Introduction
We respect your privacy and are committed to protecting it through our compliance with this privacy policy (“Policy”). This Policy describes the types of information we may collect from you or that you may provide (“Personal Information”) in the “HeyDrop PSA” mobile application (“Mobile Application” or “Service”) and any of its related products and services (collectively, “Services”), and our practices for collecting, using, maintaining, protecting, and disclosing that Personal Information. It also describes the choices available to you regarding our use of your Personal Information and how you can access and update it. This Policy covers the HeyDrop apps for iOS and Android, the HeyDrop Teams web platform, our websites, and the shared card pages we host on your behalf.
This Policy is a legally binding agreement between you (“User”, “you” or “your”) and HeyDrop PSA (“HeyDrop PSA”, “we”, “us” or “our”). If you are entering into this Policy on behalf of a business or other legal entity, you represent that you have the authority to bind such entity to this Policy, in which case the terms “User”, “you” or “your” shall refer to such entity. If you do not have such authority, or if you do not agree with the terms of this Policy, you must not accept this Policy and may not access and use the Mobile Application and Services. By accessing and using the Mobile Application and Services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Policy. This Policy does not apply to the practices of companies that we do not own or control, or to individuals that we do not employ or manage.
Legal Basis for Processing Personal Data
We process your personal data based on the following legal grounds:
Consent (GDPR Article 6(1)(a)): We rely on your consent to process your contact details (name, email) for sending you product updates and newsletters. You may withdraw your consent at any time.Contract (GDPR Article 6(1)(b)): We process your personal data (name, email, payment details) to fulfill our contract with you when you create an account or make a purchase.Legal Obligation (GDPR Article 6(1)(c)): We process transaction data to comply with legal obligations such as tax and accounting requirements.Legitimate Interests (GDPR Article 6(1)(f)): We process usage data and analytics to improve our services, based on our legitimate interest in understanding user behavior and enhancing service features. You may object to this processing at any time.
Legitimate Interests (GDPR Article 6(1)(f)) for contact data: where you scan a business card or import contacts, we process the details of the person on that card so that we can provide a contact management service to you and to that person's business contact. Those individuals may object to this processing, or ask for correction or erasure, at any time by writing to [email protected]. See Business card scanning, contacts and AI features below.
Consent (GDPR Article 6(1)(a)) for non-essential cookies and similar technologies: analytics and advertising cookies are set only after you accept them in our cookie banner, and you can withdraw consent at any time through our cookie settings.
Contact details
The controller within the meaning of Art. 4 para. 7 EU General Data Protection Regulation (GDPR) is HeyDrop P.S.A., ul. Cegielniana 4A/15, 30-404 Kraków, Poland, email: [email protected].
Privacy Lead, and contact point for all data protection questions and requests: [email protected]
For security-related matters: [email protected]
We have not appointed a statutory Data Protection Officer under Article 37 GDPR because we are not required to do so. Our Privacy Lead handles all privacy and data protection matters.
For our full security and compliance documentation, visit our Trust Center.
Data Transfer Notice
We collect and process your personal data to provide our services. Please note that your data may be transferred and stored outside the European Union, including on secure servers located in the United States. This transfer is conducted in compliance with applicable GDPR regulations using standard contractual clauses to ensure the highest level of protection for your data. We have implemented strong security measures, including encryption, to safeguard your information. We do not rely on your consent as the legal mechanism for these transfers. We rely on the following safeguards:
EU-US Data Privacy Framework (DPF): Our primary infrastructure provider, Amazon Web Services (AWS), is certified under the EU-US Data Privacy Framework, providing an adequacy-based mechanism for lawful data transfers to the United States.
Standard Contractual Clauses (SCCs): As an additional safeguard, we use SCCs as approved by the European Commission, which provide legal guarantees that your data will receive an adequate level of protection, even outside the EU. You may request a copy of the safeguards we rely on for a specific transfer by writing to [email protected].
Recipients in the United States: our infrastructure provider Amazon Web Services, and OpenAI, which processes the business card images you submit to the AI Contact Scanner. Both are certified under the EU-US Data Privacy Framework. Our other recipients, their locations and what each one receives are listed in our sub-processor list.
Additional Security Measures: Your data is stored on secure, encrypted AWS servers (AES-256 encryption at rest via AWS Key Management Service, TLS 1.2+ encryption in transit) in the U.S., and we continually monitor and improve our security practices to ensure your data is safeguarded against unauthorized access. For a full description of our security measures, see our Security Practices page.
Automatic collection of information
When you use the Mobile Application, our servers automatically record information that your device sends. This data may include information such as your device’s IP address, from which an approximate region can be inferred, device name and version, operating system type and version, language preferences, information you search for in the Mobile Application, access times and dates, and other statistics.
Information collected automatically is used only to identify potential cases of abuse and establish statistical information regarding the usage of the Mobile Application and Services. This statistical information is not otherwise aggregated in such a way that would identify any particular User of the system.
Collection of personal information
You can access and use the Mobile Application and Services without telling us who you are or revealing any information by which someone could identify you as a specific, identifiable individual. If, however, you wish to use some of the features offered in the Mobile Application, you may be asked to provide certain Personal Information (for example, your name and e-mail address).
We receive and store any information you knowingly provide to us when you create an account, publish content, or fill any forms in the Mobile Application. When required, this information may include the following:
- Account details (such as user name, unique user ID, password, etc)- Contact information (such as email address, phone number, etc)- Basic personal information (such as name, country of residence)- Camera and photo library access, used only to take or choose a photo for your card and to scan business cards- Your device address book, only if you choose to import contacts, and only for the entries you select- Any other materials you willingly submit to us (such as images and feedback)
We do not collect precise location data (latitude and longitude) and we do not access your calendar. Where a feature needs access to your camera, photos or contacts, your device asks you first and you can withdraw that permission in your device settings at any time.
You can choose not to provide us with your Personal Information, but then you may not be able to take advantage of some of the features in the Mobile Application. Users who are uncertain about what information is mandatory are welcome to contact us.
Business card scanning, contacts and AI features
The AI Contact Scanner lets you photograph a physical business card or event badge so the details on it can be extracted automatically. To do this, the image is sent to OpenAI, which performs the text recognition and field extraction and returns the result to us. OpenAI is certified under the EU-US Data Privacy Framework and, under its API terms, does not use data submitted through its API to train its models. Scan images are deleted once processing is complete and in any event within 24 hours. The extracted details are stored in your account.
When you scan or import a card you are collecting personal data about another person. You are responsible for having a proper basis to do so and for using those details lawfully, including under applicable marketing and anti-spam rules.
If you are the person whose card was scanned: you can ask us what we hold about you, ask us to correct it, or object to the processing and ask for erasure, by writing to [email protected]. We will act on your request and, where the data sits inside a business customer account, we will pass your request to that customer as the controller and support them in answering it.
Our support channel uses an automated assistant. Where you interact with it, you are told that you are dealing with an AI system and you can ask to be transferred to a person at any time. Our AI features assist you, they do not make automated decisions about you that produce legal effects or similarly significantly affect you. AI output can contain errors, so please check extracted details before relying on them.
Privacy of children
Our Services are intended for users aged 18 and over, as stated in our Terms of Use. We do not knowingly collect any Personal Information from children under the age of 18. If you are under the age of 18, please do not submit any Personal Information through the Mobile Application and Services. If you have reason to believe that a child under the age of 18 has provided Personal Information to us through the Mobile Application and Services, please contact us to request that we delete that child’s Personal Information from our Services.
We encourage parents and legal guardians to monitor their children’s Internet usage and to help enforce this Policy by instructing their children never to provide Personal Information through the Mobile Application and Services without their permission. We also ask that all parents and legal guardians overseeing the care of children take the necessary precautions to ensure that their children are instructed to never give out Personal Information when online without their permission.
Use and processing of collected information
We are the data controller for the personal data of our own users, including account details, billing data, support conversations and product analytics. Where you use HeyDrop Teams, your organisation is the controller of the data it puts into the platform, including its members' cards and the contacts they collect, and we act as processor on its instructions under our Data Processing Agreement. Where an individual user collects contacts through the app for their own purposes, that user is the controller of those contacts and we act as processor for them.
Our role may also differ depending on the specific situation involving Personal Information. We act in the capacity of a data controller when we ask you to submit your Personal Information that is necessary to ensure your access and use of the Mobile Application and Services. In such instances, we are a data controller because we determine the purposes and means of the processing of Personal Information.
We act in the capacity of a data processor in situations when you submit Personal Information through the Mobile Application and Services. We do not own, control, or make decisions about the submitted Personal Information, and such Personal Information is processed only in accordance with your instructions. In such instances, the User providing Personal Information acts as a data controller.
In order to make the Mobile Application and Services available to you, or to meet a legal obligation, we may need to collect and use certain Personal Information. If you do not provide the information that we request, we may not be able to provide you with the requested products or services. Any of the information we collect from you may be used for the following purposes:
- Create and manage user accounts- Send administrative information- Send product and service updates- Respond to inquiries and offer support- Request user feedback- Improve user experience- Enforce terms and conditions and policies- Protect from abuse and malicious users- Respond to legal requests and prevent harm- Run and operate the Mobile Application and Services
Processing your Personal Information depends on how you interact with the Mobile Application and Services, where you are located in the world and if one of the following applies: (i) you have given your consent for one or more specific purposes; (ii) provision of information is necessary for the performance of this Policy with you and/or for any pre-contractual obligations thereof; (iii) processing is necessary for compliance with a legal obligation to which you are subject; (iv) processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in us; (v) processing is necessary for the purposes of the legitimate interests pursued by us or by a third party. We may also combine or aggregate some of your Personal Information in order to better serve you and to improve and update our Mobile Application and Services.
Note that under some legislations we may be allowed to process information until you object to such processing by opting out, without having to rely on consent or any other of the legal bases. In any case, we will be happy to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Information is a statutory or contractual requirement, or a requirement necessary to enter into a contract.
Managing information
You are able to delete certain Personal Information we have about you. The Personal Information you can delete may change as the Mobile Application and Services change. When you delete Personal Information, however, we may maintain a copy of the unrevised Personal Information in our records for the duration necessary to comply with our obligations to our affiliates and partners, and for the purposes described below.
Disclosure of information
Depending on the requested Services or as necessary to complete any transaction or provide any Service you have requested, we may share your information with our affiliates, contracted companies, and service providers (collectively, “Service Providers”) we rely upon to assist in the operation of the Mobile Application and Services available to you and whose privacy policies are consistent with ours or who agree to abide by our policies with respect to Personal Information. We share personal data with these Service Providers only to the extent they need it to perform their function for us, under written data processing agreements that require them to protect it and to process it only on our instructions. We do not sell personal data and we do not share it with unaffiliated third parties for their own purposes. The current list of these providers, what each receives and where each is located is published in our sub-processor list, and we give business customers with a signed Data Processing Agreement at least 30 days notice before adding or replacing one.
Service Providers are not authorized to use or disclose your information except as necessary to perform services on our behalf or comply with legal requirements. Service Providers are given the information they need only in order to perform their designated functions, and we do not authorize them to use or disclose any of the provided information for their own marketing or other purposes. A complete list of our sub-processors is available at heydrop.app/security/subprocessors.
We may also disclose any Personal Information we collect, use or receive if required or permitted by law, such as to comply with a subpoena or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
Retention of information
We will retain and use your Personal Information for the period necessary to comply with our legal obligations, as long as your user account remains active, to enforce our Policy, resolve disputes, and unless a longer retention period is required or permitted by law. Specifically:
- Account, profile and card data: kept while your account is active, then deleted within 30 days of a verified deletion request. Copies inside encrypted backups are overwritten within a further 60 days.
- Contact records you created, including scanned cards: kept while your account is active and deleted with your account. Scan images are deleted once processing completes and in any event within 24 hours.
- Billing and transaction records: 5 years from the end of the tax year in which the transaction was invoiced, as required by Polish tax law, so up to 6 years in practice.
- Support conversations: 24 months after the conversation is closed.
- Product analytics events: up to 24 months, after which only aggregated statistics that cannot identify you are kept.
- Application logs: 12 months. Security, audit and fraud prevention logs: 3 years.
- Website server logs: 7 days.
- Cookie consent records: 24 months, so we can show what you consented to and when.
- Marketing consent: until you withdraw it, plus 12 months to evidence the withdrawal.
We may use any aggregated data derived from or incorporating your Personal Information after you update or delete it, but not in a manner that would identify you personally. Once the retention period expires, Personal Information shall be deleted. Therefore, the right to access, the right to erasure, the right to rectification, and the right to data portability cannot be enforced after the expiration of the retention period.
Data analytics
Our Mobile Application and Services may use third-party analytics tools that use cookies, web beacons, or other similar information-gathering technologies to collect standard internet activity and usage information. The information gathered is used to compile statistical reports on User activity such as how often Users visit our Mobile Application and Services, what pages they visit and for how long, etc. We use the information obtained from these analytics tools to monitor the performance and improve our Mobile Application and Services. These tools use identifiers that are personal data, such as a user or device identifier and an IP address, and some of them record product sessions, so analytics data can be linked to an individual account. We use it to understand and improve the product, not to build advertising profiles about you, and we do not sell it. Where analytics or advertising technologies require consent, we set them only after you have consented, and you can withdraw consent at any time through our cookie settings or object by writing to [email protected]. The analytics providers we use are named in our sub-processor list.
Social media features
Our Mobile Application and Services may include social media features, such as the Facebook and Twitter buttons, Share This buttons, etc (collectively, “Social Media Features”). These Social Media Features may collect your IP address, what page you are visiting on our Mobile Application and Services, and may set a cookie to enable Social Media Features to function properly. Social Media Features are hosted either by their respective providers or directly on our Mobile Application and Services. Your interactions with these Social Media Features are governed by the privacy policy of their respective providers.
Email marketing
We offer electronic newsletters to which you may voluntarily subscribe at any time. We are committed to keeping your e-mail address confidential and will not disclose your email address to any third parties except as allowed in the information use and processing section or for the purposes of utilizing a third-party provider to send such emails. We will maintain the information sent via e-mail in accordance with applicable laws and regulations.
In compliance with the CAN-SPAM Act, all e-mails sent from us will clearly state who the e-mail is from and provide clear information on how to contact the sender. You may choose to stop receiving our newsletter or marketing emails by following the unsubscribe instructions included in these emails or by contacting us. However, you will continue to receive essential transactional emails.
Push notifications
We offer push notifications to which you may also voluntarily subscribe at any time. To make sure push notifications reach the correct devices, we use a third-party push notifications provider who relies on a device token unique to your device which is issued by the operating system of your device. While it is possible to access a list of device tokens, they will not reveal your identity, your unique device ID, or your contact information to us or our third-party push notifications provider. We keep device tokens only for as long as you have notifications enabled. If, at any time, you wish to stop receiving push notifications, simply adjust your device settings accordingly.
Links to other resources
The Mobile Application and Services contain links to other resources that are not owned or controlled by us. Please be aware that we are not responsible for the privacy practices of such other resources or third parties. We encourage you to be aware when you leave the Mobile Application and Services and to read the privacy statements of each and every resource that may collect Personal Information.
Information security
We secure information you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use, or disclosure. We maintain reasonable administrative, technical, and physical safeguards in an effort to protect against unauthorized access, use, modification, and disclosure of Personal Information in our control and custody. However, no data transmission over the Internet or wireless network can be guaranteed.
Therefore, while we strive to protect your Personal Information, you acknowledge that (i) there are security and privacy limitations of the Internet which are beyond our control; (ii) the security, integrity, and privacy of any and all information and data exchanged between you and the Mobile Application and Services cannot be guaranteed; and (iii) any such information and data may be viewed or tampered with in transit by a third party, despite best efforts.
As the security of Personal Information depends in part on the security of the device you use to communicate with us and the security you use to protect your credentials, please take appropriate measures to protect this information.
Data Protection Rights
GDPR (for users in the EEA and UK): you have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on our legitimate interests, including profiling. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing already carried out. You also have the right to lodge a complaint with a supervisory authority. To exercise any of these rights, write to [email protected].
US state privacy laws (California, Colorado, Connecticut, Virginia, Texas and others): depending on where you live, you may have the right to know what personal information we collect and why, to access a copy of it, to correct it, to delete it, to opt out of targeted advertising and of the sale or sharing of your personal information, and to appeal a decision we make on your request. We do not sell personal information for money. We do use analytics and advertising technologies, including Google and Meta tools, that may count as sharing personal information for cross-context behavioural advertising under the CCPA as amended by the CPRA. You can opt out at any time using the Cookie Settings link in our cookie policy, by enabling a Global Privacy Control signal in your browser, or by writing to [email protected]. We will not discriminate against you for exercising any of these rights. You may use an authorised agent, and we may ask for proof of authority. If we refuse a request, you can appeal by replying to our decision, and we will respond within 45 days.
Data breach
In the event we become aware that the security of the Mobile Application and Services has been compromised or Users’ Personal Information has been disclosed to unrelated third parties as a result of external activity, including, but not limited to, security attacks or fraud, we reserve the right to take reasonably appropriate measures, including, but not limited to, investigation and reporting, as well as notification to and cooperation with law enforcement authorities. In the event of a data breach, we will make reasonable efforts to notify affected individuals if we believe that there is a reasonable risk of harm to the User as a result of the breach or if notice is otherwise required by law. When we do, we will send you an email.
Changes and amendments
We reserve the right to modify this Policy or its terms related to the Mobile Application and Services at any time at our discretion. When we do, we will revise the updated date at the bottom of this page, send you an email to notify you. We may also provide notice to you in other ways at our discretion, such as through the contact information you have provided.
An updated version of this Policy will be effective immediately upon the posting of the revised Policy unless otherwise specified. Your continued use of the Mobile Application and Services after the effective date of the revised Policy (or such other act specified at that time) will constitute your consent to those changes. However, we will not, without your consent, use your Personal Information in a manner materially different than what was stated at the time your Personal Information was collected.
Acceptance of this policy
You acknowledge that you have read this Policy and agree to all its terms and conditions. By accessing and using the Mobile Application and Services and submitting your information you agree to be bound by this Policy. If you do not agree to abide by the terms of this Policy, you are not authorized to access or use the Mobile Application and Services.
Your Rights
In accordance with GDPR, you have the right to request access to your personal data, correct any inaccurate information, delete your data, and restrict or object to the processing of your data. Additionally, you have the right to request the transfer of your data to another service provider (data portability). We will provide your data in a structured, commonly used, and machine-readable format (e.g., CSV) upon your request. To exercise any of your rights, write to [email protected]. We respond within one month of receiving your request. We may first ask you to confirm your identity using your account email address. If your request is complex and we need more time, we will tell you within that month and explain why.
Data Breach Notification
In the event of a personal data breach we will notify the competent supervisory authority within 72 hours of becoming aware of it where Article 33 GDPR requires it. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay under Article 34. Where we act as processor for a business customer, we notify that customer without undue delay and in any case within 48 hours. We will inform you of the nature of the breach, the data impacted, and any steps you can take to mitigate potential risks.
Contacting us
If you have any questions, concerns, or complaints regarding this Policy, the information we hold about you, or if you wish to exercise your rights, we encourage you to contact us using the details below:
[email protected]
Privacy, data protection, and all data subject requests: [email protected]
Security: [email protected]
Trust Center: heydrop.app/security
Data Processing Agreement (DPA)
If you are a business customer (HeyDrop Teams), we offer a Data Processing Agreement in accordance with GDPR Article 28. Review our standard DPA at heydrop.app/security/dpa or contact [email protected].
Supervisory Authority
You have the right to lodge a complaint with your local data protection authority. For HeyDrop, the lead supervisory authority is the Polish Data Protection Authority (PUODO): ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.
We will attempt to resolve complaints and disputes and make every reasonable effort to honor your wish to exercise your rights as quickly as possible and in any event, within the timescales provided by applicable data protection laws.