We process personal data exclusively in compliance with the General Data Protection Regulation (GDPR) and all applicable German data protection laws.

1. Controller

DooDigital Agency
Owner: Björn Juncker
Address: Am Kleesbrock 20, 33719 Bielefeld-Heepen, Germany
E-mail: info@doodigital.agency
Phone: +49 170 906 8195

2. Personal Data We Collect

2.1 Automatically Collected Data

When you visit our website, certain technical data is automatically collected, including:

• IP address (anonymized where possible)

• Browser type and version

• Device information

• Referrer URL

• Session duration and interaction data

• Log files related to security and performance

We use this information to ensure proper website operation, security, optimization, and analytics.

2.2 Contact Forms & Brief Generator

When using our contact forms or Brief Generator, we collect:

• Name

• E-mail address

• Project details

• Uploaded files (images, documents, etc.)

• Additional information you voluntarily provide

Purpose of processing:

• Communication and responding to inquiries

• Preparation of offers

• Execution of projects

• File handling and project planning

2.3 Cookies

We use technically necessary cookies and, if you consent, analytics and performance cookies.
A cookie banner allows you to accept or reject non-essential cookies at any time.

3. Analytics and Third-Party Tools

We use the following external tools and service providers:

3.1 Google Analytics (GA4)

Provider: Google Ireland Ltd.
Purpose: Analytics, website performance insights.
Data processed: anonymized IP address, device data, behavior patterns, session information.
Legal basis: Art. 6(1)(a) GDPR (consent).
International transfers: possible to the USA; Google participates in the EU–US Data Privacy Framework.
You may withdraw consent at any time via cookie settings.

3.2 Cloudflare

Provider: Cloudflare Inc.
Purpose: Security, performance optimization, CDN, DDoS protection.
Data processed: IP addresses, security-event logs, routing data.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable website operation).
International transfers may occur.

3.3 SEMRush

Provider: Semrush Inc.
Purpose: SEO analytics and performance insights.
Data processed: anonymized or pseudonymized usage data.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving online presence).

3.4 Microsoft Clarity

Provider: Microsoft Corporation.
Purpose: Heatmaps, click tracking, session analysis.
Data processed: device information, movement data, interaction patterns.
Form field content is not recorded.
Legal basis: Art. 6(1)(a) GDPR (consent).

4. Purpose of Processing

We process personal data for:

• Operating and optimizing our website

• Ensuring security and stability

• Responding to inquiries and project requests

• Preparing offers and providing services

• Analyzing website usage (with consent)

We never sell or share data for advertising by third parties.

5. Legal Basis for Processing

Depending on the context, processing is based on:

• Art. 6(1)(a) GDPR – consent (e.g., analytics tools)

• Art. 6(1)(b) GDPR – performance of a contract (e.g., form submissions for project work)

• Art. 6(1)(f) GDPR – legitimate interests (security, server logs, Cloudflare)

6. Data Retention

We store personal data only as long as necessary for its purpose.
Specifically:

• Inquiry and project data: deleted when communication or cooperation is completed, unless legal retention applies.

• Uploaded files: deleted upon request or once no longer needed.

• Analytics data: retained according to respective provider policies (usually anonymized or auto-deleted).

7. Your Rights Under GDPR

You may exercise the following rights at any time:

• Right of access (Art. 15 GDPR)

• Rectification (Art. 16 GDPR)

• Erasure (Art. 17 GDPR)

• Restriction of processing (Art. 18 GDPR)

• Data portability (Art. 20 GDPR)

• Objection to processing (Art. 21 GDPR)

• Withdrawal of consent (Art. 7 GDPR)

Contact for rights requests: info@doodigital.agency

8. Data Sharing & Processors

We only share data with service providers who process data on our behalf (Data Processors), such as hosting providers or analytics tools.
Where required, Data Processing Agreements (DPAs) exist according to Art. 28 GDPR.

9. Security Measures

We take appropriate technical and organizational measures, including:

• SSL encryption

• Cloudflare security systems

• Access controls

• Regular monitoring of hosting and website infrastructure

10. International Data Transfers

Some tools may transfer data to countries outside the EU (e.g., Google, Microsoft, Cloudflare, Semrush).
Transfers occur based on:

• Adequacy decisions (e.g., EU–US Data Privacy Framework)

• Standard Contractual Clauses (SCCs)

• Additional safeguards provided by the respective vendor

11. Changes to This Privacy Policy

We may update this policy to reflect technical, legal, or operational changes.
Latest update: December 2025