Data Processing Agreement (DPA)

1. Subject matter and duration

1. (1) The subject matter is the processing of personal data by the Provider on behalf of the Customer when providing the DroneShow Studio software in accordance with the Terms of Service.
2. (2) This agreement applies for the term of the usage contract and beyond until the Provider has deleted or returned all of the Customer’s data.

2. Nature and purpose of processing

The Provider processes the data exclusively to provide the Software, in particular: storing and displaying project, show and portal data; sending e-mails that the Customer triggers or schedules in the Software (e.g. invitations, reminders, summaries); processing input with the AI assistant when the Customer uses it; backups; troubleshooting, security and support at the Customer’s request.

3. Types of data

• Contact data of participants and of the Customer’s clients (e.g. name, company, role, e-mail address, phone number)
• User data of the Customer’s users (name, e-mail address, login and session data)
• Project and show data (e.g. venue, dates, tasks, responsibilities, comments, approvals, show versions)
• Uploaded files (e.g. documents, images, logos, music) and their content, insofar as they contain personal data
• E-mail traffic from the Software (recipients, content, sending and delivery status)
• Logs (activity history per project with person, action and time; access and server logs with IP addresses and timestamps)
• Input to the AI assistant and the related project and scene data

Processing of special categories of personal data (Art. 9 GDPR) is not intended. The Customer does not bring such data into the Software.

4. Categories of data subjects

• Employees and other users of the Customer
• The Customer’s clients and their contact persons
• Participants in projects (e.g. event organisers, service providers, remote pilots, contact persons at authorities and landowners)
• Recipients of show links and e-mails from the Software

5. Instructions

1. (1) The Provider processes the data only on documented instructions from the Customer, including with regard to transfers to a third country, unless required to do so by Union or Austrian law; in such a case the Provider informs the Customer of that legal requirement before processing, unless that law prohibits such information (Art. 28(3)(a) GDPR).
2. (2) The instructions result from the Terms of Service, this agreement and the Customer’s use of the functions of the Software. The Customer gives further instructions by e-mail.
3. (3) If the Provider considers that an instruction infringes data protection law, it informs the Customer without delay. It may suspend the execution until the instruction is confirmed or changed.

6. Confidentiality

The Provider ensures that all persons authorised to process the Customer’s data have committed themselves to confidentiality or are under a statutory obligation of confidentiality (Art. 28(3)(b) GDPR, § 6 Austrian Data Protection Act). Access to the Customer’s data takes place only for the purposes stated in the Terms of Service and is logged.

7. Technical and organisational measures

The Provider implements the measures pursuant to Art. 32 GDPR described in Annex 1. It may adapt them to technical progress, provided that the level of protection is not reduced.

8. Sub-processors

1. (1) The Customer gives its general authorisation to engage the sub-processors listed in Annex 2.
2. (2) The Provider informs the Customer by e-mail at least four weeks in advance of any intended addition or replacement of a sub-processor. Within this period the Customer may object for an important data protection reason. If the parties cannot agree, the Customer may terminate the contract with effect from the date of the change.
3. (3) The Provider imposes on each sub-processor by contract essentially the same data protection obligations as set out in this agreement (Art. 28(4) GDPR).
4. (4) Data is transferred to a country outside the European Economic Area only if the requirements of Art. 44 et seq. GDPR are met, for example by an adequacy decision or standard contractual clauses.

9. Assistance to the Customer

1. (1) The Provider assists the Customer with appropriate technical and organisational measures in responding to requests from data subjects (Art. 12 to 22 GDPR). If a data subject contacts the Provider directly, the Provider forwards the request to the Customer without delay.
2. (2) Taking into account the information available to it, the Provider assists the Customer in complying with the obligations under Art. 32 to 36 GDPR (security, notification of breaches, data protection impact assessment, prior consultation).
3. (3) Where assistance is not covered by functions of the Software and goes beyond the usual, the Provider may claim reasonable compensation for its effort, unless the assistance results from a breach by the Provider.

10. Personal data breaches

1. (1) The Provider notifies the Customer of a personal data breach without undue delay, and at the latest within 72 hours after becoming aware of it, by e-mail to the address stored in the account.
2. (2) As far as known, the notification contains the information pursuant to Art. 33(3) GDPR: nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences and measures taken or proposed. Information not yet available is provided without undue delay.
3. (3) The Provider takes the necessary measures without delay to secure the data and to mitigate possible adverse effects.

11. Deletion and return

1. (1) Until the end of the contract, the Customer can download its data via the export functions of the Software; the Provider assists on request.
2. (2) After the end of the contract, the Provider deletes all of the Customer’s data within 30 days, unless Union or Austrian law requires storage. Backup copies are overwritten within the regular backup cycle [Placeholder: retention period of backups].
3. (3) On request, the Provider confirms the deletion in writing; e-mail is sufficient.

12. Demonstration of compliance and audits

1. (1) The Provider makes available to the Customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.
2. (2) The Customer or an auditor mandated by it and bound to confidentiality may conduct audits, including inspections. Audits must be announced at least 14 days in advance, take place during normal business hours, must not disrupt operations disproportionately and – unless there is a specific reason – take place no more than once per calendar year. Data of other customers and the Provider’s trade secrets must be protected.
3. (3) The Provider primarily fulfils its obligation to demonstrate compliance by providing information and documents. The Customer bears the costs of an audit, unless it reveals a material breach by the Provider.

13. Liability

Liability towards data subjects is governed by Art. 82 GDPR. Between the Customer and the Provider, the liability provisions of the Terms of Service apply unless Art. 82 GDPR mandatorily provides otherwise.

14. Final provisions

1. (1) In the event of contradictions between this agreement and the Terms of Service, this agreement prevails in matters of data protection.
2. (2) Austrian law applies. The place of jurisdiction is the competent court in Innsbruck, Austria.
3. (3) Should any provision be invalid, the remaining provisions remain valid.
4. (4) This agreement is available in German and English. The German version is legally binding.

Annex 1 – Technical and organisational measures (summary)

• Location: the servers are located exclusively in data centres of Hetzner Online GmbH in Germany (Nuremberg, Falkenstein) and Finland (Helsinki), i.e. in the European Union.
• Encrypted transmission: the Software, client portal and show links are only accessible via HTTPS (TLS).
• Tenant separation: every request is assigned on the server side to the organisation of the logged-in user; access to data of other organisations is rejected.
• Access control: login with a personal password stored only as a hash (bcrypt); time-limited sessions; the renewal token is kept in an HttpOnly, Secure and SameSite cookie; limits on login, registration and reset attempts per IP address.
• Authorisation concept: participants in the client portal receive personal, revocable access links and only see the content released to them; internal content remains reserved for the Customer’s users.
• Input control: activity history per project (who, what, when); server and access logs; access by the Provider to Customer data is logged.
• Uploads: file type and file size checks.
• Availability: daily backups; backups are stored in a separate data centre (Helsinki). Restoration according to a contingency plan.
• Organisation: confidentiality commitment of all persons involved; access only for defined purposes; regular security updates; handling of security incidents according to a defined procedure.

Annex 2 – Sub-processors

In the users’ browser, the Software loads map and elevation data from public map services (aerial images from basemap.at, elevation data from the public “Terrain Tiles” dataset on Amazon Web Services). No Customer data is transferred on behalf of the Customer; only map tiles are retrieved, and for technical reasons the map services receive the browser’s IP address. See the privacy policy for details.