Data Compliance

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Data Controller for all personal data processed through this website and associated services is:

This page should be read alongside our Privacy Policy and Terms & Conditions, which together form our full data governance documentation.

Skyline Drone Services processes personal data in accordance with the following legislation and standards:

The table below is a summary of our data processing activities as required by UK GDPR Article 30 (Records of Processing Activities).

The following third-party sub-processors handle personal data on our behalf. Each is contractually bound to process data only for the stated purpose and in accordance with applicable data protection law.

Personal data is retained only for as long as is necessary for its original purpose or as required by law. The following schedule applies to all data processed by Skyline Drone Services.

We implement technical and organisational measures proportionate to the risk presented by our processing activities. As a small sole trader, these measures are practical and targeted.

• HTTPS/TLS encryption on all pages — enforced via Netlify with Let's Encrypt certificates, auto-renewed
• Environment variables for all API keys — no credentials exposed in client-side code
• Netlify serverless functions as API proxies — Anthropic and Google APIs are never called directly from the browser
• Stripe Payment Element — card data never enters our systems; handled entirely within Stripe's PCI-DSS compliant infrastructure
• No plain-text email storage of payment details — all financial data routed through Stripe
• Email obfuscation on all public-facing pages — reduces automated harvesting of contact addresses

• Personal data is accessible only to the sole operator — no third-party staff with system access
• Customer data is not shared with any party not listed in the sub-processors register
• All devices used for business operations are password-protected with up-to-date security software
• Physical media containing customer data (e.g. SD cards with aerial footage) is kept secure and erased promptly after delivery

In the event of a suspected or confirmed personal data breach, we will follow the procedure below in accordance with UK GDPR Article 33 and 34.

Any individual whose personal data we process has the right to request a copy of that data, ask for corrections, or request deletion. We take all such requests seriously and handle them promptly and free of charge.

• Email info@skylinevisual.co.uk with the subject line "Data Request"
• Include your full name and the email address associated with your booking or enquiry
• Specify the type of request: access, rectification, erasure, portability, or objection

We may ask you to verify your identity before releasing personal data, to protect against unauthorised requests. This is standard practice and not intended to obstruct your rights.

Our cookie consent system is implemented in accordance with the Privacy and Electronic Communications Regulations (PECR) and UK GDPR. Consent is obtained before any non-essential scripts are loaded.

Consent preferences are stored locally in the user's browser under the key skyline_cookie_consent_v1 and are not transmitted to our servers. Users may withdraw or change their consent at any time by clearing their browser's local storage or revisiting the cookie preference panel.

This Data Compliance statement is reviewed whenever there is a material change to our processing activities, a new sub-processor is engaged, or applicable legislation is updated — and at minimum once per calendar year.

The current version was last reviewed in May 2026. Any questions or concerns about this statement should be directed to: