Privacy & cookies
1. Who is responsible for your data?
JDS & Co s.r.o., company ID 23583347
Anenská 546/8, Liberec III-Jeřáb, 460 07 Liberec, Czechia
Registered with the Regional Court in Ústí nad Labem, Section C, File 54407.
Email: info@jdsandco.cz · Telephone: +420 602 192 453
We are the controller when handling our own enquiries, arranging services and training, and managing our operations. Contact the email address above about data protection. Our offer of external DPO services to clients does not itself mean that we have appointed a DPO for our own operations.
2. What we process, why and for how long
We keep personal data for the relevant purpose and periods below, then delete or anonymise it. A dispute may justify keeping necessary evidence until it is resolved. Statutory retention depends on the document concerned.
| Situation and information | Purpose and legal basis | Retention |
|---|---|---|
| Enquiry: name, email, telephone, organisation and message. | Responding and preparing a contract at an individual's request: Article 6(1)(b) GDPR. For an organisation's contact persons: legitimate interest in business communication, Article 6(1)(f). | Unsuccessful enquiries: up to 6 months after the last substantive communication, unless a specific claim justifies longer retention. |
| Contracts, orders, contacts, agreed outputs and delivery records. | Contract performance for individuals; legitimate interest for organisational representatives. Necessary evidence for establishing or defending claims: legitimate interest. | During the contract; necessary evidence generally for 3 years after settlement. A dispute or specific longer limitation period may justify retaining relevant evidence for longer, not all underlying information automatically. |
| Billing and accounting details, payer identity and payment. | Legal accounting and tax obligations: Article 6(1)(c). | Accounting documents generally 5 years after the relevant accounting period; financial statements 10 years. A particular tax proceeding or legal duty may require longer retention. |
| Training participants: name, work contact, attendance and confirmation. | Organising and evidencing training: contract performance for direct customers, legitimate interest for employees attending through an organisation. | Organisational lists up to 3 months after the event; minimum records of issued confirmations 3 years. Any longer mandatory period for funded projects is communicated beforehand. |
| Data protection requests and necessary identity verification. | Compliance with GDPR obligations: Article 6(1)(c), with a minimum record of how the request was handled. | Necessary records up to 3 years, with regular reviews of need. Identity document copies are not routinely requested. |
Without necessary contact or contractual information, we may be unable to respond or deliver the service. Accounting information is required by law. Please do not send optional information that is not relevant to your enquiry.
3. Sources, recipients and service providers
We normally receive data from you. An employer or client may supply details of training participants or other contacts. Where required, we provide them with privacy information at the first communication and no later than the applicable legal deadline, subject to statutory exceptions.
Authorised collaborators, accountants, hosting and email providers, IT support, banks and specialists involved in an assignment may receive information as necessary. Processors act under agreed instructions and security arrangements. An attorney may act as an independent controller; we inform the client before the relevant disclosure. We disclose information to public authorities when legally required.
- ACTIVE24: website hosting and the info@jdsandco.cz email service, including necessary technical data and email content.
- Apple iCloud: storage and synchronisation of work documents and supporting information, depending on the files included.
- Telephone consultations: telephone numbers and connection details are also processed by the relevant telecommunications operator. We do not automatically record calls.
- Video consultations: use of Google Meet or another platform is agreed in advance. We identify the service and processing arrangements before sending an invitation. Videoconferencing is not embedded in this website.
- Google Analytics: optional measurement described below.
Cloud services may use infrastructure or support outside the European Economic Area. We therefore cannot state that all information remains in the EU. International transfers are subject to Chapter V GDPR. Contact us for details of the safeguards used and how to obtain a copy. Client databases, health information and similarly sensitive material should not be sent through an ordinary enquiry: we first agree the necessary scope and a suitable transfer method.
4. Website scans, enquiries and private administration
Our server retrieves the public entry page and up to five linked HTML documents. It respects automated-access rules, does not execute JavaScript or submit forms on the scanned website, and does not send their content to an external AI service. The scan is not automated decision-making with legal or similarly significant effects.
Without an email address: you can view and download the result in your browser. On ACTIVE24 hosting, we retain the website address, scan time, discovered links, short text indicators and technical result under a random identifier for 24 hours. This is not a public directory of results. The purpose is to provide the requested service and allow you to attach its result to a subsequent enquiry. The basis is Article 6(1)(b) GDPR, or a legitimate interest in handling a request from an organisation's contact person under Article 6(1)(f).
Requesting a proposal: only at your request do we link the result to your email, optional phone number, selected service and message. The confirmation link expires after 24 hours. An unconfirmed enquiry also expires after 24 hours. Confirmation verifies access to the email inbox, not ownership of the scanned domain. Confirmed scanner enquiries are retained for no more than 180 days after confirmation. If you become a client, necessary information follows the contractual retention rules above. An enquiry is not a marketing subscription.
Security: results and contact details are not publicly accessible. Administration requires a password stored as a secure hash. Password recovery uses a one-time link, valid for 30 minutes, sent to the designated administrator's email. To prevent abuse, a daily changing cryptographic hash of the IP address and request counts are retained for up to 24 hours on the basis of legitimate interests in security. Hosting logs are separate technical processing.
Expired application records become inaccessible and are deleted during database cleanup triggered by service requests. Any hosting backups follow the provider's separate retention cycle. Do not enter passwords, health information or client databases into the form. Only scan a website you operate or are authorised to check. Agree a secure method with us before sharing sensitive documents. Authorised administration staff and the hosting provider have access only as necessary.
5. Optional email updates
Subscription to GDPR Legal updates is handled by email. The subscription link on the Czech website opens a prepared message; the website does not submit the email address itself. We confirm enrolment by reply. If you send only a brief request, we first send the subscription terms for confirmation.
JDS & Co s.r.o. processes the subscriber's email, the date, content and method of consent, and any unsubscribe request to send GDPR, cookie, AI and website-obligation updates and offers of our services. The legal basis is voluntary consent under Article 6(1)(a) GDPR; marketing messages are also governed by Section 7 of Czech Act No. 480/2004 Coll.
Consent lasts for 2 years unless withdrawn earlier. Unsubscribe free of charge by replying to any message or emailing info@jdsandco.cz. Withdrawal does not affect the lawfulness of earlier processing. Each message identifies the sender and offers a way to unsubscribe. Our other services do not depend on subscribing.
After withdrawal, we remove the address from the active mailing list. Minimum evidence of consent and withdrawal may be kept on the basis of legitimate interest for as long as necessary, generally up to 3 years, to demonstrate the lawfulness of earlier messages. Longer retention requires a specific reason. A limited suppression record helps prevent accidental re-enrolment while the mailing activity continues; we regularly review its necessity. Authorised staff and the email provider handle subscriptions. No external bulk-mailing platform is currently connected.
6. Your rights
Subject to GDPR conditions, you can request access and a copy, correction, erasure, restriction and, where automated processing is based on consent or contract, portability. You can object to processing based on legitimate interests for reasons relating to your circumstances. You can object to direct marketing at any time without giving a reason. Where consent is used, you may withdraw it at any time without affecting earlier lawful processing.
Send requests to info@jdsandco.cz. We respond without undue delay, normally within one month. If a lawful extension of up to two further months is needed, we explain the reason within the first month. We verify identity only as needed and proportionately to the risk. Rights are not absolute; any applicable limitation will be explained.
You can complain to the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, or another competent supervisory authority. You do not have to contact us first.
7. Cookies and optional measurement
We use Google Analytics for website statistics and Google Ads to measure advertising results. Each is a separate, optional choice in Cookie settings. Before consent to the relevant service, its tag does not run. If both are rejected, Google measurement does not load. The website and enquiry forms remain available.
Reject optional and Accept optional are equally accessible in the first layer. Settings lets you choose each purpose separately; both are off by default. Closing the banner or scrolling is not consent. Your choice is stored as gdprlegal-consent-v2 in localStorage for 180 days. This necessary record includes the date and notice version.
Analytics cookies _ga and _ga_* last up to 180 days. Advertising measurement cookies _gcl_* last up to 90 days. The necessary gdprlegal_session cookie protects requested forms, scans and administration for the browser session. It does not require measurement consent.
With analytics consent, we count visits, contact-link clicks and submitted and confirmed service enquiries. With separate advertising-measurement consent, Google Ads receives an event only after the server successfully confirms an AI-service enquiry. Opening a page or clicking Submit is not a confirmed enquiry.
Data includes pseudonymous identifiers, time, page path, referring domain and device/browser information. With advertising-measurement consent, Google click identifiers gclid, gbraid or wbraid may be included. Other URL parameters and fragments are removed from the measured page address. IP addresses are technically transmitted to Google; this is not fully anonymous processing. We do not send enquiry content, names, emails, phone numbers, enquiry IDs, verification tokens or scanned website addresses. Private administration, scans and reports are excluded.
We do not use remarketing, Google Signals, ad personalisation, enhanced conversions using contact details or automatic collection of form contents. Google Ireland Limited provides the services under the applicable data-processing terms and controller terms. Data may be processed outside the EEA, including the USA, under the applicable transfer safeguards. Contact us for further information or a copy of relevant safeguards.
The legal basis is consent under GDPR Article 6(1)(a), with prior consent to optional cookies under section 89(3) of Czech Act No. 127/2005. Analytics user/event retention is two months without renewal; aggregate reports have a different retention regime. The Google Ads click-through conversion window is 30 days, which is not the provider's data-retention period.
Withdraw consent through Cookie settings by turning off a category and saving, or selecting Reject optional. We stop further measurement and remove accessible cookies of that category; the page may reload to unload the vendor code. Withdrawal does not retroactively change lawfulness or automatically erase data already sent to Google. See section 6 for your rights and the detailed Czech cookie notice.