Legal · GDPR
Privacy Policy
The Dutch version prevails in case of conflict, except toward consumers, for whom the reading most favourable to them applies (Art. 19 of the Terms).
PRIVACY POLICY: INCUTEC BV
1. Data controller
| Name | Incutec BV |
| Registered office | Stapelhuisstraat 15, 3000 Leuven |
| Company number | 1038.934.039 (KBO, RPR Leuven) |
| contact@opendrone.be |
Incutec BV has not appointed a Data Protection Officer (DPO) because this is not mandatory for its current activities (Art. 37 GDPR).
2. What personal data do we process?
| Category | Data | Purpose |
|---|---|---|
| Order data | Name, address, email, telephone number | Processing and delivery of orders |
| Order attribution | Campaign source (utm parameters), creator code and first page visited, stored with your order in Shopify | Knowing which channels and creators lead to orders |
| Payment data | Payment method, transaction ID | Payment processing (via payment provider) |
| Account data | Email (sign-in with a one-time code via Shopify) | Customer account on the webshop |
| Shared OpenDrone account (opendrone.be and chatfpv.com) | On opendrone.be: your Shopify customer id, when the account was created and last signed in, session start and expiry, the encrypted Shopify sign-in confirmation. On chatfpv.com: a pairwise account id only, and the ChatFPV conversations you have while signed in | One sign-in for opendrone.be and chatfpv.com; keeping your ChatFPV history |
| Communication | Name, email, order number, content of messages and attachments (support tickets) | Customer service, complaint handling |
| Website usage | IP address, browser, pages visited | Website optimisation, security |
| Newsletter | Email, country (derived from IP address) | Marketing communication (only with consent) |
| Trade enquiries | Company and contact name, email, telephone number, shipping and billing address, VAT or EIN number, shop details, requested products | Answering and quoting a shop's wholesale request |
| Discord Early Bird role (only when you claim it) | Your order number and Shopify order id, your Discord user id | Giving the buyer of a preorder the Early Bird role and the #early-birds channel on the OpenDrone Discord server, one Discord account per order |
| ChatFPV assistant (the helper on product pages, the Ask box on /support, reply suggestions for support tickets) | The text you type and ChatFPV's replies; on product pages also the product you are viewing; a salted hash of your IP address (rate limits); your rating of an answer and any note. For a reply suggestion: the question text of your ticket without name, email, telephone number, order data or attachments | Answering product and FPV questions with an AI assistant; suggesting replies to our support staff; improving ChatFPV's answers |
| Owners map (aggregate, no sign-in) | Country and, for the United States, state of the shipping address of paid orders with physical goods, counted once per customer in memory during a refresh. Only the resulting ranges per region are stored, never orders, addresses or counts per customer | Showing where OpenDrone owners are, as a map with ranges |
| Pilot map (optional, signed-in owners) | Your Discord user id and username (read once through Discord sign-in with the identify scope; Discord's access token is revoked at once), the centre of a grid cell of about 10 km (the point you click is snapped on our server and never stored or logged), your Shopify customer id as the key for deletion, the time and version of your consent | Letting owners find each other. Other signed-in owners with a paid order see your Discord username and the 10 km area; everyone else sees only how many pilots are listed |
3. Legal bases (Art. 6 GDPR)
| Processing | Legal basis |
|---|---|
| Execution of the order | Necessary for performance of a contract (Art. 6.1.b) |
| Payment processing | Necessary for performance of a contract (Art. 6.1.b) |
| Invoicing and bookkeeping | Legal obligation (Art. 6.1.c: VAT legislation, accounting law) |
| Customer service | Legitimate interest (Art. 6.1.f) |
| ChatFPV answers in the helper and the Ask box | Legitimate interest (Art. 6.1.f): answering product and FPV questions without a staff member for every message |
| Unanswered questions, ratings and correction notes used to improve ChatFPV | Legitimate interest (Art. 6.1.f); you can object at any time |
| Website analytics | Legitimate interest (Art. 6.1.f): improving the website and measuring which channels and creators lead to orders; cookieless, no persistent identifier |
| Order attribution and purchase statistics | Legitimate interest (Art. 6.1.f); you can object at any time via privacy@opendrone.be |
| Newsletter | Consent (Art. 6.1.a) |
| Trade enquiries | Steps taken at the request of the enquirer before entering into a contract (Art. 6.1.b) |
| Discord Early Bird role | Consent (Art. 6.1.a): you start the claim and choose the Discord account |
| Fraud / abuse prevention | Legitimate interest (Art. 6.1.f) |
| Shared OpenDrone account and ChatFPV history | Necessary for performance of a contract (Art. 6.1.b) |
| Owners map (aggregate) | Legitimate interest (Art. 6.1.f): showing the community's reach. A country or US state is published as a range (1-4, 5-9 and up), never as an exact count, so no individual can be identified |
| Pilot map | Consent (Art. 6.1.a): an unticked box with the wording you see, plus your confirmation that you are 16 or older. You can withdraw on the pilot map at any time, which deletes the entry at once |
4. Retention periods
| Data | Retention period |
|---|---|
| Order and invoice data | 10 years from 1 January after the close of the financial year (Art. III.86 WER; Art. 60 §4 VAT Code) |
| Order attribution on the order | Kept with the order data |
| Customer account | Until deleted at your request, at the latest 3 years after your last sign-in or order |
| Customer service communication (support tickets on the site, in Discord and the ticket reference on your Shopify customer record) | 24 months after the ticket is closed, then deleted automatically. A ticket we answered closes after 30 days without a reply from you, any other ticket after 90 days without activity |
| Website log files | 6 months |
| Shared account sign-in sessions | 30 days after your last visit, or until you sign out; then deleted automatically |
| Sign-in codes and sign-in cookies for chatfpv.com | 60 seconds (codes), 10 minutes (sign-in cookie); deleted automatically after expiry |
| ChatFPV conversations made while signed in | 12 months after the last message in the conversation; earlier when you delete them or your customer account is deleted |
| Shared OpenDrone account (the opendrone.be account record and the ChatFPV account id) | 3 years after your last sign-in; earlier when your customer account is deleted |
| Newsletter subscription | Until unsubscribed |
| Trade enquiries without an order | 2 years after the last contact |
| Early Bird claim (order id and number with the Discord user id) | Until you ask us to delete it via privacy@opendrone.be; the role on your Discord account can be removed at the same time |
| ChatFPV conversations in the helper and the Ask box, with ratings | 90 days after the last message in the conversation |
| ChatFPV reply suggestions for a support ticket | 24 months after the last message in the ticket; the staff reply stays, without your text |
| Unanswered questions copied to improve ChatFPV (no link to who asked) | 90 days after the question was last asked |
| Your text copied into a proposed ChatFPV correction | 24 months, then deleted; the knowledge change stays without your text |
| Prompts and replies at Google (Gemini API) | 55 days for abuse monitoring (30 days for Google Search grounding), by Google |
| Owners map (published ranges per region, no personal data) | Replaced at the latest every 30 days by the next refresh |
| Pilot map entry | Until you withdraw, or 24 months after your consent unless you confirm again, or when your customer data is erased or your account is deleted after 3 years without sign-in |
5. Recipients / processors
| Recipient | Purpose | Location |
|---|---|---|
| Shopify International Limited | Webshop platform: catalog, cart, checkout, orders, customer accounts, order and shipping notifications, newsletter consent, and a reference to your support tickets on your customer record | Ireland (EU); transfers to Shopify Inc. in Canada rely on the EU adequacy decision for Canada, other transfers on SCCs; Shopify's privacy policy: https://www.shopify.com/legal/privacy |
| Shopify Payments, processed by Stripe Payments Europe, Ltd. | Payment processing for the payment methods shown at checkout: payment data, email, billing address; device data for fraud prevention | 1 Grand Canal Street Lower, Dublin 2, Ireland (EU); Stripe's privacy policy: https://stripe.com/privacy |
| bpost NV/SA | Parcel delivery and shipping labels for parcels sent from Belgium to EU addresses | Belgium (EU) |
| Fulfilment partner that packs and ships preorder goods | Packing and dispatch of preorder batch goods sent directly to the customer | Inside or outside the EEA, depending on the batch: see "Shipping data" below |
| Other carriers | Delivery of parcels to destinations outside the EU and of parcels sent by the fulfilment partner | The carrier's network and the destination country: see "Shipping data" below |
| Customs brokers, and carriers acting as customs agent | Customs clearance of deliveries to the United States with import duties included in the price (Article 7ter.6 of the terms) | United States: see "Shipping data" below |
| Judge.me | Review requests after delivery and publication of reviews: name, email, ordered products, review text | Judge.me's privacy policy: https://judge.me/privacy |
| Google Workspace (Google Ireland Ltd.) | Company mailboxes, staff email and sign-in | Ireland (EU); Google's standard contractual clauses cover any transfer outside the EEA |
| Plausible Analytics | Cookieless website statistics on opendrone.be, and one purchase event per order from the order confirmation page on checkout.opendrone.be (order value, currency, campaign source, creator code); IP address and browser are used only to compute a daily changing visitor code and are not stored; only aggregated statistics are kept. Data processing agreement: https://plausible.io/dpa | Plausible Insights OÜ, Estonia (EU); hosting in Germany |
| Polar Advisory BV (accountant) | Invoicing and annual accounts | Belgium |
| Resend (Plus Five Five, Inc.) | Mail sent by opendrone.be: withdrawal confirmations, welcome and newsletter mail, trade requests, notices of a new reply on a support ticket (link only, no message content) | EU region infrastructure; US legal entity: SCCs |
| Discord Inc. (processor) | Support tickets: our team reads and answers them in a staff-only Discord channel (your first name, email, order number and order details, messages, attachments) | US: EU-US Data Privacy Framework (Art. 45 GDPR); Discord's processor terms: https://support.discord.com/hc/en-us/articles/37891902561687 |
| Cloudflare, Inc. | Hosting and delivery of the website (IP address, request data, derived country); storage of support tickets and of anti-abuse counters (Cloudflare D1; counters hold a keyed hash of IP address and email, never the values, and are deleted after at most two days); Turnstile anti-spam on the newsletter, trade and support forms; running ChatFPV at chatfpv.com, which also answers in the helper and the Ask box (Workers, conversations in D1, the knowledge base in Vectorize, a fallback AI model in Workers AI that does not train on your content) | US: EU-US Data Privacy Framework (Art. 45 GDPR); SCCs (Art. 46 GDPR) in Cloudflare's data processing addendum for any transfer the Framework does not cover |
| Google (Gemini API, paid tier) | Writing ChatFPV answers and reply suggestions from your question, the conversation so far and retrieved source text; Google Search grounding for answers and for researching unanswered questions. On the paid tier Google does not use prompts or replies to improve its products; it keeps them for 55 days only to detect abuse (30 days for Search grounding) | United States and other Google locations: EU-US Data Privacy Framework (Art. 45 GDPR) and SCCs (Art. 46 GDPR) in Google's processor terms |
| European Commission (VIES) | Check of the VAT number given in a trade enquiry | EU |
Order and customer data (name, address, email, payment reference, order history) and newsletter consent are processed in Shopify.
Shipping data. To deliver an order, we share your name, delivery address and telephone number, and the contents and value of the parcel, with the fulfilment partner, the carrier and, where customs clearance is needed, the customs agent, each only as far as it needs them. The legal basis is the performance of the contract (Art. 6.1.b GDPR). Where one of them is established outside the EEA, the transfer relies on standard contractual clauses (Art. 46 GDPR) or, where the transfer is necessary for the performance of your contract, on Art. 49.1.b GDPR.
ChatFPV. ChatFPV is an AI assistant for FPV and OpenDrone product questions, run by Incutec BV at chatfpv.com. Its replies are machine-generated and can be wrong: check the sources it cites. On opendrone.be it appears in two places. The helper in the corner of product pages is chatfpv.com loaded inside the page: your question and the product you are viewing go to chatfpv.com exactly as you type them, and chatfpv.com keeps a random conversation id in your browser's local storage (no name, no account). The Ask box on /support sends your question through opendrone.be, which first removes email addresses, phone numbers, card numbers, IBANs and similar identifiers, but not names or order numbers: leave those out. When our staff answer a support ticket, ChatFPV can suggest a reply from the ticket's question, without your name, email, telephone number, order data or attachments; a staff member decides what is sent. A question ChatFPV could not answer is copied, without who asked it and after email addresses, phone numbers and order numbers are removed, into a list our staff use to add missing knowledge; a rating note can become a proposed correction. You can object to this use via privacy@opendrone.be. ChatFPV's own privacy notice, with the cookies and browser storage chatfpv.com uses: https://chatfpv.com/privacy
Discord. The OpenDrone community server runs on Discord. Discord Inc. is an independent controller for the community server you choose to join. For support tickets, Discord Inc. processes the ticket on our behalf as a processor (table above); you do not need a Discord account to open a ticket. Discord's privacy policy: https://discord.com/privacy If you claim the Early Bird role, you authorise our Discord application on discord.com; we record which Discord user id claimed which order (Cloudflare D1), and our bot gives that account the role and adds it to the server if it is not a member yet. No name, email, address or order content goes to Discord.
Shared sign-in with chatfpv.com. chatfpv.com, the ChatFPV FPV assistant, is also run by Incutec BV. When you sign in to chatfpv.com with your OpenDrone account, opendrone.be confirms your sign-in to chatfpv.com with a separate account id that only chatfpv.com receives. chatfpv.com receives no name, email address or Shopify customer id. Shopify access tokens are discarded right after sign-in; opendrone.be keeps only the Shopify sign-in confirmation (ID token), encrypted, to end your Shopify session when you sign out. When chatfpv.com checks whether you are already signed in (silent sign-in), opendrone.be sets no cookie and stores nothing for a visitor who is not signed in.
Transfers outside the EEA. Some recipients process data outside the EEA. Those transfers rely on an adequacy decision (Art. 45 GDPR: Canada, UK, or the EU-US Data Privacy Framework for certified US recipients) or on standard contractual clauses (Art. 46 GDPR, Decision 2021/914). Shipping data for a delivery can also be transferred because the transfer is necessary for the performance of your contract (Art. 49.1.b GDPR). The basis per recipient is in the table above.
6. Rights of the data subject
You have the right to:
- Access your personal data (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure of your data ("right to be forgotten") (Art. 17)
- Restriction of processing (Art. 18)
- Object to processing based on legitimate interest (Art. 21). You may object to processing for direct marketing at any time and free of charge; we then stop that processing immediately (Art. 21.2-21.3)
- Portability of your data (Art. 20)
- Withdraw your consent (Art. 7.3)
Signing in creates a Shopify customer account. Signing in with your OpenDrone account, on opendrone.be or from chatfpv.com, uses Shopify customer accounts: Shopify sends a one-time code to your email address. If you have no customer account yet, Shopify creates one that holds your email address. We add nothing else to it: no newsletter or marketing consent, no tags or notes and no ChatFPV content.
Your ChatFPV history. Signed in on opendrone.be, the account page (opendrone.be/account) lets you export your ChatFPV conversations as a JSON file or delete them at once. When your customer account is deleted in Shopify, your OpenDrone account data and your ChatFPV history are deleted with it. You can also ask privacy@opendrone.be to erase or export them; we do so within one month, without waiting for Shopify.
Requests can be sent to: privacy@opendrone.be We respond to your request within one month (Art. 12(3) GDPR), extensible by a further two months for complex or numerous requests.
7. Complaints
You have the right to file a complaint with the Belgian Data Protection Authority (GBA):
| Address | Drukpersstraat 35, 1000 Brussels |
| Phone | +32 (0)2 274 48 00 |
| Website | https://www.gegevensbeschermingsautoriteit.be |
| contact@apd-gba.be |
You may also lodge a complaint with the supervisory authority of your place of residence or work within the EU, if you do not reside in Belgium (Art. 77 GDPR). This includes complaints about ChatFPV.
8. Security
Incutec BV takes appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction:
- SSL/TLS encryption on the website
- Access control (need-to-know basis)
- Regular backups
9. Automated decision-making
Incutec BV does not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR. Every order is processed and, where needed, reviewed by a staff member. ChatFPV's answers are generated automatically but decide nothing about you, and a reply to a support ticket is always sent by a staff member.
Whether providing data is required. Name, address, email and payment details are needed to fulfil an order; without them no contract can be concluded. Invoicing data must be retained by law. All other data (phone number, newsletter, account details) is optional.
Copy of safeguards. A copy of the standard contractual clauses or the DPF certification covering the transfers in section 5 can be requested via privacy@opendrone.be.
10. Data breaches
In the event of a data breach presenting a risk to your rights and freedoms, we are obliged to notify the Belgian Data Protection Authority (GBA) within 72 hours (Art. 33 GDPR). If the breach is likely to result in a high risk to your rights and freedoms, we will inform you personally as soon as possible in accordance with Art. 34 GDPR.
11. Amendments
Incutec BV may amend this privacy policy. The most recent version is always available at opendrone.be/privacy. Customers and newsletter subscribers are notified by email of material changes.