Privacy Policy

Who is responsible for your data

The controller of your personal data is the seller:

No data protection officer has been appointed; the law does not require one for this activity. Write to the e-mail address above for anything concerning your data.

Last updated: 7 November 2026 (version 2026-11-07.2). You can read this policy before you enter any personal data: it is linked from every page footer and from the order dialog.

What data we process and where it comes from

We process only what the sale and the law require, plus analytics if you consent. Everything below was checked against the code of this shop, not assumed.

1. 01E-mail address — entered by you in the order dialog; used to deliver the Ebook, the order confirmation, the invoice and any correspondence.
2. 02Name and billing address (street, apartment, postcode, city, country) — entered by you on the Stripe payment page, where they are mandatory; printed on the invoice, and the country decides the VAT treatment.
3. 03Payment card details — entered on the Stripe payment page and processed by Stripe only. We never see or store your card number; we receive a payment reference, the payment status and the country in which the card was issued.
4. 04IP address of the device you order from, and the country derived from it — recorded when you place the order, as evidence of where you were when buying (an EU VAT rule requires it, see section 3).
5. 05Your withdrawal-right consents — the two boxes you tick, the time you ticked them, the IP address, the version of the wording you saw and your browser language.
6. 06Order and invoice records — order number, invoice number, amounts, VAT figures, the exchange rate used, dates, the Stripe payment reference, download-link use (when and how many times).
7. 07Correspondence — anything you send to contact@takedroneseasy.com, including complaints and withdrawal statements.
8. 08Analytics identifiers — only if you click "Accept" in the cookie banner: a random visitor identifier stored in a cookie by Google Analytics 4 (loaded through Google Tag Manager), pages viewed, approximate location, device and browser type. If you reject or do not answer, nothing from Google is loaded.

Why we process it and on what legal basis

1. 01Performing the contract of sale and delivering the Ebook, sending the order confirmation and re-sending download links — art. 6(1)(b) GDPR (contract). Data: e-mail, name, address, order records.
2. 02Telling you about and sending you a corrected edition of the Ebook under the promise in section 3 of the Terms of Sale — art. 6(1)(b) GDPR (contract). Data: e-mail, order records. This is performance of the contract, so it needs no consent and puts you on no marketing list; if your e-mail address has been erased at your request (section 7), we cannot reach you this way.
3. 03Issuing, storing and reporting invoices and VAT — art. 6(1)(c) GDPR (legal obligation), the obligation being art. 106b and 106e ustawy o VAT (content of the invoice), art. 112 and 112a ustawy o VAT and art. 86 § 1 Ordynacji podatkowej (keeping the records until the tax liability is time-barred). Data: name, address, country, amounts, invoice records. Because this rests on a legal obligation, there is nothing to withdraw and erasure can be refused for the retention period (section 6).
4. 04Establishing where you were when you bought (place of supply for VAT) — art. 6(1)(c) GDPR; the obligation is art. 28k ustawy o VAT with art. 24b and 24f of Council Implementing Regulation (EU) No 282/2011, which require evidence such as the billing address, the card-issuer country and the IP address. Data: billing country, card-issuer country, IP address and IP country.
5. 05Proving that you requested immediate delivery and acknowledged the loss of the right of withdrawal — art. 6(1)(c) GDPR (art. 24 and art. 38 ust. 1 pkt 13 ustawy o prawach konsumenta put the burden of proof on us) and art. 6(1)(f) GDPR (defence of legal claims). Data: the consent record described in section 2.
6. 06Handling complaints, withdrawals and refunds — art. 6(1)(c) GDPR (art. 7a, 27-32 and 43h-43q ustawy o prawach konsumenta) and art. 6(1)(b) GDPR. Data: correspondence, order records.
7. 07Preventing fraud and keeping the service secure (rate limits, single-use download links, server logs) — art. 6(1)(f) GDPR (our legitimate interest in not delivering to someone who did not pay, and in a working service). Data: IP address, download-link use.
8. 08Analytics — art. 6(1)(a) GDPR (your consent) and art. 398 ustawy Prawo komunikacji elektronicznej for storing the analytics cookie on your device. You can withdraw consent at any time (section 7); withdrawal does not affect anything done before.

We do not use your data for marketing e-mails, profiling or automated decisions with legal effects, and we do not sell or share it for advertising.

Who receives your data

Each recipient receives only what its task requires:

1. 01Stripe Payments Europe, Ltd., Dublin, Ireland (with Stripe, Inc., USA, as its parent) — payment processing, collection of your name and billing address on the payment page, card-issuer country. Stripe is an independent controller for the payment itself and a processor for the checkout data it collects on our behalf.
2. 02small.pl (hosting provider, Poland) — hosts the application, the database with the order and invoice records, and the invoice PDF archive. Processor.
3. 03OVH (SMTP e-mail service, France) — sends the confirmation, download and invoice e-mails on our behalf. Processor.
4. 04Google Ireland Ltd. and Google LLC (USA) — Google Tag Manager and Google Analytics 4, only after you accept analytics cookies. Google acts as a processor for measurement and may act as a controller for some of its own uses as described in Google's terms.
5. 05Telegram — we receive an instant notification of each order in the seller's Telegram account (Telegram FZ-LLC, Dubai, United Arab Emirates). The notification contains the order number, the amount, the invoice number and the country of the order; it contains no name, no e-mail address and no other data about you.
6. 06Our accounting office (Poland) — receives the invoices and the monthly sales export for the VAT return (JPK_V7) and bookkeeping. Processor for the data it handles on our instructions; it keeps its own copy for the statutory period.
7. 07Public authorities — the tax administration and other authorities where the law obliges us to hand data over, for example during a tax audit.

The IP-to-country lookup runs on our own server with a locally stored database (GeoLite2 by MaxMind); your IP address is not sent to MaxMind or any other party for it.

Transfers outside the European Economic Area

Stripe and Google may process data in the United States. Both Stripe, Inc. and Google LLC are certified under the EU-US Data Privacy Framework, which the European Commission recognised as adequate on 10 July 2023 (Decision (EU) 2023/1795); in addition, their contracts with us include the European Commission's standard contractual clauses (Decision (EU) 2021/914). You can obtain a copy of the safeguards by writing to contact@takedroneseasy.com.

The Telegram notification described in section 4 contains no personal data about you, so it involves no transfer of your data. Hosting (small.pl) and e-mail (OVH) are in the EU.

How long we keep it

1. 01Order and invoice records, including your name, billing address and country, the amounts, the VAT figures and the exchange rate, and the location evidence (IP address, IP country, card-issuer country): until 31 December of the seventh year following the year of purchase. The tax law requires them at least until the tax liability is time-barred — five years from the end of the year in which the tax was due (art. 70 § 1 Ordynacji podatkowej, art. 86 § 1 Ordynacji podatkowej, art. 112 ustawy o VAT), which for a purchase in 2026 is 31 December 2032; the extra year covers the events that suspend or interrupt that period. On that date the records are anonymised and the invoice PDF is deleted by an automated job; the same date is used in our records, in this policy and in the job.
2. 02Withdrawal-right consent record (the two consents, time, IP, wording version, language): as long as the order record, because it is the proof that the contract was performed lawfully (art. 17(3)(e) GDPR).
3. 03E-mail address: as long as the order record, unless you ask us to erase it earlier. The e-mail address is not part of the invoice, so — unlike the name and address — we can erase it on request while keeping the invoice.
4. 04Download-link records: as long as the order record.
5. 05Complaints and other correspondence: until the matter is closed and any claim arising from it is time-barred (up to six years under art. 118 Kodeksu cywilnego).
6. 06Analytics data (Google Analytics 4): event data for 2 months from the visit, and data tied to your analytics identifier for 14 months from your last visit; the analytics cookie itself lives up to 2 years unless you delete it or withdraw consent. Analytics data is kept separately from the invoicing data and is erased independently of it.
7. 07If you start an order and do not pay: the e-mail address, IP address and consent record entered for that attempt are deleted after 30 days.
8. 08Server logs with IP addresses: up to 30 days, for security.

Your rights

You have the right to access your data and receive a copy, to have inaccurate data rectified, to have data erased, to restrict processing, to receive the data you provided in a portable format, to object to processing based on our legitimate interests, and to withdraw a consent at any time. To exercise any of them write to contact@takedroneseasy.com; we reply within one month.

Erasure has one limit: we must refuse to erase the name, address and country on an issued invoice, and the invoice itself, until the retention date in section 6, because the tax law requires us to keep them (art. 17(3)(b) GDPR with art. 86 § 1 Ordynacji podatkowej and art. 112 ustawy o VAT). Everything else about you — the e-mail address, the IP address and the download records, and all analytics identifiers — can be erased on request. If we refuse a request in part, we tell you why and until when we keep the data.

Analytics: you can withdraw your consent, or give it later, with the "Cookie Settings" link in the page footer; you can also delete the cookies in your browser. Withdrawing consent stops Google's tools from loading on your next visit.

You have the right to lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, Poland, https://uodo.gov.pl — or with the authority of the EU country where you live.

Cookies and similar technologies

Strictly necessary: a single entry in your browser's local storage ("cookieConsent") remembers your choice in the cookie banner. It contains only "accepted" or "rejected" and no identifier. Stripe sets its own cookies on its payment page under Stripe's privacy policy.

Analytics (consent only): if you accept, Google Tag Manager loads Google Analytics 4, which sets cookies such as _ga and _ga_<id> holding a random identifier, and Google's Consent Mode receives your choice. Until you accept, no request is made to Google's servers and no such cookie is set. Rejecting is one click and as easy as accepting.

Changes to this policy

We update this policy when our processing changes. Each version carries a version number and a date; the version history is below. Substantive changes are announced on this page before they take effect.