google will use the information obtained on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. The following information may be collected: IP address, date and time of the page view, click path, information about the browser you are using and the device you are using, pages visited, referrer URL (website from which you accessed our website), location data, purchase activities. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. Google Analytics uses technologies such as cookies, web storage in the browser and tracking pixels that enable your use of the website to be analyzed. The information generated about your use of this website is usually transmitted to a Google server in the USA and stored there. IP anonymization is activated on this website. As a result, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. Google has certified itself in accordance with the US-EU data protection agreement "TADPF" (dataprivacyframework.gov) and is therefore obliged to comply with European data protection guidelines. Data processing, in particular the setting of cookies, is carried out with your consent on the basis of Art. 6 para. 1a GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You can find more information on terms of use and data protection at https://marketingplatform.google.com/about/analytics/terms/de/ or at https://www.google.de/intl/de/policies/ and at https://policies.google.com/technologies/cookies?hl=de.

Use of Google Web Fonts

We use so-called web fonts on our website, which were originally provided by Google, for the uniform and appealing display of fonts. In contrast to use via the Google Fonts API, however, these fonts are hosted locally on our server.

When a page is called up, the required fonts are loaded directly from the server of our website into the browser cache. There is no connection to Google servers. This means that no data, in particular no IP address, is transmitted to Google.

The local integration of the fonts ensures that no personal data is passed on to third parties. This increases data protection and avoids data being transferred to third countries such as the USA.

The processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR, as there is a legitimate interest in a technically secure, visually consistent and user-friendly presentation of our online offer - while at the same time complying with data protection requirements.

If your browser does not support the embedded fonts, a standard font of your end device will be used automatically.

9.2 Plug-ins and integration of external services

Use of Google invisible reCAPTCHA

We use the invisible reCAPTCHA service of Google Inc (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google") on our website. This serves the purpose of distinguishing the input by a human or by automated, machine processing. In the background, Google collects and analyzes usage data that is used by Invisible reCAPTCHA to distinguish regular users from bots. For this purpose, your input is transmitted to Google and used there. In addition, the IP address and any other data required by Google for the Invisible reCAPTCHA service will be transmitted to Google. This data is processed by Google within the European Union and possibly also in the USA. For data processing in the USA, Google has certified itself in accordance with the US-EU data protection agreement "TADPF" (dataprivacyframework.gov) and is therefore obliged to comply with European data protection regulations.

The processing is carried out on the basis of Art. 6 para. 1f GDPR out of the legitimate interest to protect our website from automated spying, misuse and SPAM. You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1f) GDPR. You can find more information about Google reCAPTCHA and the associated privacy policy at

• https://www.google.com/recaptcha/intro/android.html sowie
• https://www.google.com/privacy.

Use of social plug-ins

Our pages on Facebook, Linkedin, Twitter, Instagram, Xing and YouTube are used for active communication with our customers and interested parties. We provide information there about our products and services as well as special promotions and events.
We use social network plug-ins on our website. The integration of social plug-ins and the data processing that takes place serves the purpose of optimizing the advertising of our products. When social plug-ins are integrated, a link is established between your computer and the servers of the social network provider and the plug-in is displayed on the page by notifying your browser, provided you have expressly consented to this. Both your IP address and the information about which of our pages you have visited are transmitted to the provider servers. This applies regardless of whether you are registered or logged in to the social network. Transmission also takes place for users who are not registered or not logged in. If you are connected to one or more of your social network accounts at the same time, the information collected can also be assigned to your corresponding profiles. When you use the plug-in functions (e.g. by clicking the button), this information is also assigned to your user account. You can prevent this assignment by logging out of your social media accounts before visiting our website and before activating the buttons.

The processing is based on Art. 6 (1a) DSGVO with your consent. You can revoke your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until the revocation.

The social networks named below are integrated into our website by means of social plug-ins. For more information on the scope and purpose of the collection and use of the data, as well as your rights in this regard and options for protecting your privacy, please refer to the linked data protection notices of the providers.

• Facebook: https://www.facebook.com/about/privacy/
• YouTube (Google): https://policies.google.com/privacy
• Instagram: https://help.instagram.com/519522125107875
• Twitter: https://twitter.com/de/privacy
• Linkedin: https://www.linkedin.com/legal/privacy-policy?_l=de_DE
• Xing: https://privacy.xing.com/de/datenschutzerklaerung

If you need help, e.g. with requests for information, you are welcome to contact us. However, we would like to point out that inquiries regarding the processing of data or the assertion of user rights are best addressed directly to the provider of the respective platforms, as only they have access to the data.

Integration of YouTube videos

We have integrated YouTube videos into our online offering, which are stored on www.YouTube.com and can be played directly from our website. These are all integrated in "extended data protection mode", i.e. no data about you as a user is transferred to YouTube if you do not play the videos. Only when you play the videos will the data mentioned in paragraph 2 be transmitted. We have no influence on this data transfer.

When you visit the website, YouTube receives the information that you have accessed the corresponding subpage of our website. In addition, the data mentioned in the next paragraph "Further information" of this statement will be transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your YouTube profile, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right.

Further information on the purpose and scope of data collection and its processing by YouTube can be found in the privacy policy. There you will also find further information about your rights and settings options to protect your privacy: https://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

Integration of Google Maps

We use the Google Maps service on this website. This allows us to show you interactive maps directly on the website and enables you to use the map function conveniently.

By visiting the website, Google receives the information that you have called up the corresponding sub-page of our website. In addition, the data mentioned in the next paragraph under "Further information" of this statement are transmitted. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be directly assigned to your account. If you do not want the assignment with your profile at Google, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.

Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the provider's privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy: http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has submitted to the EU-US TADPF (dataprivacyframework.gov).

Use of Google Ads conversion tracking

We use Google Ads conversion tracking on our website, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The aim is to measure the effectiveness of our advertising measures on external websites and to optimize our online offering.

If you access our website via a Google ad, Google will store a so-called "conversion cookie" on your device. This cookie is usually valid for 30 days and is not used for personal identification. The cookie enables Google and us to recognize that a user has clicked on an ad and has been redirected to a specific target page (so-called conversion page). The following information may be collected and processed by Google:

• IP address of the user (shortened if necessary)
• Time of the page view
• Information on the device and browser used
• Ads clicked on and their positioning (ad impressions, frequency)
• Opt-out information (marking that no tracking is desired).

A separate cookie is assigned to each Google Ads customer. Cookies can therefore not be tracked across the websites of multiple Ads customers.

We ourselves only receive aggregated statistical evaluations from Google, which we can use to evaluate the effectiveness of our advertising campaigns. It is not possible for us to personally identify users.

By integrating Google Ads, your browser automatically establishes a connection to Google servers. This may also result in the transfer of personal data (in particular your IP address) to the USA. Google uses standard contractual clauses in accordance with Art. 46 GDPR and is also certified under the EU-U.S. Data Privacy Framework (see https://www.dataprivacyframework.gov).

If you are logged in to Google, your data may be linked to your Google account. Even users who are not logged in can be pseudonymized by Google.

The use of Google Ads Conversion Tracking is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the statistical analysis and optimization of our advertising measures and the economically fair billing of advertising services.

If you have given your consent in the context of our cookie banner, the processing is also carried out on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG.

You can deactivate Google's conversion tracking in various ways:

• by setting your browser accordingly to suppress third-party cookies
• by deactivating cookies for conversion tracking via the domain https://www.google.de/settings/ads
• via the platform of the "Digital Advertising Alliance ": http://www.aboutads.info/choices
• through the browser plugin for deactivating interest-based advertising (for Chrome, Firefox, Internet Explorer): http://www.google.com/settings/ads/plugin

Please note that if you deactivate it, you may not be able to use all the functions of our website to their full extent. Further information on data protection at Google can be found at:

• https://policies.google.com/privacy
• https://services.google.com/sitestats/de.html
• https://www.networkadvertising.org

Use of the Google Search Console

For the technical monitoring and optimization of our website, we use the Google Search Console service, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The Google Search Console enables us to carry out statistical evaluations of the search behavior of visitors to our website and their visibility in Google searches. In particular, we receive information about which search terms are used to find our pages, which pages were accessed how often and whether there are technical errors (e.g. crawling or indexing problems).

When using the Google Search Console, no personal data of website visitors is processed or stored. The data is provided by Google exclusively in aggregated and anonymized form. It is not possible to identify individual users.

The Google Search Console is used on the basis of Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the analysis of website performance, error detection and the optimization of our content for search engines.

It cannot be ruled out that data will be processed on Google LLC servers in the USA in the course of use. Google is certified under the EU-U.S. Data Privacy Framework (see: https://www.dataprivacyframework.gov). In addition, standard contractual clauses of the EU Commission exist to safeguard data transmission. Further information on data processing by Google can be found at

• https://policies.google.com/privacy

Integration of Google Looker Studio

We use Google Looker Studio, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to visualize and analyse data. Looker Studio enables us to create interactive dashboards and reports that are fed from various data sources.

This may involve the processing of personal data, especially if the underlying data sources contain information such as:

• IP addresses
• Usage data
• E-mail addresses or
• other directly or indirectly personal characteristics are included

Processing takes place exclusively for analysis, planning or internal control purposes. Personal evaluations are not published.

Data processing is based on Art. 6 para. 1 lit. f GDPR, as there is a legitimate interest in the evaluation and processing of company data. Insofar as data is transferred on the basis of your consent, Art. 6 para. 1 lit. a GDPR is the legal basis.

Google processes personal data as part of order processing in accordance with Art. 28 GDPR. The data is generally stored on servers within the EU. However, in certain cases, data may be transferred to third countries, in particular to the USA. Google is certified in accordance with the EU-U.S. Data Privacy Framework (see: https://www.dataprivacyframework.gov) and also offers suitable guarantees via standard contractual clauses in accordance with Art. 46 GDPR.

Further information on data processing by Google can be found at:
https://policies.google.com/privacy?hl=de

The use of Google Looker Studio is optional and limited to internal purposes. No interactive reports containing personal data are made publicly accessible.

Integration of Microsoft Bookings

For booking appointments, we offer an online service via Microsoft Bookings, a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.

The use of Microsoft Bookings enables you to make an appointment with us online. The following personal data is generally processed during the booking process:

• Name
• E-mail address
• Phone number
• selected date
• Optional information (e.g. concerns or comments in the free text field)

This data is processed exclusively for the purpose of planning, carrying out and confirming your appointment.

Your data is processed on the basis of Art. 6 para. 1 lit. b GDPR, insofar as the appointment booking is necessary for the implementation of (pre-)contractual measures, and on the basis of Art. 6 para. 1 lit. f GDPR, as we have a legitimate interest in the efficient processing of appointments. If you voluntarily provide additional information, this is done on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR.

Data processing is carried out by Microsoft as part of order processing in accordance with Art. 28 GDPR. Microsoft generally processes the data on servers within the EU. In individual cases, however, data may be transferred to third countries (in particular the USA). Microsoft has submitted to the EU-U.S. Data Privacy Framework (see: https://www.dataprivacyframework.gov) and offers standard contractual clauses to safeguard these transfers. Further information on data processing by Microsoft can be found at

• https://privacy.microsoft.com/de-de/privacystatement

The use of Microsoft Bookings is voluntary. Alternatively, you can also make appointments with us by telephone or e-mail without using the service.

Use of Zoom

We use the Zoom video conferencing service, provided by Zoom Video Communications, Inc, 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA, to conduct webinars.

Participation in a webinar requires prior registration. Registration establishes a contractual relationship for the provision of and participation in the online event.

The aim is to hold digital information events and webinars. The following personal data is processed during use - depending on participation behavior:

• Registration data (name, e-mail address),
• technical access data (e.g. IP address, browser type, client version),
• with active use: audio, video and chat data (voluntarily released by the user).

By default, the webinar is configured so that participants are not recorded with sound, images or names. Active participation via microphone or camera is voluntary and within the user's sphere of influence.

The webinars are recorded and published afterwards, e.g. on our YouTube channel. We will clearly inform all participants before the start of the recording so that you can decide for yourself whether you wish to continue attending or leave the event.

Art. 6 para. 1 lit. b GDPR - to conduct the webinar as part of the contractual relationship (after registration),

Zoom generally processes data on servers within the European Union. A transfer of personal data to the USA cannot be ruled out in individual cases. Zoom is certified under the EU-U.S. Data Privacy Framework and also offers EU standard contractual clauses in accordance with Art. 46 GDPR to secure international data transfers.

Further information:

• https://www.zoom.com/de/trust/privacy/privacy-statement/
• https://www.youtube.com/intl/ALL_de/howyoutubeworks/user-settings/privacy/

10 Who should I contact if I have questions about data protection at Droniq?

The responsible person within the meaning of the General Data Protection Regulation and the Federal Data Protection Act is the:

Droniq GmbH
Managing Directors: Jan-Eric Putze, Ralph Schepp
Ginnheimer Stadtweg 88
60431 Frankfurt
Phone: +49 (0)69 / 509547 400
E-mail: info@droniq.de

The contact details of our data protection officer are:

DFS German Air Navigation Services GmbH

• Dr. Frank Schury - Group Data Protection Officer
• Riko Pieper - Deputy Group Data Protection Officer
• Heike Mosmann - Deputy Data Protection Officer of Droniq GmbH
• Markus Bruns - Deputy Data Protection Officer of Droniq GmbH
• VD Division - Group Data Protection and Quality Management

E-mail: datenschutzbeauftragter@dfs.de

11. your rights as a data subject

As a data subject, you have the following rights:

• in accordance with Art. 15 DSGVO the right to request information about your personal data processed by us to the extent specified therein;
• in accordance with Art. 16 DSGVO the right to demand the correction of incorrect or completion of your personal data stored by us without delay;
• in accordance with Art. 17 GDPR, the right to demand the deletion of your personal data stored by us, unless further processing is necessary.
  • to exercise the right to freedom of expression and information;
  • to fulfill a legal obligation;
  • for reasons of public interest or
  • is necessary for the establishment, exercise or defense of legal claims;
• in accordance with Art. 18 GDPR, the right to demand the restriction of the processing of your personal data, insofar as
  • the accuracy of the data is disputed by you;
  • the processing is unlawful, but you object to its erasure;
  • we no longer need the data, but you need it to assert, exercise or defend legal claims, or
  • you have objected to the processing pursuant to Art. 21 GDPR;
• in accordance with Art. 20 DSGVO, the right to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request the transfer to another controller;
• the right to complain to a supervisory authority pursuant to Art. 77 DSGVO. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters for this purpose.

Please contact us directly by post or e-mail if you have any questions about the collection, processing or use of your personal data, or if you wish to request information, correct, block or delete data, revoke your consent or object to a specific use of data:

Droniq GmbH
Ginnheimer Stadtweg 88
60431 Frankfurt
Tel.: 069-509547-400
E-mail: info@droniq.de

In addition, according to Art. 21 (1) DSGVO, you have the right to object to processing based on Art. 6 (1) f DSGVO and to processing for the purpose of direct marketing.

The collection of data for the provision of the websites and storage of the data in log files is mandatory for the operation of the website. Consequently, there is no possibility for the user to object.

12. changes to the privacy policy

We reserve the right to continuously update this and the specific privacy statements to incorporate changing legislation or case law. We therefore recommend that you visit the respective websites regularly so that you are informed about the protection and processing of your data.

13. links to other websites

The internet presence of Droniq GmbH contains links to other websites for which Droniq neither operates nor is responsible. Droniq is not responsible for the content and compliance with data protection regulations on these other websites.

Status: July 2025