Privacy Policy
Last updated: March 2026
SAD is committed to protecting your privacy and processing your personal data with full transparency, in accordance with EU Regulation 2016/679 (General Data Protection Regulation — GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD).
1. Data controller
2. Personal data we collect
We collect the following data depending on how you interact with the Website:
When placing an order:
- Full name
- Email address
- Phone number
- Complete shipping address (street, city, province, postcode, country)
- Order reference and selected payment method (bank transfer or Bizum)
When creating a customer account:
- Email address and password (stored as a secure hash, never in plain text)
- Full name (optional on the profile)
When browsing the Website:
- Technical browsing data necessary for the site to function (essential session cookies; see our Cookie Policy)
We do not collect sensitive payment data (credit/debit cards). Payments are made by direct bank transfer or Bizum; SAD does not access any banking details beyond confirming receipt.
3. Purposes of processing
We process your data for the following purposes:
- Order management: Processing, managing, and dispatching your orders. Legal basis: performance of a contract (Art. 6.1.b GDPR).
- Customer account management: Creating and maintaining your account, order history, and saved addresses. Legal basis: performance of a contract (Art. 6.1.b GDPR).
- Order communications: Sending order confirmations, status updates, and shipping notifications. Legal basis: performance of a contract (Art. 6.1.b GDPR).
- Legal compliance: Retaining documentation required by tax, commercial, and e-commerce regulations. Legal basis: legal obligation (Art. 6.1.c GDPR).
- Service improvement: Aggregated analysis of website performance to improve user experience. Legal basis: legitimate interest (Art. 6.1.f GDPR).
- Commercial communications: Sending product or promotional information only if you have given express consent. Legal basis: consent (Art. 6.1.a GDPR).
4. Retention periods
| Data type | Retention period |
|---|
| Order and customer data | Duration of commercial relationship + 5 years (statute of limitations) |
| Tax and accounting records | 4 years (Spanish General Tax Law) |
| Consent for commercial communications | Until consent is withdrawn |
| Session cookies | See Cookie Policy |
Once the stated periods have elapsed, data will be securely deleted or anonymised.
5. Recipients of data
Your data may be shared with the following third parties, only to the extent necessary to provide the service:
- Shipping and courier companies: For order delivery (name, delivery address, contact phone number).
- Hosting provider: Railway (website hosting infrastructure). See their privacy policy at railway.app.
- Transactional email provider: For sending order confirmations and notifications.
We do not transfer personal data outside the European Economic Area, unless providers have adequate safeguards as set out in the GDPR (adequacy decisions, standard contractual clauses, etc.).
We do not sell or share your personal data with third parties for advertising or commercial purposes.
6. Your rights
Under the GDPR, you may exercise the following rights at any time:
- Access: Obtain confirmation of whether we process your data and receive a copy.
- Rectification: Correct inaccurate or incomplete data.
- Erasure ("right to be forgotten"): Request deletion of your data when it is no longer necessary for the purposes for which it was collected.
- Restriction of processing: Request that we suspend processing of your data in certain circumstances.
- Data portability: Receive your data in a structured, commonly used format.
- Objection: Object to processing based on legitimate interest or for direct marketing purposes.
- Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time without retroactive effect.
How to exercise your rights: Send an email to privacidad@spanish-advanced-drones.com stating the right you wish to exercise and enclosing a copy of your identity document.
We will respond within a maximum of 1 month of receiving your request.
Right to lodge a complaint: If you believe that processing of your data infringes data protection law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
7. Security
SAD implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:
- Encrypted communications via HTTPS/TLS.
- Passwords stored as secure hashes (never in plain text).
- Data access restricted to authorised personnel only.
- Infrastructure hosted with providers holding recognised security certifications.
8. Cookies
The Website uses essential technical cookies for its operation (session, cart, language preference). See our Cookie Policy for more information.
9. Amendments to this policy
SAD may update this Privacy Policy to reflect legislative changes or service updates. We will publish the updated version on the Website with the date of last modification. If the changes are significant, we will notify you by email.