Privacy Policy

1. Data controller

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), and with Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (the "LOPDGDD"), users are informed of the following details regarding the data controller:

• Controller: EHang Technologies S.L.
• Trade name: PintaSky
• Tax ID (NIF): B88286141
• Address: Calle Castillo de Antequera, 86, 28692 Villanueva de la Cañada, Madrid, Spain.
• Email: info@pintasky.com
• Website: www.pintasky.com

Hereinafter, PintaSky.

2. Purpose of this Privacy Policy

This Privacy Policy is intended to inform, in a clear, transparent and understandable manner, about how PintaSky collects, uses, retains and protects the personal data of people who:

• visit www.pintasky.com;
• request information about PintaSky's services;
• contact PintaSky through forms, email, phone or other available channels;
• request quotes or commercial proposals;
• contract or maintain a business relationship with PintaSky;
• represent companies, bodies, agencies, institutions or entities that are clients or potentially interested in PintaSky's services;
• maintain business or professional relationships with PintaSky;
• request to receive commercial communications, where this option is available; or
• otherwise interact with PintaSky in a way that involves the processing of personal data.

PintaSky will process personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality and proactive accountability established under data protection law.

3. What personal data may we process?

Depending on the relationship maintained with PintaSky and the channel used, the following categories of data may be processed:

3.1. Identification data

For example:

• first name;
• surname;
• company or entity represented;
• job title or professional role.

3.2. Contact data

For example:

• email address;
• phone number;
• postal address, where necessary;
• other contact details provided by the data subject.

3.3. Professional and business data

Where the data subject acts on behalf of a company, agency, institution, public administration, production company, event organizer or other entity, the following data may be processed:

• company or entity;
• job title;
• department;
• relationship with the organization;
• professional information necessary to manage the business relationship.

3.4. Data related to enquiries and projects

When a user requests information or a quote for a show or project, the data necessary to analyze and manage that request may be processed, such as:

• planned venue for the event;
• planned date or dates;
• characteristics of the show;
• approximate number of drones;
• type of event;
• technical requirements;
• data relating to the organizer;
• information necessary to prepare a commercial proposal;
• communications and information exchanged during the project.

3.5. Financial and billing data

Where a contractual relationship exists, the data necessary for administrative, contractual, accounting and tax management may be processed, including:

• billing data;
• bank details where necessary;
• payment information;
• contractual information.

3.6. Technical and browsing data

When the user accesses the website, certain technical data may be processed, depending on the site's configuration and the technologies used, such as:

• IP address;
• device type;
• browser;
• operating system;
• date and time of access;
• pages visited;
• technical browsing information;
• identifiers associated with cookies or similar technologies.

The use of cookies and similar technologies is specifically governed by PintaSky's Cookie Policy.

4. How do we obtain personal data?

PintaSky may obtain personal data directly from the data subject when they:

• fill in a form on the website;
• send an email;
• contact PintaSky by phone;
• request information;
• request a quote;
• initiate a commercial negotiation;
• contract a service;
• participate in a project;
• hand over a business card or voluntarily provide their data in a professional context;
• interact with PintaSky through social media or other corporate channels; or
• maintain any other professional or business relationship with PintaSky.

In certain cases, data may be provided by the company, entity, agency, institution or organization for which the data subject works or which they represent, provided there is a legal basis allowing such processing.

Likewise, certain technical data may be obtained automatically while browsing the website through cookies and similar technologies, when these are used and in accordance with the preferences configured by the user.

5. What do we process your personal data for?

PintaSky may process personal data for the purposes described below.

5.1. Handling enquiries and information requests

Data may be used to:

• respond to enquiries;
• provide information about our services;
• resolve questions;
• handle requests received through the website, email, phone or other contact channels.

5.2. Preparing and managing quotes and commercial proposals

When a user requests information about a potential show or project, their data may be used to:

• analyze the project's requirements;
• assess its initial feasibility;
• request additional information;
• prepare quotes;
• prepare commercial proposals;
• maintain communications prior to a possible contract;
• follow up on the request.

5.3. Managing contracting and service delivery

Where a contractual relationship exists, data will be processed to:

• formalize the contract;
• manage the relationship with the client;
• plan and execute the project;
• manage technical, administrative and operational aspects;
• coordinate the necessary work;
• maintain communications relating to the service;
• handle incidents;
• carry out billing and manage collections and payments;
• comply with obligations arising from the contract.

5.4. Managing administrative and operational project requirements

Due to the nature of PintaSky's services, certain projects may require procedures, communications, coordination or requests with:

• aeronautical authorities;
• airport operators;
• air navigation service providers;
• public administrations;
• police and security forces;
• local councils;
• owners or operators of venues;
• bodies responsible for airspace;
• authorities or equivalent bodies in other countries.

Where necessary for the preparation, authorization, coordination or execution of a project, PintaSky may process and, where a legal basis allows it, disclose the data strictly necessary for those purposes.

5.5. Administrative, accounting, tax and legal management

Data may be processed for:

• billing;
• accounting;
• managing collections and payments;
• compliance with tax obligations;
• compliance with commercial-law obligations;
• audits;
• contract management;
• handling and defending against claims;
• compliance with other legal obligations applicable to PintaSky.

5.6. Maintaining professional and business relationships

Where the data subject acts on behalf of a company or entity, PintaSky may process their professional data to manage and maintain the corresponding business or professional relationship.

5.7. Sending commercial communications

PintaSky may send commercial information about its services, projects, news, activities or content related to its business when:

• the data subject has expressly given their consent; or
• a prior contractual relationship exists and the legal requirements for informing about similar own products or services to those previously contracted are met.

The recipient may request at any time that these communications cease, through the mechanism included in each communication or by writing to info@pintasky.com.

5.8. Security and proper functioning of the website

Certain technical data may be processed to:

• ensure the security of the website;
• detect fraudulent or malicious use;
• prevent cyberattacks;
• diagnose technical errors;
• protect PintaSky's systems, users and technological infrastructure.

5.9. Analysis and measurement of website usage

Where analytics tools requiring consent are used, the data associated with them will only be processed after the user has given consent through the cookie management system.

The user may withdraw or modify that consent as set out in the Cookie Policy.

6. What is the legal basis for processing?

The legal basis will depend on the specific purpose of the processing.

Handling enquiries

Where an enquiry is intended to request general information, the legal basis may be PintaSky's legitimate interest in handling and managing the communications received.

Where the enquiry relates to a request for a quote, contracting or possible contracting of services, the legal basis will be the application of pre-contractual measures at the data subject's request.

Quote requests and commercial proposals

The legal basis will be the application of pre-contractual measures requested by the data subject and, where applicable, the performance of a contract.

Provision of services

The legal basis will be the performance of the contract entered into with the client.

Administrative, tax and accounting management

The legal basis will be compliance with the legal obligations applicable to PintaSky

Data of company representatives and contact persons

Where professional data of individuals providing services to a legal entity is processed, the legal basis may be the legitimate interest in managing and maintaining business and professional relationships between organizations, in accordance with applicable regulations.

Commercial communications

Where the data subject has expressly requested to receive communications, the legal basis will be their consent.

Where a prior contractual relationship exists and the requirements established by applicable law for sending information about similar own services to those contracted are met, the processing may be based on PintaSky's legitimate interest, without prejudice to the recipient's right to object at any time.

Cookies and non-necessary technologies

Where a given cookie or technology requires consent, the legal basis will be the user's consent.

Website security

The processing of information strictly necessary to ensure the security of the systems may be based on PintaSky's legitimate interest in protecting its technological infrastructure, its services, its information and its users.

7. Is it mandatory to provide the data?

Fields marked as mandatory in forms must be completed in order to properly process the corresponding request.

The user must provide truthful, accurate, complete and up-to-date information.

Refusal to provide the data that are necessary may prevent PintaSky from:

• adequately responding to an enquiry;
• preparing a quote;
• assessing a project;
• formalizing a contract; or
• providing certain services.

Users must not provide the personal data of third parties unless they have sufficient legitimation to do so and, where necessary, have previously informed those persons about the disclosure of their data.

8. How long will we keep the data?

Data will be kept only for as long as necessary to fulfil the purpose for which it was obtained. In general:

Enquiries and information requests: kept for as long as necessary to respond to and reasonably follow up on the request.

Quote requests or projects that are not contracted: kept for as long as necessary to manage the proposal and, subsequently, for the period strictly necessary to address potential liabilities or maintain the business record where there is a legal basis for doing so.

Clients and contracted projects: data will be kept for the duration of the contractual relationship and, once it ends, will remain duly blocked for the periods legally established to address potential liabilities.

Accounting, tax and commercial-law information: kept for the periods required by applicable law.

Commercial communications based on consent: data will be processed until the data subject withdraws their consent or requests to stop receiving such communications.

Data processed through cookies: kept in accordance with the periods set out in the corresponding Cookie Policy.

When data is no longer necessary for the corresponding purpose, it will be deleted or anonymized or, where legally necessary, will remain duly blocked for the statutory limitation periods of any liabilities that may arise from the processing.

9. Who may the data be disclosed to?

In general, PintaSky will not disclose personal data to third parties except where there is a legal basis allowing it or it is necessary for the proper provision of services. Data may be disclosed, where applicable, to:

• public administrations;
• judicial authorities;
• tax authorities;
• aeronautical authorities;
• police and security forces;
• regulatory bodies;
• financial institutions;
• legal, tax or accounting advisors;
• auditors;
• insurance companies;
• providers or collaborators necessary for the execution of a project;
• venue or facility operators;
• air navigation providers;
• authorities and bodies competent in airspace matters;
• any other recipients where there is a legal obligation or it is necessary for the performance of a contract.

In all cases, disclosure will be limited to the data strictly necessary for the corresponding purpose.

10. Providers that process data on behalf of PintaSky

PintaSky may engage external providers for certain functions necessary for its business, such as:

• web hosting;
• technological maintenance;
• email services;
• cloud storage;
• business management systems;
• communication tools;
• CRM systems;
• administrative services;
• advisory services;
• web analytics;
• IT security;
• other technological or business services.

Where these providers access personal data on behalf of PintaSky, they will act as data processors and the relationship will be governed by the corresponding contract or legal instrument under Article 28 of the GDPR.

PintaSky will require these providers to offer adequate guarantees regarding privacy, confidentiality and security.

11. International data transfers

Due to the international nature of PintaSky's activity and the possible use of certain technology providers, some processing activities may involve transfers of data outside the European Economic Area (EEA).

Where an international transfer of personal data takes place, PintaSky will adopt the safeguards required by the GDPR, which may be based, as applicable, on:

• an adequacy decision adopted by the European Commission;
• standard contractual clauses approved by the European Commission;
• binding corporate rules;
• legally recognized international transfer frameworks; or
• any of the other mechanisms provided for in Articles 44 et seq. of the GDPR.

Where applicable, data subjects may request additional information about the applicable safeguards by writing to info@pintasky.com.

The specific use of providers involving international transfers will be reflected, where applicable, in this Privacy Policy or in the Cookie Policy.

12. International communications related to projects

Since PintaSky provides services both in Spain and internationally, certain projects carried out outside the European Economic Area may require communications with clients, collaborators, authorities, bodies or providers located in third countries.

Where such communications involve an international transfer of personal data, this will only take place where a valid legal basis exists and the requirements set out in applicable data protection law are met.

In these cases, PintaSky will limit the processing and disclosure of data to what is necessary to manage, coordinate or execute the corresponding project.

13. Rights of data subjects

Data subjects may exercise the rights recognized under data protection law.

Right of access

Allows the data subject to find out whether PintaSky is processing their personal data and to obtain information about that processing.

Right of rectification

Allows the data subject to request the correction of data that is inaccurate or incomplete.

Right of erasure

Allows the data subject to request the deletion of their data where the legally established requirements are met.

Right to object

Allows the data subject to object to the processing of data based on certain legal grounds, including, in particular, the use of data for direct marketing purposes.

Right to restriction of processing

Allows the data subject to request that processing be restricted in certain circumstances established by law.

Right to portability

Where applicable, allows the data subject to receive the personal data they provided in a structured, commonly used and machine-readable format, and to request its transmission to another controller where technically feasible.

Right to withdraw consent

Where processing is based on consent, the data subject may withdraw it at any time. Withdrawing consent will not affect the lawfulness of processing carried out prior to the withdrawal.

Right not to be subject to certain automated decisions

In the cases provided for by law, the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

14. How can these rights be exercised?

Data subjects may exercise their rights by sending a request to:

PintaSky
Calle Castillo de Antequera, 86
28692 Villanueva de la Cañada
Madrid, Spain

or by email to info@pintasky.com.

The request must sufficiently identify the data subject and clearly indicate the right they wish to exercise.

Where there are reasonable doubts about the identity of the person making the request, PintaSky may request additional information strictly necessary to verify their identity.

The exercise of these rights is free of charge, except in the exceptional cases provided for by law where requests are manifestly unfounded or excessive, in particular because of their repetitive nature.

PintaSky will handle requests within the time limits established by applicable law.

15. Complaints to the supervisory authority

If the data subject considers that PintaSky has processed their personal data in breach of data protection law, they may lodge a complaint with the competent supervisory authority. In Spain, the supervisory authority is:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid
Spain
www.aepd.es

Notwithstanding the above, it is recommended to first contact PintaSky at info@pintasky.com to try to resolve any issue relating to the processing of personal data.

16. Commercial communications and right to object

Where PintaSky sends commercial communications by electronic means, the recipient may request at any time to stop receiving them.

Each commercial communication will include, where legally required, a simple and accessible mechanism to exercise this right. Users may also request to unsubscribe by sending an email to info@pintasky.com.

An unsubscribe request from commercial communications will not affect communications that are necessary to:

• handle a request;
• perform a contract;
• provide a service;
• manage a project; or
• comply with legal obligations.

17. Automated decisions and profiling

PintaSky will not make decisions producing legal effects or significantly affecting the data subject based solely on automated processing of their personal data, unless the circumstances and safeguards established by law are met.

Should such systems be implemented in the future, data subjects will be informed beforehand in accordance with the requirements of the GDPR.

18. Data of minors

PintaSky's services are mainly aimed at companies, entities, institutions, agencies, organizations and adults interested in contracting shows and professional services.

PintaSky does not intend to deliberately collect personal data from minors through the website.

If a minor provides personal data without the legally required authorization of their parents, guardians or legal representatives, these may request its deletion by writing to info@pintasky.com.

19. Data of third parties

Where a user provides PintaSky with personal data relating to another person, they will be responsible for having a sufficient legal basis to do so and for having complied, where necessary, with the corresponding duty to inform that person.

The user undertakes to provide only such third-party data as is adequate, relevant and necessary for the corresponding purpose.

20. Special categories of data

PintaSky does not generally request through its website data belonging to special categories, such as information relating to:

• health;
• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic data;
• biometric data intended to uniquely identify a person; or
• sex life or sexual orientation.

Users must refrain from providing this type of information unless strictly necessary and where an appropriate legal basis exists for its processing.

21. Security of personal data

PintaSky will adopt appropriate technical and organizational measures to protect personal data against risks such as:

• unauthorized access;
• alteration;
• loss;
• destruction;
• unauthorized disclosure;
• unlawful or accidental processing.

Security measures will be established taking into account factors such as:

• the nature of the data;
• the purpose of processing;
• the state of the art;
• existing risks;
• the likelihood and impact of such risks.

However, no technological system connected to the Internet can guarantee absolute security. For this reason, PintaSky will review and adapt its security measures whenever necessary.

22. Confidentiality

Persons who, under the authority of PintaSky, have access to personal data must maintain due confidentiality regarding such information.

This duty of confidentiality will continue even after the professional, employment or contractual relationship that allowed access to the data has ended.

23. Social media

PintaSky may maintain corporate profiles on social networks and third-party platforms.

When a user interacts with PintaSky's official profiles, data made public by the user or provided through the corresponding platform may be processed.

Processing carried out directly by PintaSky will be for the purpose of:

• handling enquiries;
• responding to messages;
• managing interactions;
• informing about PintaSky's services and activities;
• managing its corporate presence on social media.

The relevant platforms will also carry out their own data processing in accordance with their respective privacy policies and terms of use, over which PintaSky has no general control.

Users are advised to review the settings and privacy policies of each platform.

24. Cookies

The website www.pintasky.com may use its own and third-party cookies or other similar technologies.

Strictly necessary cookies may be used to enable the proper functioning of the website.

Where analytical, advertising, personalization cookies or other technologies requiring consent are used, they will not be activated until the user has given consent through the system enabled for that purpose.

Full information regarding:

• cookies used;
• purpose;
• provider;
• duration;
• possible international transfers; and
• mechanisms to accept, reject or configure cookies,

is available in PintaSky's Cookie Policy.

25. Links to third-party pages

The website may contain links to sites, services or platforms managed by third parties.

PintaSky does not control the privacy policies or the processing carried out directly by such third parties.

When the user leaves www.pintasky.com via an external link, they should review the privacy policy of the corresponding website or platform before providing personal data.

26. Accuracy and updating of data

The user guarantees that the personal data provided is truthful, accurate, complete and up to date.

Where any relevant change occurs, the data subject must notify PintaSky so that the information remains correctly updated.

PintaSky may request, where reasonably necessary, the updating or confirmation of certain information.

27. Changes to this Privacy Policy

PintaSky may modify this Privacy Policy when necessary, among other reasons, due to:

• legislative or regulatory changes;
• new criteria from data protection authorities;
• case-law changes;
• the addition of new services;
• the implementation of new technological tools;
• changes to the purposes of processing;
• organizational changes at PintaSky.

Where the changes are relevant to the rights of data subjects, reasonable measures will be taken to inform them.

The version in force will be the one published at any given time at www.pintasky.com.

28. Contact regarding data protection

For any query relating to this Privacy Policy or to the processing of personal data carried out by PintaSky, you can contact:

PintaSky
Calle Castillo de Antequera, 86
28692 Villanueva de la Cañada
Madrid, Spain
Email: info@pintasky.com
Website: www.pintasky.com