Privacy Policy

Droppey Sp. z o.o. (“Droppey”, “we”) is a Polish company building autonomous last-mile delivery for Polish cities. Registered office: Wrocław, Poland. Data Controller contact: [email protected]. Data Protection Officer: [email protected].

• Contact form — name, email, company, inquiry type, message.
• Merchant account — business details, NIP, billing, dashboard activity.
• Delivery recipients — first name, delivery address, phone (from the merchant).
• Technical — IP (anonymised), browser, device, pages visited.
• Fleet operations — route, sensor telemetry, incident logs.

• Contract — to provide delivery services to merchants and recipients.
• Legitimate interest — service security, fraud prevention, product improvement.
• Consent — optional analytics cookies, marketing emails.
• Legal obligation — tax, accounting, regulatory reporting (Polish law).

We share the minimum necessary with: payment processors (Stripe, PayU), email providers (Postmark/Resend), cloud infrastructure (AWS, Cloudflare), and Polish regulators when legally required. We do not sell personal data. We do not use data for advertising.

Data is stored primarily in EU data centres. Where transfer outside the EU is necessary (e.g., for SaaS sub-processors), we rely on European Commission Standard Contractual Clauses and assess the recipient country’s data protection regime.

• Access your data — request a copy
• Rectification — correct inaccurate data
• Erasure — request deletion (“right to be forgotten”)
• Restriction — limit our processing
• Portability — machine-readable export
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, without affecting prior processing
• Complain to UODO — uodo.gov.pl, ul. Stawki 2, 00-193 Warsaw

To exercise any right, email [email protected]. We respond within 30 days.

We keep data only as long as necessary: contact form submissions for 24 months, merchant accounts for the duration of the relationship plus 7 years (Polish tax law), delivery records for 24 months, and sensor telemetry for 90 days unless an incident is recorded.

See our Cookie Policy for the complete list. TL;DR: we only use what’s strictly necessary plus (with your consent) privacy-safe analytics. We never use advertising or tracking cookies.

We will notify you of material changes at least 30 days in advance via email and a prominent banner on droppey.com.