Personal data processing

Data controller

The controller is DoDo Group SE, company ID 06344470, Pernerova 676/51, Karlín, 186 00 Prague 8, registered with the Municipal Court in Prague under file H 2003. Privacy contact: info@idodo.cz.

Enquiry form

If you submit the contact form, we also link the record of your same-day visit to your enquiry: the pages visited, the time spent on them and your interactions, never the contents of form fields. It helps the sales team follow up on your enquiry with relevant information. If your browser sends the GPC signal, no visit record is created, so none is linked to the enquiry.

Purpose

Handling your enquiry and the follow-up business communication.

Legal basis

Art. 6(1)(b) GDPR (steps prior to a contract, at your request); recording the enquiry's source under Art. 6(1)(f).

Data

Name, work e-mail, company, country, approximate daily delivery volume and your message; optionally also phone, your answer to “where did you hear about us”, segment and target markets. Technically the site language, the enquiry's marketing attribution (campaign parameters, entry page, the domain you came from and the ad-click type) and the pseudonymous fingerprint of that day's visit. The server uses your IP address only in memory, to protect the form against abuse and to compute the fingerprint, and never writes it to the database.

Obligation to provide data

Providing your data is voluntary. Without the form's required fields, however, we cannot accept or handle the enquiry.

Recipients

The internal sales team; processors: Zerops s.r.o. (running the site and the database; EU, Prague) and Resend, Inc. (delivering the e-mail notification of the enquiry to our team; USA, standard contractual clauses).

Retention

For the duration of the discussions and follow-up communication, at most 3 years from the last contact; deleted afterwards. An enquiry that led to a business relationship is kept for as long as that relationship lasts. The visit record linked to an enquiry has the same retention as the enquiry.

First-party traffic measurement (cookieless)

The site measures traffic with its own technology and no external providers: aggregate statistics about which pages work and where visitors come from. The measurement uses no cookies and stores no identifier on your device. For the duration of the visit it keeps only the entry page, the domain you came from and the ad-click type in the browser's session storage (the dodo_landing entry on the cookies page).

We store neither your IP address nor browser details in the database. The server uses them only at the moment of processing, to compute a pseudonymous fingerprint that changes every day. The cryptographic salt the fingerprint is computed from is deleted from the database automatically on the third night after the day it was valid for, that is 50 to 74 hours after it was used. Copies of the salt remain in the database backups for a limited time (see Site operation and security). As long as the salt exists, the fingerprint is pseudonymous, not anonymous: with the IP address and browser details it could be computed again.

Traffic records are deleted after 14 months; the deletion runs as an automated job and every run is logged. Data stays in the EU and is not shared with third parties for their own purposes.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR); the legitimate-interest assessment is available on request. You can object at any time. The Global Privacy Control (GPC) browser signal is honoured automatically, and objections are also accepted by e-mail at info@idodo.cz.

Google Analytics 4

The tool is prepared but not running on this site. If we enable it, it will load exclusively after your consent in the cookie bar (Consent Mode v2, default “denied”), with Google Ireland Ltd. / Google LLC as the recipient and transfers to the USA under the EU-U.S. Data Privacy Framework. Until then, the site does not load Google Analytics. Embedded YouTube videos, a Google service, are described in the next section.

Third-party embedded content and map

Some Content Hub articles contain embedded players from YouTube (Google), Spotify, SoundCloud, Vimeo or Apple Podcasts. For now the player loads together with the article page, that is before you make any choice in the cookie bar. Its provider receives your IP address, browser details and the domain of our site from your browser and may store its own cookies on your device. It processes the data under its own policies, including in the USA. We are preparing a change after which a player loads only when you click it.

Until they are moved to our own storage, the images and videos in articles load from the server of DODO's previous website (www.idodo.cz and its language versions), which a hosting provider runs for us. Your browser passes it your IP address, browser details and the domain of our site.

The order-tracking demo on the e-commerce delivery page loads its map tiles from the OpenFreeMap service (tiles.openfreemap.org). Your browser passes it your IP address, browser details and the domain of our site.

Site operation and security

The application, the database and its backups run on EU infrastructure (Zerops s.r.o., Prague). Deleted data may remain for a limited time in the database backups, which serve only to restore the site after a failure: our daily backup is kept for 30 days, the hosting's automatic backups according to its backup plan (currently at least three months).

The Sentry error-reporting tool is prepared in the code but switched off, so it receives no data. The purpose of the processing in this section is operating and securing the site; the legal basis is legitimate interest (Art. 6(1)(f) GDPR).

Transfers to the USA

We transfer enquiry data to the USA only to Resend, Inc., which delivers the e-mail notification of a new enquiry to our team; the transfer relies on standard contractual clauses. The providers of embedded players may also process the data they receive from your browser in the USA (see Third-party embedded content and map).

Your rights

You have the right to access your data, to rectification and erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interest. Requests are handled within the statutory deadlines.

Where processing relies on your consent, for example the optional categories in the cookie bar, you can withdraw it at any time, as easily as you gave it: with the cookie icon in the bottom-left corner of the site or on the cookies page. Withdrawal applies to further processing; processing carried out before it remains lawful.

You also have the right to lodge a complaint with the supervisory authority, the Czech Office for Personal Data Protection (uoou.gov.cz).

Contact

For any question or request concerning personal data, contact us by e-mail.