1. Introduction

At Drone by Nature SAS (“Drone by Nature”, “we”, “our”, or “us”), we adhere to the highest standards of protecting your personal data when we process it in connection with your use of our services, our website https://dronebynature.com (the “Platform”), or when you otherwise provide your personal data to us.

This Privacy Policy is designed to help you understand how we collect, use, store, and protect your personal data, and to explain your rights and our obligations under applicable data protection laws.

Drone by Nature SAS is a company incorporated under the laws of France, with its registered office at 17-21 Rue Saint-Fiacre, 75002 Paris, France. Drone by Nature SAS is registered with the Paris Trade and Companies Register (RCS Paris) under number 990 152 357, with an intra-community VAT number FR87990152357. We act as the data controller for the purposes of the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).

This Privacy Policy, together with our Terms of Use (https://dronebynature.com/terms-of-use) and any other applicable policies, forms a contractual agreement between you and Drone by Nature. All capitalized terms not defined in this Privacy Policy have the meaning given to them in the Terms of Use or any other Drone by Nature policy.

Please read this Privacy Policy carefully, along with our other applicable policies and guidelines, to understand your rights and our responsibilities regarding the protection of your personal data.

2. Legal Framework

In the context of providing and operating our Platform, we process your personal data in compliance with Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation or “GDPR”) and the French Data Protection Act (Loi Informatique et Libertés), as amended, as well as any other applicable international data protection laws relevant to our activities.

“Personal data” means any information relating to an identified or identifiable natural person. We collect and process personal data solely for the purposes of providing, improving, and managing our Services, operating our Platform, and communicating with you about those Services, in strict accordance with the principles set out in the GDPR.

We ensure that the personal data we collect is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. We do not intentionally collect any data that is considered sensitive under applicable law (such as information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or health data).

By registering on or using the Platform, you acknowledge that you have read and understood this Privacy Policy and authorize us to process your personal data in accordance with its terms. If you do not agree with this Privacy Policy, you should refrain from using the Platform and our Services.

3. Important Information and Who We Are

Purpose of this Privacy Policy:

This Privacy Policy aims to provide you with clear information about how we collect, use, store, and protect your personal data in connection with any form of your engagement with us, whether through our website https://dronebynature.com (the “Platform”), our services, or any other interaction.

It is important that you read this Privacy Policy together with any other privacy notice or fair processing notice that we may provide on specific occasions when we collect or process personal data about you, so that you are fully aware of how and why we are using your data. This Privacy Policy supplements those other notices and is not intended to override them.

We do not knowingly collect or process personal data relating to minors, nor do we process any special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or health data). Please do not provide us with such information. Any transmission of such data will constitute an immediate and automatic breach of this Privacy Policy and our Terms of Use.

Children’s Data:

Drone by Nature does not knowingly collect, process, or store personal data relating to children under the age of 15 years.

If we become aware that we have inadvertently collected such data, we will take immediate steps to delete it from our systems.

Parents or legal guardians who believe their child has provided personal data to Drone by Nature without consent should contact us at support@dronebynature.com so we can promptly remove the information.

Controller and Processor:

Drone by Nature SAS, a company incorporated under the laws of France and registered at 17-21 Rue Saint-Fiacre, 75002 Paris, France, acts as the data controller when it determines the purposes and means of processing your personal data.

In certain cases, Drone by Nature may also act as a data processor on behalf of third parties, such as contributors or partners who offer their services via our Platform. In such cases, we process personal data only on their documented instructions and in accordance with our contractual obligations and applicable data protection laws.

We have appointed a Data Protection Contact within Drone by Nature who is responsible for overseeing questions relating to this Privacy Policy and data protection compliance. If you have any questions about this Privacy Policy, or if you wish to exercise your legal rights, please contact us using the details below.

Data Protection Officer (DPO):

Drone by Nature has designated a Data Protection Officer (“DPO”) in accordance with Article 37 of the General Data Protection Regulation (GDPR).

The DPO ensures compliance with all applicable data protection laws and acts as a point of contact with supervisory authorities, including the CNIL.

You may contact the DPO at privacy@dronebynature.com or by post at Drone by Nature SAS, 17-21 Rue Saint-Fiacre, 75002 Paris, France (please indicate “Data Protection – DPO”).

Our Contact Details:

For any questions regarding your personal data or if you wish to exercise your rights (access, rectification, deletion, limitation, portability, or objection), you can contact us at:

• By post: Drone by Nature SAS, 17-21 Rue Saint-Fiacre, 75002 Paris, France (please indicate “Data Protection”)
• By email: support@dronebynature.com

You have the right to lodge a complaint at any time with the Commission Nationale de l’Informatique et des Libertés (CNIL), the French Data Protection Authority (https://www.cnil.fr), or with any other competent supervisory authority. However, we would appreciate the opportunity to address your concerns before you approach a regulator, so please contact us first.

Changes to this Privacy Policy:

This Privacy Policy was last updated on 14 November 2025. Previous versions are archived and can be provided upon request.

We may update or amend this Privacy Policy from time to time. Any changes will take effect when the revised version is published on the Platform. Your continued access to or use of our Services after such updates constitutes your acceptance of the revised Privacy Policy. It is your responsibility to review this Privacy Policy periodically to stay informed of any changes.

To ensure accuracy, please inform us promptly if any of your personal data changes during your relationship with us.

Third-Party Links on the Platform:

Our Platform may include links to third-party websites, plug-ins, or applications. Clicking on those links or enabling such connections may allow third parties to collect or share data about you. We do not control these third-party platforms and are not responsible for their privacy practices. When you leave our Platform or interact with third-party content, we encourage you to read the privacy policy of each website or service you visit.

4. What We Collect About You

“You” refers to contributors, customers, models, minor models and their parents or legal guardians, as well as property owners who engage with Drone by Nature SAS (“Drone by Nature”, “we”, “our”, or “us”).

Personal data (also referred to as personally identifiable information) means any information relating to an identified or identifiable natural person. This includes information that can directly or indirectly identify you as an individual. Personal data does not include data where the identity has been removed (anonymous or aggregated data).

We may collect, use, store, and transfer (“process”) different categories of personal data about you, which you provide directly to us or which we collect automatically through your use of our Services or Platform. Personal data may be collected in particular when you:

• Browse the Site or Platform, including logging in and viewing pages;
• Create an account, including providing information such as first and last name, date of birth, country, email address, telephone number, and other account details;
• Make an online payment, including payment information handled by third-party payment providers (credit/debit card number, expiration date, security code, billing information) and, where applicable, mobile phone details required for processing;
• Enter information in the “Account Details” section of your Dashboard;
• Subscribe to newsletters or promotional communications;
• Contact our Customer Service or support teams.

The categories of personal data we process may include:

• Identity Data: Full name, professional title, or information relating to your company (company registration or identification details).
• Contact Data: Email address, postal or registered addresses, telephone numbers.
• Account Data: Account login credentials, profile information, user-generated content, communications, and payment history.
• Financial Data: Bank account details or identifiers for payment service providers (processed securely by third parties acting on our instructions).
• Transaction Data: Payments, invoices, subscriptions, contractual terms, and services/products purchased or provided. This may also include information relating to your optional participation in our Stripe Climate donation feature (such as whether you have activated the 1% donation setting in your Contributor Dashboard), although Drone by Nature does not receive or store your payment card details.
• Technical Data: IP address, login data, browser type/version, device type, time zone and location data, cookies, browser plug-ins, operating system, preferred language, advertising identifiers, mobile network data, and other technology used to access the Platform.
• Usage Data: How you use our Platform, products, services, including browsing behaviour and participation in surveys or feedback.
• Marketing and Communications Data: Newsletter and marketing preferences, communication preferences, and records of communications exchanged with us or between users through the Platform.
• Support Data: Records of support requests, complaints, and correspondence with our support team.

We may also collect, use, and share Aggregated Data for statistical or analytical purposes. Aggregated Data may be derived from personal data but does not identify you. If Aggregated Data is combined with personal data and becomes identifiable, it will be treated as personal data under this Privacy Policy.

For professional clients (legal entities), we may collect personal data of their representatives or employees (e.g., first name, last name, position, professional contact details). These data are treated as personal data and enjoy the same protection and rights as other data collected.

Where we are required by law or under a contract with you to collect personal data and you fail to provide that data when requested, we may not be able to perform our contractual obligations (for example, to provide services or allow you to provide services via the Platform).

Consent for communications: If you consent to receive newsletters or promotional communications, you may withdraw your consent at any time without cost.

Please do not provide us with personal data about any third party (individual or company) without a lawful basis or authorization. By submitting such information, you represent and warrant that you have obtained all necessary rights or permissions and agree to indemnify Drone by Nature against any claim or liability arising from your breach of this obligation.

5. How Is Your Personal Data Collected

We collect personal data from and about you through a variety of methods, including:

Direct interactions:

You may provide personal data directly to us when you use our Services, register or interact with our Platform, or correspond with us by phone, email, or other channels. This includes personal data you provide when you:

• Use our Services;
• Use our Platform;
• Enter into a contract with us;
• Provide services to us as an independent contractor or service provider;
• Request information from us; or
• Give us feedback, participate in surveys, or otherwise communicate with us.

Automated technologies or interactions:

When you interact with our Platform, we may automatically collect personal data about your device, browsing behavior, and usage patterns. We collect this data through technologies such as cookies, server logs, and similar tools. In some cases, we may also receive data about you from other Platforms or websites that employ our cookies or tracking technologies.

Third parties:

We may receive personal data about you from third parties, including:

• Analytics and measurement providers;
• Payment service providers and gateways;
• Publicly available sources;
• Messaging or social media platforms (e.g., WhatsApp, Instagram, Facebook);
• Marketing or advertising platforms;
• Search engines or other online service providers.

All personal data collected, whether directly, automatically, or from third parties, is processed by Drone by Nature SAS, in accordance with the EU General Data Protection Regulation (GDPR), the French Data Protection Act (Loi Informatique et Libertés), and applicable international privacy laws where relevant.

6. How We Use Your Personal data

We will only process your personal data when the law permits us to do so and for legitimate purposes, which you expressly understand and consent to where required. Most commonly, we process your personal data in the following circumstances:

• With your consent: where you have explicitly agreed to our processing of your personal data for a specific purpose;
• To perform a contract: where processing is necessary to enter into or perform a contract with you, including providing our Services or enabling you to provide services through our Platform;
• For legitimate interests: where processing is necessary for our legitimate business interests (or those of a third party), provided that your rights, interests, and fundamental freedoms do not override those interests;
• To comply with legal obligations: where processing is necessary to comply with applicable laws, regulations, or legal orders.

Where you choose to activate the optional 1% Stripe Climate donation, we process this donation setting on the basis of your consent and for the performance of your contract with Drone by Nature.

Please note that we may process your personal data on more than one lawful basis, depending on the specific purpose for which we are using it.

All processing is carried out in accordance with the EU General Data Protection Regulation (GDPR), the French Data Protection Act (Loi Informatique et Libertés), and other applicable international privacy laws relevant to our global operations.

7. Purposes for Which We Use Your Personal Data

We process your personal data for specific, explicit, and legitimate purposes, and we do not further process it in a manner incompatible with those purposes. The purposes for which we may process your personal data include:

• To engage with you after you have contacted us via our Platform, social media, or other communication channels;
• To provide our Services, including access to the Drone by Nature database of aerial stock media, the functionality of our Platform, user notifications, and updates via email or other communication channels;
• To perform and manage contracts concluded with you as a client, contributor, service provider, or independent contractor;
• To enable authorised service providers to perform services necessary for the operation of our Platform and Services (for example, payment gateways, hosting, and analytics providers);
• To process payments, manage billing, subscriptions, optional Contributor donation settings (Stripe Climate), and any financial transactions related to the Services;
• To comply with legal, regulatory, and security obligations, including fraud prevention, cybersecurity, and ensuring user safety;
• To manage our relationship with you, including notifying you about updates to our Terms of Use, this Privacy Policy, or other relevant policies;
• To administer, maintain, and protect our company and Platform, including troubleshooting, data analysis, testing, maintenance, and support;
• To analyse data and improve the performance, content, and user experience of our Platform and Services;
• To facilitate communication between users through the Platform; and
• To provide you with marketing communications and suggest Services, offers, or updates that may be of interest to you.

Marketing:

We strive to offer you clear choices regarding the use of your personal data, particularly for marketing and advertising purposes. You may exercise your rights related to marketing communications at any time by using the opt-out mechanisms included in those communications or by contacting us directly.

You will receive marketing communications from us only if you have requested our Services, subscribed to our updates, or otherwise provided your consent, and you have not opted out of such communications.

You may withdraw your consent or update your marketing preferences at any time. Please note that even if you opt out of marketing messages, we may still send you important service-related or transactional communications that are necessary for the use of our Services.

Third-Party Marketing:

We will not share your personal data with any external organisation for third-party marketing purposes without obtaining your prior express consent (“opt-in”).

Change of Purpose:

We will only use your personal data for the purposes for which it was collected, unless we reasonably determine that it must be used for another purpose that is compatible with the original one.

If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

Please note that, in certain circumstances, we may process your personal data without your knowledge or consent, but only where required or permitted by applicable laws or regulations.

8. Disclosures Of Your Personal data

We may need to share your personal data with certain third parties for the purposes outlined in this Privacy Policy. All such disclosures are made in compliance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the French Loi Informatique et Libertés.

Internal Third Parties:

• Other entities or affiliates within the Drone by Nature group, acting as joint controllers or processors, where necessary for administrative, operational, or service delivery purposes.

External Third Parties:

We may disclose your personal data to:

• Authorised partners and third parties under contractual agreement with Drone by Nature SAS who require access to your personal data in order to provide our Services to you or facilitate your use of the Platform;
• Service providers acting as processors, including but not limited to developers, hosting and cloud service providers, payment gateways, analytics providers, social media and marketing platforms, and professional IT support teams.

Stripe also processes any optional 1% environmental donations activated by Contributors via Stripe Climate. These donations are handled directly by Stripe, and Drone by Nature does not access or store your payment card details;

• Professional advisers acting as processors or joint controllers, including lawyers, bankers, auditors, accountants, or insurers providing legal, financial, or compliance-related services to Drone by Nature SAS;
• Regulatory, judicial, or administrative authorities when required to comply with applicable laws and regulations, including anti-fraud, anti-money laundering (Lutte contre le blanchiment d’argent), anti-corruption, or tax obligations; and
• Business partners or successors, in the event of a merger, acquisition, restructuring, or sale of assets. In such cases, your personal data may be transferred to the acquiring entity, which will continue to process your data in accordance with this Privacy Policy.

International Transfers:

As Drone by Nature operates globally, some of our service providers or partners may be located outside the European Economic Area (EEA). In such cases, we ensure that:

• Transfers are made only to countries recognized by the European Commission as providing an adequate level of data protection; or
• Appropriate safeguards are implemented, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms.

You may request further details about these safeguards by contacting us at support@dronebynature.com.

Third-Party Obligations:

We require all third parties to respect the confidentiality and security of your personal data and to process it strictly in accordance with our instructions and applicable laws. We do not permit our third-party service providers to use your personal data for their own purposes and only authorize them to process your data for specific, lawful purposes in line with our contractual agreements.

9. When and How We Share Your Personal Data

We may share your personal data in the following circumstances:

With Service Providers and Third Parties:

We may share your personal data with third-party service providers who process personal data on our behalf, including cloud hosting, payment processing, analytics, IT services, and communication platforms. These third parties are contractually required to process your personal data in accordance with our instructions and comply with applicable data protection laws.

• Marketing and Commercial Use: We will never share your personal data with third parties for marketing or commercial purposes without your prior consent.
• International Transfers: Some of our service providers may be located outside the European Economic Area (EEA). In such cases, we implement safeguards such as Standard Contractual Clauses, adequacy decisions, or other GDPR-compliant measures to ensure your data is protected.

With Authorities:

We may disclose personal data to governmental, administrative, or judicial authorities where required by law or to:

• protect our legal rights,
• prevent fraud or unlawful activity,
• enforce our Terms of Use, or
• protect the rights or safety of other users or third parties.

Such disclosures are made strictly in compliance with applicable EU, French, or international laws.

10. How Long We Keep Your Personal Data

We retain your personal data only for as long as necessary to achieve the purposes for which it was collected, including to:

• provide and maintain your access to our Services and Platform;
• comply with legal, accounting, or regulatory obligations;
• resolve disputes, prevent fraud, or enforce agreements; and
• maintain evidence for potential claims or legal requirements.

To determine the appropriate retention period for personal data, we consider the nature, volume, and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether those purposes can be achieved by other means, and all applicable legal or regulatory requirements under European Union, French, or other relevant international laws.

Specific Retention Periods:

We apply the following general retention periods unless a longer period is required by law or justified by legitimate business needs:

• Account and profile data: retained for up to 3 years after the last user activity or account closure;
• Contractual and transaction data: retained for up to 5 years from the date of the transaction (statutory limitation period under French law);
• Invoices and accounting data: retained for 10 years pursuant to Article L123-22 of the French Commercial Code;
• Marketing communications and consent records: retained for 3 years from the last contact or consent update;
• Support correspondence and complaints: retained for 3 years from the date of closure.

When personal data is no longer necessary for the purposes for which it was collected, or when you request its deletion, we will delete it or securely anonymise it so that it can no longer be linked to you. Where possible, we may anonymise your personal data for statistical, analytical, or research purposes. Anonymised data is no longer considered personal data and may be retained indefinitely.

You may request the deletion of your personal data or closure of your account at any time by contacting us directly through the Platform or by email. Following such a request, we will delete your personal data except where retention is required for:

• the protection of safety, security, or fraud prevention;
• compliance with legal, tax, or accounting obligations;
• the management or resolution of ongoing disputes or claims; or
• the fulfilment of contractual obligations still in effect.

11. Cookies

Our Use of Cookies:

Our Platform uses cookies and similar technologies to ensure its proper functioning, improve your browsing experience, and analyse how our Services are used.

What Are Cookies:

Cookies are small text files stored on your device (computer, smartphone, or tablet) when you visit a website or use our Platform. They enable the Platform to recognise your device, remember your preferences, and collect information about your browsing activity. Cookies also allow us to measure the effectiveness of our content and provide relevant advertising or social media features.

Types of Cookies We Use:

We may use the following categories of cookies:

• Strictly necessary cookies: Essential for the functioning of the Platform (e.g., secure login, payment processing, remembering cookie preferences). Cannot be disabled.
• Performance and analytics cookies: Help us understand Platform usage, identify popular pages/features, and improve user experience.
• Functional cookies: Remember your preferences such as language, region, or device display settings to personalise your experience.
• Social media and advertising cookies: May collect data when you use sharing buttons or social media features, or when relevant content or ads are displayed.

Cookies may also store form information (account registration, subscription, shopping cart contents) and support access to reserved/personal areas of the Platform with authentication and security measures.

Cookie Retention:

Cookies placed on your device with your consent are generally deleted 13 months after being stored, unless you delete them sooner via your browser settings.

Legal Basis and Consent:

In accordance with the GDPR and French Loi Informatique et Libertés, non-essential cookies (analytics, advertising, or social media cookies) are only placed on your device with your prior consent.

When you first visit our Platform, a cookie banner will appear, allowing you to:

• Accept all cookies,
• Refuse all non-essential cookies, or
• Customise your cookie preferences.

Continuing to navigate the Platform or interacting with its elements (clicking links, buttons, images, etc.) constitutes acceptance of cookie placement.

You can modify your preferences or withdraw consent at any time by adjusting your browser settings or deleting cookies. Please note that refusing cookies may limit certain features or functionalities of the Platform.

Third-Party Cookies:

Some cookies may be set by third-party service providers (e.g., analytics, social media, or advertising platforms such as Google Analytics or Meta). These partners are contractually bound to process your data only for specified purposes and in compliance with applicable data protection laws.

Managing Cookies:

You can configure your browser to accept, refuse, or alert you about cookies. Settings vary by browser:

Chrome: https://support.google.com/chrome/answer/95647

Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences

Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Edge: https://support.microsoft.com/en-us/help/4468242/microsoft-edge-browsing-data-and-privacy

For more information about cookies and your rights, you may consult the CNIL website (https://www.cnil.fr/).

12. International Transfers

As a global digital platform, we may transfer and process your personal data outside your country of residence, including to countries outside the European Economic Area (EEA), for purposes such as secure cloud storage, data hosting, or engagement with service providers and software necessary for our business operations.

Whenever we transfer your personal data internationally, we ensure that it is afforded a level of protection consistent with the requirements of the EU General Data Protection Regulation (GDPR) and the French Loi Informatique et Libertés. To achieve this, we implement one or more of the following safeguards:

• Adequacy Decisions: We may transfer your personal data to countries that the European Commission has determined provide an adequate level of data protection;
• Standard Contractual Clauses (SCCs): Where we use service providers or partners located in countries without an adequacy decision, we enter into contracts incorporating the European Commission’s Standard Contractual Clauses, which require those recipients to protect your personal data in line with EU standards;
• Binding Corporate Rules (BCRs): Where applicable, we may rely on approved internal rules governing international data transfers within our corporate group; or
• Specific Derogations: In certain limited cases, such as when a transfer is necessary for the performance of a contract with you or with your explicit consent, we may rely on one of the derogations provided for in Article 49 of the GDPR.

We take all reasonable steps to ensure that your personal data remains secure, confidential, and processed in accordance with this Privacy Policy, regardless of where it is stored or accessed.

If you would like further information about the safeguards we apply to international transfers of personal data, please contact us at support@dronebynature.com.

Non-EU Users and Local Laws:

While Drone by Nature is established in France and processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and French Data Protection Act, we also respect mandatory privacy rights granted under the local laws of users outside the European Union.

Where local regulations provide stronger protections, those rights shall prevail to the extent required by law.

13. Data Security

Drone by Nature SAS takes the security, integrity, and confidentiality of your personal data very seriously. We have implemented appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

These measures are proportionate to the risks presented by our processing activities and reflect industry best practices. They include, but are not limited to:

• Access controls: restricting access to personal data to employees, contractors, and authorised service providers who require it for legitimate purposes;
• Encryption and pseudonymisation: protecting data during storage and transmission;
• Secure servers and networks: with monitoring and regular security audits;
• Regular staff training: to ensure employees and contractors understand and follow data protection obligations;
• Incident response procedures: to detect, respond to, and mitigate any potential breaches.

Access to your personal data is strictly limited to those who have a legitimate business need to use it for providing our Services. All personnel and authorised third parties are required to process your personal data solely in accordance with our instructions and are bound by strict confidentiality and data protection obligations.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Commission Nationale de l’Informatique et des Libertés (CNIL) and, where applicable, you personally, in accordance with Articles 33 and 34 of the EU General Data Protection Regulation (GDPR).

Limitation of Liability:

Drone by Nature implements industry-standard security measures and continuously monitors the integrity of its systems. However, no online service can guarantee absolute protection against unauthorized access or misuse of data.

Except where prohibited by mandatory law, Drone by Nature shall not be held liable for indirect, consequential, or incidental damages arising from such unauthorized access or data breaches beyond its reasonable control.

While we take all reasonable measures to safeguard your personal data, no system or transmission over the Internet can be guaranteed to be completely secure. You are responsible for maintaining the confidentiality of your login credentials, and any activity performed through your account will be considered your responsibility. If you share a device, always log out after use.

14. Your Legal Rights

Under applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the French Data Protection Act (Loi Informatique et Libertés), and other relevant international data protection frameworks, you have specific rights regarding your personal data and how it is processed.

You may exercise the following rights at any time by contacting us using the details provided in this Privacy Policy:

• Right of access: You have the right to obtain confirmation as to whether we process your personal data and, if so, to access that data and receive a copy.
• Right to rectification: You may request correction or completion of your personal data if it is inaccurate or incomplete.
• Right to erasure (“right to be forgotten”): You may request that we delete your personal data when there is no longer a legal reason for us to retain or process it.
• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on our legitimate interests, including profiling. You also have the right to object to processing for direct marketing purposes.
• Right to restriction of processing: You may request that we limit the processing of your personal data in certain circumstances (for example, while we verify its accuracy or the basis for processing).
• Right to data portability: You may request to receive your personal data in a structured, commonly used, and machine-readable format, or to have it transmitted directly to another controller where technically feasible.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to decide on post-mortem fate of your data: You may provide instructions regarding what should happen to your personal data after your death, within the limits permitted by law.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee or refuse to act on your request if it is manifestly unfounded, repetitive, or excessive.

We may request additional information to confirm your identity before responding to any request to ensure that your personal data is not disclosed to anyone who has no right to receive it.

We aim to respond to all legitimate requests within one month. If your request is particularly complex or if you have made multiple requests, we may take longer to respond. In such cases, we will inform you of the delay and keep you updated.

To exercise your rights, you can contact us:

• By email: support@dronebynature.com
• By post: 17-21 Rue Saint-Fiacre, 75002 Paris, France (please attach a copy of a valid identity document)

Additionally, you may unsubscribe from our newsletter at any time by clicking the unsubscribe link in the email or by contacting us directly.

If you believe that your data protection rights have been infringed, you have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL), the French supervisory authority for data protection (www.cnil.fr), or with your local supervisory authority if you are located in another country. We nonetheless encourage you to contact us first so we can promptly address your concern.

15. Changes to this Privacy Policy

We may update or modify this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the features of our Services and Platform. We recommend that you review this Privacy Policy periodically to stay informed of any updates.

Material changes will be communicated in advance, when legally required.

When we make material changes to this Privacy Policy, we will notify you by posting the updated version on the Platform and, where appropriate, by other means we consider suitable.

Your continued use of our Services or Platform after such updates constitutes your acceptance of the revised Privacy Policy. If you do not agree with any substantial changes, you should discontinue your use of the Services or Platform.

This Privacy Policy supersedes all previous versions and remains effective until replaced by a subsequent update published on the Platform.