Guide
GDPR-compliant drone photogrammetry processing in the EU
EU controller in Lithuania, storage in Finland and paid processing in the EU. How we handle drone imagery for GDPR with pay per job and deletion after 30 days for Basic and 365 days for Full Service.
Bottom line
GIJA HUB MB in Vilnius, Lithuania operates Forresten and GIJA MAPS. Your uploaded images and results are stored in the EU with Hetzner in Germany and Finland. Standard paid processing runs on temporary servers in the EU with Hetzner and Google Cloud. Data is kept 30 days for Basic and 365 days for Full Service, or deleted earlier on request.
Why EU matters for drone data
Drone imagery often shows construction sites, infrastructure, fields and property with precise location. For many EU companies it matters which company is controller, where data is stored, and where processing happens.
An EU controller means your GDPR rights apply directly. Storage and paid processing in the EU means your images and results are not routinely transferred to third countries during photogrammetry itself.
If you process confidential surveys, contact us before upload so we can arrange appropriate delivery and access control for results.
Where your data lives and is processed
We separate paid photogrammetry from the rest of the platform so you can assess transfers concretely.
- Controller: GIJA HUB MB, Polocko g. 4B-20, Vilnius, Lithuania, company code 307210538.
- Storage of images and results: Hetzner in Germany and Finland, EU.
- Paid processing: temporary servers in the EU with Hetzner and Google Cloud, only while the job runs.
- We have bare-metal servers in European data centres and a physical server in an EU office. The physical machine is used only for custom jobs with client approval and can provide a better price when the job fits the capacity.
- Platform operation: website, API, database, viewer and CAPTCHA at Hetzner in the EU.
- Optional: Google Sign-In. Google is an independent controller (Google Ireland Limited for EEA users) and may transfer data internationally under its own safeguards. You can always use email and password instead.
How long we keep data
Images, job data and results are kept 30 days for Basic and 365 days for Full Service from creation, or until earlier deletion on your request. We delete them from active systems within 30 days after the storage period ends, your account is closed or you ask for deletion. Write to agne@gijahub.com and we will delete your data early.
Result share links stay active while your data is stored. The link is protected by a unique token without a password. You are responsible for keeping it confidential.
Security logs are kept 90 days. Payment and accounting records are kept as long as accounting law requires.
Who can see your data
You retain the rights you have in your images and results. GIJA HUB MB does not claim ownership. To provide the service you grant us and our processors a limited right to host, process and deliver the material, only for purposes described in the Privacy Policy.
Automated processing requires access to the full dataset you submit. We do not routinely inspect images or outputs manually. If a job fails, behaves unexpectedly or needs troubleshooting for security or reliability, authorised personnel may access the smallest relevant portion, such as logs, metadata or a limited sample of files. Full access is used only where necessary.
We do not use your images or results to train models.
Limitations
Result share links are protected by a unique token only, not by a password. Google Sign-In is handled by Google as an independent controller. See the Privacy Policy for safeguards and transfer bases.
Anonymous, cookieless website analytics at a US provider processes no personal data and is separate from paid photogrammetry. See the Privacy Policy for details.
Frequently asked questions
Which GDPR rights can I use, and what is the response time?
You can request access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interest. Write to agne@gijahub.com, and we will respond within 30 days. Job data is deleted earlier if you ask.
Can we sign a data processing agreement (DPA)?
Yes. The Data Processing Agreement (DPA) is part of our Terms, and you accept it when you register. We send a countersigned copy on request. The sub-processors are listed on the Sub-processors page, and the transfer bases are in the Privacy Policy.
Do you keep anything after my account is deleted?
Account data is deleted from active systems within 30 days after the account is closed. Images, job data and results are kept 30 days on Basic and 365 days on Full Service from creation, or deleted earlier if you ask. Security logs are kept for 90 days, and payment and accounting records are kept for as long as accounting law requires.
Do you use my images to train AI models?
No. Your images and results are used only for the purposes described in the Privacy Policy, and model training is not one of them. They are kept 30 days on Basic and 365 days on Full Service from creation, or deleted earlier if you ask.
More reading from us
These are our own articles and tools, not external sources. Start here if you want to see how we work.
Privacy Policy
Controller, retention, processors and transfers.
Data Processing Agreement (DPA)
Roles, instructions, security, sub-processors and deletion for Customer Content.
Sub-processors
The providers we use, with their roles and countries.
Terms of Service
Pricing, delivery, intellectual property and liability.
Why we built GIJA MAPS
Why pay per job can be the right model for routine and seasonal work.
Orthophoto without subscription
When pay per job makes sense and what it costs.
Do you have a confidential dataset?
Contact us before upload if you need access-controlled delivery. Otherwise create an account and upload directly.