Data Processing Agreement

Draft for review. Prepared from what the software actually does. Not reviewed by a lawyer and not legal advice. Items marked [CONFIRM] need a decision or a professional opinion before publication.

Terms on which we process personal data on your behalf.

This draft follows the structure controllers and their reviewers expect. The operative wording, and any standard contractual clauses for transfers, must be settled by counsel.

1. Roles

You are the controller of operational data you put into DronOps. Aero Innovations LLC is the processor. For your own account and billing data we are the controller; that is covered by the Privacy Policy.

2. Subject matter and duration

We process personal data to provide DronOps, for as long as your account is active plus any retention described below.

3. Categories

Data subjects: your staff, pilots and crew; client contacts you record. Data: identity and contact details, professional certifications and currency, duty and rest records, flight participation, and location data associated with operations.

[CONFIRM] Whether medical certificate data is recorded in your deployment; if so it may be a special category and needs its own basis and safeguards.

4. Our obligations

Process only on your documented instructions.
Bind everyone with access to confidentiality.
Apply the technical and organisational measures on the security page.
Assist with data-subject requests and with your own impact assessments.
Delete or return the data at the end of the contract, except where retention is legally required.

5. Sub-processors

You authorise the sub-processors listed in the register. We will give notice before adding one that materially changes how data is handled, and you may object.

6. Breach notification

We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you need to meet your own obligations.

[CONFIRM] A specific notification window (commonly 72 hours) should be committed to here.

7. International transfers

Personal data processed under this agreement is stored in the European Union (Frankfurt, Germany). Transfers arise in two directions and they are not the same problem:

Into the EU. Customer personnel and operational records originating in the UAE, Saudi Arabia and Oman are transmitted to EU-hosted infrastructure for storage and processing.
Out of the EU. Certain sub-processors listed in the register process data outside the EU — notably application hosting at the network edge and, where enabled, the AI providers in the United States.

[CONFIRM] The legal instrument for each direction — standard contractual clauses, the recipient jurisdiction's own adequacy or consent basis, and any UAE, KSA or Oman transfer requirement that applies to data leaving those countries. The hosting region is now settled (Frankfurt), so this section is no longer blocked on a technical decision; what remains is the choice of instrument, which is a professional opinion rather than an engineering one.

8. Audit

We will make available the information needed to demonstrate compliance with this agreement and will contribute to audits on reasonable notice.