Data Processing Addendum

Last updated October 9, 2026

This Data Processing Addendum ("DPA") is part of the Terms of Service between [LEGAL ENTITY NAME] ("Dronrly") and the business that uses Dronrly ("Business"). It applies automatically when the Business accepts the Terms, and covers personal data that Dronrly processes on the Business's behalf. If this DPA conflicts with the Terms, this DPA wins for that data.

1. Definitions

"Customer Personal Data" means personal data about the Business's customers, their contacts and people captured in its files, that the Business or its customers put into the Service, and personal data Dronrly reads from the Business's connected Stripe account under section 3. "Data Protection Laws" means all laws that apply to that data, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the California Consumer Privacy Act as amended by the CPRA ("CCPA") and other US state privacy laws. Terms like "controller", "processor", "personal data breach", "service provider", "sell" and "share" have the meanings given in those laws.

2. Roles

The Business is the controller (or "business" under the CCPA) of Customer Personal Data. Dronrly is its processor (or "service provider"). Dronrly is a separate controller for account data about the Business's own staff, and for billing, as described in the Privacy Policy.

The Business is responsible for having a lawful basis for its processing, giving its customers any required notices, and complying with the law when capturing drone imagery.

3. Details of processing

• Subject matter and purpose: providing the Service: managing customers, job requests, scheduling, messages, deliverable files, quotes, invoices and payments, and the customer portal.
• Duration: the term of the Business's account, plus the deletion periods in section 10.
• Data subjects: the Business's customers and their contacts; people, vehicles and property that appear in drone imagery; the Business's staff as users of the Service.
• Categories of data: names, company, email, phone, postal and job-site addresses, optional GPS coordinates of job sites, job descriptions, messages, internal notes, photos, video and other files, quotes, invoices and payment records (amounts, method, Stripe IDs; no card data), portal login details, and IP address and user agent in sessions and audit logs.
• Special categories: none are intended. The Business will not upload special-category data, government ID numbers or financial account numbers unless strictly necessary.
• Nature of processing: storage, retrieval, display to authorized users, transmission by email, export, and deletion.
• Connected Stripe account: if the Business connects its Stripe account through Stripe Connect, the Business authorizes Dronrly to access that account with the "read_write" scope Stripe grants. Stripe never gives Dronrly full card numbers, but this access is broad: it technically covers most data in the account and lets Dronrly act on the account. The Business instructs Dronrly to use it only to (a) create and expire Checkout sessions for its invoices and confirm payments, including through Stripe's Connect webhook, and (b) read the account's balance, balance transactions, charges (with the payer's name or email as held in Stripe), refunds and payouts for the in-app payments dashboard. Item (b) covers all payments on the account, including payments not made through Dronrly. That data is shown to owners and managers, kept in server memory for up to 5 minutes, and not stored in Dronrly's database. Dronrly stores only the connected account's ID and when it was connected. A Business that set up payments before Stripe Connect may instead have its own Stripe API keys stored, encrypted. Those keys give the access the Business chose when it created them, and they are deleted when the Business connects or disconnects, or when Dronrly removes all such keys.

4. Dronrly's obligations

Dronrly will:

• process Customer Personal Data only on the Business's documented instructions (the Terms, this DPA and the Business's use of the Service) unless the law requires otherwise, and tell the Business if it believes an instruction breaks Data Protection Laws;
• make sure everyone who can access the data is bound by confidentiality;
• keep the security measures in section 7;
• help the Business respond to data subject requests and meet its obligations on security, breach notification, impact assessments and prior consultation (Arts. 32 to 36 GDPR), taking into account the information available to Dronrly;
• delete or return data at the end of the service as described in section 10;
• make available the information needed to show compliance with this DPA, and allow audits as described in section 9.

5. CCPA service-provider terms

For Customer Personal Data subject to the CCPA or similar US state laws, Dronrly:

• processes it only for the limited and specified business purposes in section 3;
• will not sell or share it (including for cross-context behavioral advertising);
• will not retain, use or disclose it for any purpose other than the business purposes in this DPA, or outside the direct business relationship with the Business;
• will not combine it with personal data Dronrly receives from others or collects itself, except as the CCPA allows for service providers;
• will comply with the CCPA and give the same level of privacy protection the CCPA requires;
• will tell the Business if it can no longer meet its obligations, and lets the Business take reasonable steps to stop and remediate unauthorized use.

Dronrly certifies that it understands and will comply with these restrictions.

6. Subprocessors

The Business authorizes Dronrly to use the subprocessors on our subprocessor page. Dronrly will bind each one by a written contract with data protection terms no less protective than this DPA, and remains responsible for them. Dronrly will email the Business owner at least 30 days before adding or replacing a subprocessor. The Business may object on reasonable data protection grounds within that period; the parties will then discuss it in good faith, and if they can't resolve it, the Business may cancel and receive a prorated refund of prepaid fees for the unused period.

7. Security

Dronrly maintains these technical and organizational measures:

• encryption in transit with HTTPS and HSTS; a strict Content Security Policy;
• passwords hashed with bcrypt; session and reset tokens stored as SHA-256 hashes; connected Stripe accounts reached with Dronrly's platform key (no per-business keys stored); Stripe Connect requests protected by a signed, single-use state value that is tied to the signed-in session and expires after 15 minutes; Connect webhooks signature-verified; legacy Stripe API keys encrypted with AES-GCM until deleted;
• role-based access: pilots see the jobs assigned to them and open unassigned jobs they can take, plus the business's quotes and invoices; customer records and customer exports are limited to owners and managers; customers see only their own records;
• separation of each business's data on every database query;
• rate limiting, bot checks on public forms, and an audit log of significant actions, visible to owners and managers;
• card data handled only by Stripe Checkout (Stripe is PCI DSS Level 1) and never by Dronrly;
• encrypted backups kept for 30 days on a rolling basis; server logs rotated with tokens in URLs redacted;
• access to production systems limited to authorized Dronrly staff.

Multi-factor authentication is not currently available. Dronrly may update these measures as long as protection is not reduced.

8. Personal data breaches

Dronrly will notify the Business without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of people and records affected, likely consequences, and the steps taken or proposed. Dronrly will update the Business as it learns more and will help it meet its own notification obligations. Notifying is not an admission of fault.

9. Audits

On written request, no more than once a year (or after a breach or a regulator's request), Dronrly will answer reasonable security questionnaires and provide information reasonably needed to show compliance. If that is not enough to meet a legal requirement, the Business may carry out an audit, at its own cost, with 30 days' notice, during business hours, and under confidentiality, in a way that does not compromise other customers' data.

10. Data subject requests, return and deletion

The Service gives owners and managers tools to handle requests themselves: export a customer's full record as a ZIP, correct records, erase a customer, and revoke portal access. If Dronrly receives a request directly, it will pass it to the Business and will not respond itself except to redirect the requester.

Deletion follows the Service's retention schedule: delivered files are deleted after the download period the Business chooses (7 to 365 days); files on canceled jobs after 30 days; and after cancellation or trial end, all Customer Personal Data is permanently deleted after 90 days (sooner on request). Deleted data leaves encrypted backups within 30 days. Before deletion, the Business can export its data using the in-app tools. The Business can end Dronrly's access to its Stripe account at any time: by disconnecting in Settings → Payments while its workspace is active, which also asks Stripe to revoke the access, or by removing Dronrly in its Stripe Dashboard. Either way, Dronrly then forgets the account ID. Deleting a workspace also revokes Dronrly's access to the connected Stripe account at Stripe. Dronrly may keep data longer only where the law requires, and will keep protecting it.

11. International transfers

Dronrly is in the United States and hosts the Service in [HOSTING LOCATION]. Where Customer Personal Data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties agree that:

• the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor), are incorporated by reference, with Dronrly as data importer; clause 7 (docking) applies; under clause 9, option 2 (general authorization) applies with the notice period in section 6; the option in clause 11 does not apply; for clauses 17 and 18, the law and courts of Ireland apply [CONFIRM]; Annex I is completed by section 3 and the parties' details in the Terms, and Annex II by section 7; Annex III is the subprocessor page;
• for UK data, the UK International Data Transfer Addendum (version B1.0) applies, with the tables completed by the same information;
• for Swiss data, the SCCs apply with references to the GDPR read as the Swiss FADP and the Swiss FDPIC as the competent authority;
• Dronrly will also rely on the EU-US Data Privacy Framework where it or a subprocessor is certified.

If Dronrly receives a government request for Customer Personal Data, it will notify the Business where legally allowed and challenge requests it reasonably believes are unlawful.

EU representative (Art. 27 GDPR): [EU REPRESENTATIVE, IF APPOINTED]. UK representative: [UK REPRESENTATIVE, IF APPOINTED].

12. Liability and term

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws do not allow those limits. This DPA lasts as long as Dronrly processes Customer Personal Data for the Business.

13. Contact

Privacy questions and breach contacts: [email protected]. [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. A countersigned copy is available on request.