GDPR Policy

Effective Date: 28 August 2025

Mech-V Ltd t/a Engineers with Drones

1. Purpose of this Policy

Mech-V Limited T/A Engineers with Drones ("the Company") is committed to protecting the privacy and rights of individuals whose personal data may be collected through the use of drone technology. This policy outlines how we comply with the General Data Protection Regulation (GDPR), the Data Protection Act 2018, and the Guidance on the Use of Drones (DPC, May 2022). Our drones may capture images, video, and other data during operations for legitimate commercial purposes (e.g., inspections, surveys, mapping). This policy explains how we lawfully collect, process, store, and share such data.

2. Scope

This policy applies to:

All employees, contractors, and third parties engaged by Engineers with Drones
All drone operations carried out in Ireland and the EU
All personal data collected, processed, and stored through drone-based systems

3. Data Controller

Mech-V Limited T/A Engineers with Drones acts as the Data Controller where personal data is collected via drone operations.

Contact details:
info@engineerswithdrones.ie
+353 (0)21 202 8281
Engineers With Drones,
Unit 10,
John Dunlop Building,
Marina Commercial Park,
Centre Park Road,
Cork,
Ireland.
T12 WRX0

4. Legal Bases for Processing

All processing of personal data collected by drones must have a lawful basis under GDPR. The company primarily relies on:

Legitimate Interests - e.g., protecting property, carrying out inspections, or ensuring safety
Contractual Necessity - where services require drone data collection
Consent - where feasible, such as controlled filming of specific individuals or teams

We do not rely on consent when it cannot be freely given by all data subjects in public or semi-public spaces.

5. Data Protection Principles

We commit to the following GDPR principles:

Lawfulness, fairness, transparency - clear notices provided where drones are in operation
Purpose limitation - data used only for defined, legitimate purposes
Data minimisation - only data strictly necessary is collected (e.g., using blurring tools)
Accuracy - ensuring data is accurate and up to date
Storage limitation - personal data is retained only as long as necessary
Integrity & confidentiality - secure storage, encryption, and restricted access
Accountability - documented compliance with DPC requirements

6. Transparency and Notification

Where personal data may be captured by drones, we adopt a layered transparency approach in line with DPC guidance:

Advance Signage & Notices

Clear signs are placed at site entry points and within operational areas where drones are active
Signs include our company name, contact details, and a QR code linking to the privacy notice

Operator Identification

Drone operators wear high-visibility clothing clearly showing they are drone pilots and are prepared to answer privacy-related queries

Website Notice

A public privacy notice is hosted at www.engineerswithdrones.ie/privacy-policy.php, explaining the purposes of drone use, data subject rights, and how to raise concerns

7. Data Capture in Public Spaces

Mech-V Limited T/A Engineers with Drones recognises that operating in public or semi-public areas (e.g., streets, parks, construction sites, stadiums) may result in the incidental capture of personal data such as faces, vehicle registration plates, or identifiable features of individuals. To balance legitimate business interests with the rights of individuals, the following measures apply:

7.1 Lawful Basis for Public-Space Recording

The primary lawful basis is Legitimate Interest - for example, where inspections, surveys, or aerial footage are needed for a client project
We ensure that data collection does not have a disproportionate impact on individuals, and safeguards are implemented to reduce intrusiveness
Where feasible, consent is sought for controlled environments (e.g., team training videos, events where participants are identifiable)

7.2 Limiting Capture & Use

Data minimisation: Only footage essential to the task is recorded. We avoid continuous recording in areas with high pedestrian activity
Restricted angles & altitude: Camera angles are set to minimise incidental recording of unrelated individuals
Blurring & anonymisation: Automated software is applied to obscure faces, vehicle plates, and other identifiable details when such data is not required for project delivery
No surveillance intent: Mech-V Limited T/A Engineers with Drones does not use drones for covert surveillance of the general public

7.3 Transparency in Public Operations

Layered approach (as described in Section 6) ensures individuals can easily understand when drones are in use
On-site point of contact: At least one staff member is designated during public operations to respond to queries about data capture
Event-specific notices: For large events (e.g., inspections at a stadium), additional measures such as online announcements or entryway notifications may be implemented

7.4 Storage & Access to Public-Space Data

Footage containing personal data collected in public areas is stored securely and only accessed by authorised staff
Data is not published online or shared externally unless it is anonymised or legally required for contractual, insurance, or safety purposes
Where public sharing of footage is intended (e.g., marketing), all identifiable individuals are blurred or explicit consent is obtained

7.5 Individuals’ Rights in Public-Space Data

Any individual who believes they were captured in footage has the right to request:

Confirmation of whether we hold such data
Access to the footage
Erasure or restriction of processing where legally applicable

Requests are handled via info@engineerswithdrones.ie within 30 days.

8. Data Minimisation and Privacy by Design

Drones are configured to limit unnecessary recording (e.g., restricted angles, disabling 360-degree capture where not required)
Where feasible, automated blurring/anonymisation of faces, bodies, and license plates is applied
Only authorised personnel may access drone-collected data
Privacy impact is assessed before high-risk operations (see Section 10)

9. Data Security

We apply strong technical and organisational measures, including:

Encrypted storage (local and cloud)
Encrypted transmission from drones to storage
Access control (role-based permissions)
Regular cybersecurity monitoring against interference or eavesdropping

10. Data Retention

Personal data captured by drones is retained only for as long as necessary for the purpose collected.

Standard retention: 30-90 days, unless required for contractual, legal, or insurance purposes
Data required for legal claims may be retained longer, subject to strict access controls

11. Data Protection Impact Assessments (DPIA)

Before initiating projects likely to involve systematic monitoring, large-scale recording, or capturing of sensitive data, a DPIA will be carried out in line with DPC guidance.

12. Third-Party Processors

Where third-party services (e.g., cloud storage providers) are used, they act as Data Processors. All processors are bound by GDPR-compliant contracts. International data transfers outside the EEA are only made where adequate safeguards are in place.

13. Data Subject Rights

Data subjects have rights under GDPR, including:

Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to data portability
Right to object

Requests may be submitted via info@engineerswithdrones.ie. Responses will be provided within 30 days.

14. Personal Data Breaches

In case of a suspected data breach:

The DPC will be notified within 72 hours if there is a risk to individuals
Affected data subjects will be informed where required
An internal breach log is maintained

15. Training & Awareness

All employees and contractors receive mandatory training on:

GDPR principles
Drone-specific data protection risks
Secure handling of drone data

16. Governance & Review

The Data Protection Officer (DPO) [or Privacy Lead if no DPO is appointed] oversees compliance
This policy is reviewed annually or when significant changes in operations or law occur
Non-compliance may result in disciplinary action

16. Contact & Complaints

If you have concerns about how your data is processed, contact: info@engineerswithdrones.ie

If unresolved, you may lodge a complaint with the Data Protection Commission:
www.dataprotection.ie / +353 (0)21 202 8281

This policy ensures compliance with GDPR, Irish Data Protection Law, and DPC Drone Guidance (May 2022) while reflecting the operational realities of Engineers with Drones.