Privacy Policy

1. Introduction

Welcome to dronios.com (the "Website"). We take the protection of your personal data seriously and process it in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the German Federal Data Protection Act ("BDSG"), the California Consumer Privacy Act / California Privacy Rights Act ("CCPA / CPRA"), and other applicable data protection laws.

2. Data Controller

The operator's contact details are shown below as an image to prevent automated harvesting.

A Data Protection Officer has not been appointed, as this is not required under Art. 37 GDPR.

3. What Data We Collect

• IP address, approximate region, and time zone
• Device type, operating system, browser type / version
• Referrer URL and pages visited, clicks, scroll depth, time spent
• Search terms and interaction with elements on the page
• Cookie identifiers and online identifiers
• Server log data (date, time, status code, bytes transferred)

4. Purposes and Legal Bases

• Analytics (Google Analytics 4) — for traffic analysis and to improve the user experience. Legal basis: consent (Art. 6(1)(a) GDPR).
• Advertising (Google Ads / Microsoft Ads) — to deliver personalised or contextual ads and measure conversions. Legal basis: consent (Art. 6(1)(a) GDPR).
• Affiliate tracking — to attribute outbound clicks on partner links (e.g. Amazon Associates) for commission purposes. Legal basis: consent (Art. 6(1)(a) GDPR).
• Technical operation (server logs, security) — to ensure the security and integrity of the Website. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
• Legal obligations — to comply with tax, commercial, and other statutory duties. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

5. Cookies & Consent Management

We use the consent management platform CookieYes. On your first visit, a banner asks for your consent for non-essential cookies (analytics, advertising, embedded media). You can withdraw or change your consent at any time via the "Cookie settings" link below.

6. Recipients / Third Parties

• Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (Analytics, Ads, Tag Manager, YouTube)
• Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft Ads / UET)
• Amazon Europe Core S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg (Amazon Associates affiliate programme)

We have entered into data processing agreements with these providers in accordance with Art. 28 GDPR where applicable.

7. International Data Transfers

Some recipients (e.g. Google LLC, YouTube LLC, Microsoft Corporation, Amazon.com Inc.) are based in the United States. For such transfers we rely on the European Commission's Standard Contractual Clauses (SCCs) (Art. 46 GDPR).

8. Retention Periods

• Google Analytics data: 14 months (shorter on withdrawal)
• Advertising / conversion data: 90 days
• Affiliate click logs: up to 90 days
• Server log files: 7–14 days
• Documents subject to statutory retention requirements: as required by applicable law (e.g. 10 years under German Commercial & Tax Code)

9. Automated Decision-Making / Profiling

We do not carry out automated decision-making with legal effect. As part of advertising audiences (remarketing), only pseudonymous profiling occurs after consent has been given.

10. Security

We use SSL/TLS encryption, access controls, regular software updates, and server-side firewalls to protect your data.

11. Your Rights (EU / EEA Residents)

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure / "right to be forgotten" (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent at any time (Art. 7(3) GDPR)

12. Your Rights (California & Other US States)

Residents of California, Virginia, Colorado, Connecticut and Utah may request access to, deletion of, or correction of their personal information and may opt out of "sharing" as defined under the relevant state law. We do not sell personal information.

13. Exercising Your Rights

Send your request to the contact details listed above. We will respond within one month (EU) or 45 days (US).

14. Supervisory Authority

You have the right to lodge a complaint with the competent data-protection authority of your jurisdiction. The supervisory authority for the operator is named in the contact image above; EU residents may alternatively contact their local authority.

15. Changes to This Policy

This Privacy Policy will be updated as needed. The "Last updated" date above will be adjusted accordingly. We recommend reviewing this page periodically.

16. Contact

If you have questions about this policy or our data processing, please contact us using the details listed above.