Trocalia Digital SL (hereinafter, "we", "us" or "our company") is committed to protecting the privacy and personal data of our users. This privacy policy explains how we collect, use, store and protect your personal information in accordance with the General Data Protection Regulation (GDPR - Regulation EU 2016/679) and applicable Spanish legislation.

Company name: Trocalia Digital SL CIF: B70751490 Address: Calle Paixalet, Núm 6 Planta 6, Porta 2, 08030 Barcelona (Barcelona) Email: hola@espectaclesdrons.cat Data Protection Officer: Albert Bou - alboup@gmail.com

Important: We do not collect any personal data until the client voluntarily contacts us.

3.1 Identification Data: - Name and surnames - ID/NIE (only for billing) - Date of birth (for contracts) - Photography (for identification at events)

3.2 Contact Data: - Complete postal address - Mobile and landline phone - Email address - Social networks (if you contact us through this channel)

3.3 Economic Data: - Banking information for billing - Payment history - Requested quotes

3.4 Navigation Data: - IP address - Browser and device type - Pages visited and time spent - Cookies and similar technologies

3.5 Geolocation Data: - Approximate location for local services - GPS coordinates of the show location

4.1 Contract Execution: - Management of quote requests - Planning and execution of drone shows - Billing and collection - Pre and post-service communication

4.2 Compliance with Legal Obligations: - Accounting and tax obligations - AESA records (State Aviation Safety Agency) - Insurance and civil liability

4.3 Legitimate Interest: - Improvement of our services - Website statistical analysis - Computer security - Claims and legal defense

4.4 Consent: - Direct marketing - Content personalization - Behavior analysis

- Article 6.1.b GDPR: Performance of the service contract - Article 6.1.c GDPR: Compliance with legal obligations (tax, AESA) - Article 6.1.f GDPR: Legitimate interest (service improvement, security) - Article 6.1.a GDPR: Explicit consent (marketing, cookies)

- Contractual data: 6 years (tax obligation) - Accounting data: 6 years (Commercial Code) - AESA records: 5 years (aeronautical regulations) - Marketing data: Until consent revocation - Security logs: 12 months - Cookies: According to type (see Cookie Policy)

7.1 Right of Access (Article 15 GDPR): You can request information about the data we process about you.

7.2 Right of Rectification (Article 16 GDPR): You can request the correction of inaccurate or incomplete data.

7.3 Right of Erasure (Article 17 GDPR): You can request the deletion of your data when: - They are no longer necessary for the purposes - You withdraw consent - You object to the processing - The data has been unlawfully processed

7.4 Right to Restriction (Article 18 GDPR): You can request restriction of processing in certain cases.

7.5 Right to Data Portability (Article 20 GDPR): You can receive your data in a structured, machine-readable format.

7.6 Right to Object (Article 21 GDPR): You can object to processing based on legitimate interest or for direct marketing.

7.7 Rights related to Automated Decisions: Right not to be subject to decisions based solely on automated processing.

To exercise any of your rights, you can contact us through:

- Email: hola@espectaclesdrons.cat - Postal mail: Calle Paixalet, Núm 6 Planta 6, Porta 2, 08030 Barcelona - Data Protection Officer: Albert Bou - alboup@gmail.com

Required documentation: - Photocopy of ID/NIE - Signed request specifying the right to exercise - In case of representation, notarial power

Response time: 1 month (extendable by 2 more months in complex cases)

We implement appropriate technical and organizational measures to ensure the security of your data:

9.1 Technical Measures: - SSL/TLS encryption for transmissions - Encrypted databases - Regular backups - Intrusion detection systems - Multi-factor authentication

9.2 Organizational Measures: - Staff training in data protection - Confidentiality agreements - Need-based access control - Regular security audits - Incident response protocols

Some of our operations may involve data transfers outside the European Economic Area (EEA):

10.1 Cloud Services: - Google Cloud Platform (adequacy by Decision 2021/914) - Amazon Web Services (standard contractual clauses)

10.2 Analytics: - Google Analytics (adequacy with Google Analytics 4)

10.3 Safeguards: All transfers are made with adequate safeguards according to Chapter V of the GDPR.

We do not intentionally collect data from minors under 14 years of age without parental consent. For minors between 14 and 18 years old, we require:

- Consent of the minor - Authorization from parents/guardians for contracts - Identity verification at events

If we detect data from minors without adequate consent, we will delete it immediately.

If you consider that the processing of your data violates the GDPR, you can file a complaint with:

Spanish Data Protection Agency (AEPD) - Web: www.aepd.es - Phone: 901 100 099 - Electronic headquarters: sedeagpd.gob.es

Catalan Data Protection Authority (APDCAT) - Web: www.apdcat.cat - Phone: 93 528 9100

We reserve the right to modify this privacy policy to adapt it to legislative changes or in our services. We will notify you of any material change through:

- Prominent notice on the website - Email (if we have your consent) - Direct notification for substantial changes

Effective date: January 15, 2025