Privacy notice

DTA Client Portal (portal.dta.rocks) — reviewed 19 August 2026.

Who we are

Drone Tech Aerospace Ltd ("DTA", "we", "us") is the data controller for personal data processed through the DTA Client Portal. You can contact us about this notice or your data at info@dronetechaerospace.co.uk.

What we collect and why

Account and contact data — your name and business email address, held against your portal account so we can identify you, send invitations and grant you access to the correct customer's projects.
Access and security logs — sign-in, sign-out, password-reset and invitation events, and other security-relevant actions, together with the IP address and browser (User-Agent) that made the request, so we can secure the delivery channel and investigate suspected misuse or account compromise.
Cookies — only two cookies are set, both strictly necessary for the service you have asked for: the sign-in cookie (DtaPortalAuth) that keeps you logged in, and an anti-forgery cookie that protects forms from cross-site request forgery. Neither is used for analytics, tracking or advertising, and no cookie-consent banner is shown because the strictly-necessary exemption under PECR applies.
Deliverable links and passwords — where a project shares password-protected outputs (e.g. survey data folders), the password is stored encrypted so it can be revealed to authorised users of that project only.

Our lawful basis

We process your account and contact data to perform our contract with your organisation (delivering the commissioned survey outputs through the portal), and we process access/security logs on the basis of our legitimate interests in keeping the delivery channel secure and maintaining an audit trail of who accessed what. We do not process any special-category data, and no automated decision-making takes place.

How long we keep it

Account name and email: for the life of your account, plus 30 days after deletion.
Invitation email and token record: 90 days after the invitation expires or is accepted, then purged.
Access/security log entries: IP address and browser (User-Agent) are kept for 24 months, after which they are anonymised — the event itself (what happened and when) is retained for accountability, but who/where is removed.
Customer branding assets: for the life of the customer relationship.
Deliverable links and (encrypted) passwords: until the relevant project is unshared or archived.

Sub-processors

We use an SMTP relay to send account, invitation and password-reset emails on our behalf. We do not sell or share your data with any other third party.

Your rights

Under UK GDPR and the Data Protection Act 2018 you can ask us to access, correct, or erase your personal data, or ask about how we use it. To exercise any of these rights, email info@dronetechaerospace.co.uk — we will respond within one month. Where you ask us to erase your account, we disable it, purge any outstanding invitations for your email address, and anonymise your access-log entries; we retain the bare event skeleton for security accountability, as described above. If you believe we have not handled your data correctly you can also complain to the Information Commissioner's Office (ico.org.uk).