Privacy policy.

Who is responsible

The controller under the General Data Protection Regulation (GDPR / DSGVO) is:

You can contact us here for questions about this policy or to exercise your data-protection rights.

Hosting & security

We host this website on a VPS provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Our hosting region is Europe. IONOS processes hosting data on our behalf.

When you visit, the server receives technical information needed to deliver the website. Server logs may contain your IP address, request time, requested URL, response status, referrer, browser and operating-system information. We use these records to maintain availability, diagnose faults and investigate abuse. The legal basis is our legitimate interest in operating a reliable, secure website, Art. 6(1)(f) GDPR.

Routine logs are subject to the server’s automatic log rotation. We retain technical records for as long as needed to diagnose faults and protect the service; records needed to investigate a specific security incident may be retained until that investigation is complete.

Connections to this site use HTTPS to encrypt data in transit. Our fonts are served from our website; displaying them does not connect your browser to Google Fonts.

Contact forms, email & Resend

When you contact us, we process your name, email address, message and any company or service information you choose to provide. This lets us answer your inquiry, discuss a project and follow up. The required form fields are needed to handle your request; company and service details are optional.

For contractual and pre-contractual inquiries, the basis is Art. 6(1)(b) GDPR. For other correspondence, it is our legitimate interest in answering inquiries under Art. 6(1)(f) GDPR. Accepting statistics is not a condition of sending a message. An inquiry does not subscribe you to marketing emails.

Form messages are delivered to info@doodigital.agency using Resend, operated by Plus Five Five, Inc., USA. Resend processes the submitted details, email content and delivery metadata on our behalf. Its service stores customer data in the US; its published retention for email and log data on standard plans is 30 days. Resend provides an Art. 28 data-processing addendum and Standard Contractual Clauses for transfers. See Resend’s GDPR information and data-processing addendum.

Our copy of an inquiry remains in our mailbox while we handle the request and any related follow-up. We delete it when it is no longer needed, unless legal retention duties or the establishment, exercise or defence of legal claims require further storage. Provider delivery-log retention is separate from mailbox retention.

To limit automated abuse, the form uses an empty-field check and request limits. The request-limit records contain a keyed hash of the sender address and time-based counters, not message content. They expire from use after the current hourly window and are removed during subsequent cleanup. This processing supports our legitimate interest in protecting the contact service under Art. 6(1)(f) GDPR.

Cookies & your choices

Optional statistics are off by default. The banner lets you accept or reject them with equally accessible controls. The Statistics category covers Google Analytics and Microsoft Clarity, including session recordings and heatmaps. Advertising consent remains off.

We store your selection, its timestamp and the notice version in your browser’s local storage under dd_consent. The choice is valid for 180 days, unless you change it, clear browser storage or we update the consent version. This preference storage is necessary to honour your choice, under § 25(2) TDDDG and Art. 6(1)(f) GDPR.

Optional storage and access rely on your consent under § 25(1) TDDDG; the related personal-data processing relies on Art. 6(1)(a) GDPR. You can withdraw consent through Cookie settings in the footer or here. Withdrawal stops future statistics collection on this site and removes accessible first-party analytics cookies. It does not invalidate earlier processing or automatically delete data already held by a provider.

Necessary website functions, the contact form and your choice to book a call remain available when you reject statistics.

Google Tag Manager & Analytics

After Statistics consent, Google Tag Manager loads our analytics tools. Both Tag Manager and Google Analytics 4 are provided in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC in the US and other Google service providers may also process data.

Analytics helps us understand which pages people visit and whether the site leads to inquiries. Data can include page URLs, referrers, approximate location, device and browser details, cookie identifiers, page views, scrolling and link interactions. Google receives the IP address needed for the connection; Google states that GA4 does not log or store individual IP addresses.

We measure the start and successful submission of contact forms using form identifiers only. We also measure telephone, email, WhatsApp and booking-link clicks. We do not send form field values to Analytics. A booking-link click does not tell us whether an appointment was completed.

Analytics can set _ga and _ga_* cookies, typically with a lifetime of up to two years, subject to browser and account settings. User- and event-level retention follows the property setting, up to 14 months for a standard GA4 property; aggregated reports can remain available longer. Cookie lifetime and report retention are separate.

The basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Read Google’s privacy policy and its Analytics data safeguards.

Microsoft Clarity

With Statistics consent, we use Microsoft Clarity, a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA, to understand how people use the site and where navigation or layout causes difficulty.

Clarity collects interaction and technical data, such as clicks, scrolling, pointer movement, page views, browser and device information, identifiers and IP-related information. It creates heatmaps and session recordings of website interactions. Our contact form is marked for masking so its content is excluded from recordings. We do not send names, email addresses or other form values as Clarity identifiers.

Clarity uses cookies such as _clck to recognise a browser and _clsk to connect page views within a session. Microsoft documents 30-day playback retention; labelled or favourited sessions and heatmap data can be retained for up to 13 months. Processing may take place in the US.

The basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Microsoft also processes data under its applicable service terms and privacy statement. See Microsoft’s privacy statement and Clarity’s retention information.

Google Calendar booking

Our booking dialog initially shows an explanation rather than a Google iframe. Choosing “Load Google Calendar” gives consent to load the external calendar for that opening of the dialog. This consent is independent of Statistics. Closing the dialog removes the embed; loading it again requires another choice. You can also arrange a call by email.

Loading the calendar connects your browser to Google Ireland Limited and potentially Google LLC in the US. Google receives technical connection data, including your IP address, and may access cookies or associate activity with your Google account if you are signed in. Opening the external calendar link takes you directly to Google instead.

For the embedded calendar, the basis is Art. 6(1)(a) GDPR and, where storage or access takes place, § 25(1) TDDDG. When you book, we receive the contact and appointment details you submit to organise and conduct the call. That processing is based on Art. 6(1)(b) GDPR for a prospective project, or Art. 6(1)(f) GDPR for other appointments. We retain appointment correspondence while needed to arrange and follow up on the conversation, subject to applicable legal retention duties.

Google’s processing is also described in its privacy policy.

WhatsApp & external links

WhatsApp contact is optional. In the European region the service is provided by WhatsApp Ireland Limited. If you choose it, WhatsApp processes account, phone-number, connection and usage information under its own terms; processing may involve the US and other countries. We use your message and contact details to answer your inquiry on the bases described under Contact. You can use email or our form instead. See WhatsApp’s privacy policy.

Our project-brief link opens our separate DooCRM tool at crm.doodock.com. The information you provide there is used to understand and respond to your project request. Please consult the privacy information shown in that application for its own technical processing. This website does not embed its form or record brief submissions.

Other external links, including our social profiles, Clutch and Dribbble, open services with their own privacy policies. These services receive connection data when you visit them; their content is not embedded merely by displaying a link here.

International transfers

Our European hosting region does not mean all services process data only in Europe. Google, Microsoft, Resend and messaging services may process data in the US or other countries. Depending on the recipient and service, transfer safeguards include an applicable adequacy decision, such as the EU–US Data Privacy Framework for a certified recipient, or the European Commission’s Standard Contractual Clauses under Art. 46 GDPR.

The provider notices linked above explain their transfer arrangements. You can contact us for information about the safeguards applicable to processing on our behalf. Consent to Statistics and to loading the calendar can be withdrawn as described above.

Your rights

Subject to the conditions in the GDPR, you may request access (Art. 15), correction (Art. 16), erasure (Art. 17), restriction (Art. 18) and portability (Art. 20) of your personal data.

You may object to processing based on Art. 6(1)(f) GDPR for reasons relating to your particular situation (Art. 21). You may object to direct marketing at any time. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

Contact info@doodigital.agency to exercise your rights. You may also complain to a data-protection supervisory authority, including the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), or the authority where you live or work.

We do not use your inquiry or website interactions to make solely automated decisions with legal or similarly significant effects under Art. 22 GDPR.

About this policy

We update this policy when our website, providers or processing practices change. The date above identifies this version. Material changes to optional tracking may require a fresh consent choice.