1. Who we are
Stichting Delft Drone Initiative (“DDI”) is responsible for the personal data described in this statement. In the language of the General Data Protection Regulation, DDI is the controller.
| Legal name | Stichting Delft Drone Initiative |
|---|---|
| Chamber of Commerce (KvK) | 97286311 |
| support@delftdrones.eu | |
| Postal address | Kluyverweg 1, 2629 HS Delft |
DDI is not required to appoint a data protection officer and has not appointed one. Questions about this statement go to support@delftdrones.eu.
This statement covers the DDI website, registration for our activities, and our community subscription. Cookies are covered separately in our Cookie Statement.
2. Where we get your data
Most of the data we hold comes from you: when you create an account, register for an activity, pay, subscribe, or contact us.
Where a parent or guardian registers on behalf of a child, they conclude the agreement and provide the child’s details. The child has the same rights over that data as anyone else, and section 9 explains how to use them.
Where someone passes their place at an activity to you, we send them a transfer link and they pass it to you, so you register yourself and we receive your details from you directly. If they send us your name or email instead, we use it only to send you that link, and delete it if you do not register.
3. What we process, why, and for how long
| What | Why | Legal basis | Retention |
|---|---|---|---|
| Name, email, telephone, account credentials | Creating and managing your account | Performance of the agreement | While your account exists, then 12 months |
| Registration details, activity booked, date, attendance | Organising the activity and delivering it | Performance of the agreement | 2 years after the activity |
| Age or date of birth | Checking minimum age, and whether a parent must contract | Performance of the agreement, legal obligation | With the registration record |
| Parent or guardian name and contact details | Concluding the agreement for a participant under 18 | Performance of the agreement | With the registration record |
| Payment details, amount, invoices | Processing payment and keeping our accounts | Performance of the agreement, legal obligation | 7 years, as Dutch tax law requires |
| Subscription status and billing history | Running the community subscription | Performance of the agreement | 7 years for the financial record |
| Record of the terms and version you accepted | Proving what was agreed | Legitimate interest, and defending claims | 2 years after the activity |
| Cookie and consent records | Respecting and proving your choices | Legal obligation, consent | 12 months, or while consent stands |
| Newsletter subscription and history | Sending a newsletter, if and when we start one | Consent | Until you unsubscribe |
| Record that you unsubscribed | Making sure we do not email you again | Legitimate interest | Indefinitely, as a suppression record only |
| Correspondence with us | Answering questions and handling complaints | Performance of the agreement, legitimate interest | 2 years |
| Photographs and video | Educational, promotional and community purposes, and keeping a record of our activities | Legitimate interest for blurred material, consent for unblurred | See section 6 |
| Safety briefing records: who attended and completed the comprehension check | Showing that the safety briefing took place | Legitimate interest, and defending claims | 5 years, as for incident records |
| Incident and injury records | Safety, learning from incidents, and dealing with claims | Legitimate interest, legal obligation, and see section 5 | See section 5 |
| Website logs, IP address | Keeping the site secure and available | Legitimate interest | 6 months |
| Analytics data | Understanding how the website is used | Consent | See Cookie Statement |
Where we rely on legitimate interest, we have weighed our interest against your privacy. You can object to that processing, and section 9 explains how.
What is required. Your name, email, age and payment details are needed to conclude the agreement. Without them we cannot register you. Everything else — telephone number, newsletter, photo consent — is optional, and refusing has no consequence other than the obvious one of us not being able to do that particular thing.
4. Your account
Your account holds your registration history, your subscription status, and your preferences for the newsletter and for photography. You can change your preferences there at any time. You can ask us to close your account, and we will, subject to the retention periods in section 3 — most importantly the seven years we must keep financial records.
5. Incidents and injuries
We do not ask for medical or health information when you register, and you should not send it to us.
One part of our activities can nevertheless involve health information, which the GDPR treats as a special category needing stricter handling. If someone is hurt at our facility, we record what happened. That record may describe an injury. We keep it because we have a duty of care, because we learn from incidents, and because a claim may follow. Health information may only be processed on one of the narrow grounds the GDPR allows. Where an incident record contains health information, we rely on the ground that permits such processing where it is necessary for establishing, exercising or defending legal claims.
We keep incident records for five years. Where the person involved was under 18, we keep the record until they turn 23, because the period in which a claim can be brought does not begin until they reach 18.
Where emergency treatment is needed, we may pass information to emergency services without asking first, because your vital interests come first.
6. Photography and video
Photographs and video are taken at our activities. Faces are blurred in anything we publish, unless you have separately consented to being shown unblurred. That consent is optional, is never a condition of taking part, and can be withdrawn at any time in your account or by emailing us.
Withdrawing consent applies to future use. We will remove or blur the material within a reasonable time, but we cannot undo sharing that has already happened, for example by someone who reposted it.
If you do not want to be photographed at all, tell the supervisor at the start of the activity.
Published material is kept for as long as it remains in use.
We also keep photographs and video as a record of our activities, so that we have an overview of what we have done. Original files are kept for five years after the activity and are then deleted. You can object at any time under section 9, and where you do, we remove or blur the material concerned before that period ends.
7. Children
Participants can take part from the age of 12. Where the participant is under 18, the parent or guardian concludes the agreement and provides the details.
For personal data, Dutch law sets the age of consent at 16. Where the participant is 16 or 17, they give their own consent for the newsletter and for photography. Where the participant is under 16, the parent or guardian gives that consent.
A parent or guardian may exercise the rights in section 9 on behalf of a child under 16.
8. Who else sees your data
We do not sell personal data and we do not share it for anyone else’s marketing.
We use the following service providers, who process data on our instructions under a processing agreement:
| Provider | What for | Where |
|---|---|---|
| Contabo | Website and database hosting | Germany |
| Stripe | Payment processing | Ireland, with transfers to the United States |
| Website analytics, only with your consent | United States |
We do not currently send a newsletter. Any email we send you, including registration confirmations and account messages, is sent from our own servers in Germany. If we later use an external newsletter provider, we will name it here before we start.
Instagram and LinkedIn receive data when embedded content on our site is loaded, and only if you consented. Those platforms act for their own purposes, not on our instructions. See the Cookie Statement.
We also share data where the law requires it, for example with the tax authorities, and with our accountant, insurer or legal adviser where a specific matter makes that necessary.
9. Your rights
You can ask us to:
- give you a copy of the data we hold about you
- correct anything that is wrong or incomplete
- delete your data, where we have no continuing reason to keep it
- restrict what we do with it while a question about it is resolved
- transfer it to you or another organisation in a machine-readable form
- stop processing based on legitimate interest, by objecting
- withdraw consent you gave for the newsletter, photography or cookies. Every newsletter also contains an unsubscribe link, and you can switch the newsletter off in your account at any time
Withdrawing consent is as easy as giving it, and does not affect processing that already took place.
Email support@delftdrones.eu. We reply within one month. If a request is complex we may take two months more, and we will tell you before that first month is up. It is free, unless a request is excessive, and we may ask you to confirm who you are before we send personal data.
If you are unhappy with how we handle your data, tell us first so we can put it right. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.
10. Transfers outside the EEA
Our website and database are hosted in Germany, and registration data stays there.
Some of our providers transfer data to the United States. Google and Stripe participate in the EU–US Data Privacy Framework, and the European Commission has decided that organisations certified under it offer an adequate level of protection. Where a provider does not rely on that framework, we use the European Commission’s standard contractual clauses. You can ask us for a copy of the safeguards that apply to a particular transfer by emailing support@delftdrones.eu.
11. Security
Access to the database is limited to the people who need it. The website uses encrypted connections, passwords are stored hashed, and we keep backups. Where a data breach presents a risk to you, we will notify the Autoriteit Persoonsgegevens and, where required, you.
12. Automated decisions
We do not make decisions about you by automated means and we do not profile you.
13. Changes
We may amend this statement, for example if we change a service provider. The version and date at the top show when it last changed. Where a change materially affects you, we will tell you.
Stichting Delft Drone Initiative — Delft, the Netherlands · KvK 97286311 · support@delftdrones.eu