Last Updated: January 10, 2025

Effective Date: January 10, 2025

Data Controller: Jan & Mark Solutions s.r.o. Kouřimská 2242/21, Vinohrady 130 00 Praha, Czech Republic IČO: 21285969 Email: privacy@doggyq.com Data Box: ke9hczs

YOUR PRIVACY RIGHTS This Privacy Policy explains how we collect, use, share, and protect your personal information. We are committed to GDPR compliance and protecting your privacy rights. You have the right to access, correct, delete, and export your data at any time.

1. Introduction

Jan & Mark Solutions s.r.o. ("we", "us", "our") operates the DoggyQ website and service ("Service"). This Privacy Policy describes how we collect, use, store, and protect your personal data in compliance with:

• EU General Data Protection Regulation (GDPR)

• Czech Act No. 110/2019 Coll. on Personal Data Processing

• ePrivacy Directive (Cookie Law)

• Other applicable data protection laws

2. Personal Data We Collect

2.1 Information You Provide

Data Type

Examples

Purpose

Account Data

Email, name, password

Account creation, authentication

Payment Data

Billing info, transaction ID

Payment processing (via Stripe)

Quiz Responses

Lifestyle preferences, living situation

Generate breed recommendations

Communication

Support emails, feedback

Customer support, service improvement

2.2 Information Collected Automatically

Usage Data: Pages visited, features used, time spent

Device Data: IP address, browser type, device type, OS

Cookies: Session cookies, analytics cookies (see Cookie Policy)

Location Data: Country/region (inferred from IP for tax purposes)

IMPORTANT: We do NOT store credit card numbers. All payment data is processed securely by Stripe, Inc. and subject to their privacy policy. We only receive transaction IDs.

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

3.1 Contract Performance (Art. 6(1)(b))

Processing necessary to provide the DoggyQ Premium service you purchased:

• Account creation and management

• Quiz delivery and breed recommendations

• Payment processing and billing

• Customer support

3.2 Legitimate Interest (Art. 6(1)(f))

Processing necessary for our legitimate business interests:

• Service improvement and development

• Fraud prevention and security

• Analytics and performance monitoring

• Business operations and administration

3.3 Consent (Art. 6(1)(a))

With your explicit opt-in consent:

• Marketing emails and newsletters (opt-in only)

• Non-essential cookies (opt-in via cookie banner)

• Optional data collection for features

3.4 Legal Obligation (Art. 6(1)(c))

Processing required to comply with legal obligations:

• Tax and accounting requirements

• Anti-money laundering regulations

• Court orders or regulatory requests

4. How We Use Your Personal Data

4.1 Service Provision

• Create and manage your account

• Process quiz responses and generate recommendations

• Deliver premium features and content

• Process payments and issue receipts

• Provide customer support

4.2 Service Improvement

• Analyze usage patterns (anonymized data)

• Improve breed matching algorithms

• Fix bugs and technical issues

• Develop new features

4.3 Security and Fraud Prevention

• Detect and prevent fraudulent transactions

• Monitor for security threats

• Enforce Terms of Service

• Prevent abuse and spam

4.4 Legal and Compliance

• Comply with legal obligations

• Respond to legal requests

• Protect our legal rights

• Maintain tax and financial records

4.5 Marketing (Opt-In Only)

IMPORTANT: We will NEVER send you marketing emails without your explicit opt-in consent. You can unsubscribe at any time. Transactional emails (receipts, support) are not affected by marketing preferences.

5. How We Share Your Personal Data

We do NOT sell your personal data. We only share data with trusted third parties as described below:

5.1 Service Providers

Provider

Purpose

Data Shared

Stripe, Inc. (USA)

Payment processing

Email, billing info, transaction data

Supabase (USA)

Database hosting, authentication

Account data, quiz responses

Vercel, Inc. (USA)

Web hosting, CDN

Usage data, IP addresses

Google Analytics (USA)

Analytics (with consent)

Anonymized usage data, demographics

5.2 International Data Transfers

Some of our service providers are located in the United States. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by EU Commission

• Provider certifications (e.g., SOC 2, ISO 27001)

• Encryption in transit and at rest

5.3 Legal Requirements

We may disclose your data if required by law, court order, or to:

• Comply with legal obligations

• Protect our legal rights

• Prevent fraud or illegal activity

• Protect safety of users or public

5.4 Business Transfers

If we are acquired or merge with another company, your data may be transferred to the new entity, subject to this Privacy Policy.

6. Data Retention

Data Type

Retention Period

Reason

Account Data

Active account + 1 year after deletion

Service provision, legal claims

Payment Records

7 years

Tax compliance (Czech law)

Quiz Responses

Active account + 1 year

Service provision

Marketing Data

Until consent withdrawal

Consent-based processing

Analytics Data

26 months (anonymized)

Google Analytics default

After retention periods expire, we securely delete or anonymize your data.

7. Your Rights Under GDPR

YOU HAVE THE FOLLOWING RIGHTS: These rights are free of charge and can be exercised at any time by contacting privacy@doggyq.com. We will respond within 30 days.

7.1 Right to Access (Art. 15)

You have the right to request a copy of all personal data we hold about you. We will provide it in a commonly used electronic format (JSON).

How to exercise: Go to Settings → Export My Data, or email privacy@doggyq.com

7.2 Right to Rectification (Art. 16)

You have the right to correct inaccurate or incomplete personal data.

How to exercise: Update in Settings → Profile, or email privacy@doggyq.com

7.3 Right to Erasure / "Right to be Forgotten" (Art. 17)

You have the right to request deletion of your personal data when:

• Data no longer necessary for original purpose

• You withdraw consent (for consent-based processing)

• You object to processing (legitimate interest basis)

• Data processed unlawfully

Exceptions: We may retain data if required by law (e.g., tax records for 7 years) or to defend legal claims.

How to exercise: Settings → Delete Account, or email privacy@doggyq.com

7.4 Right to Data Portability (Art. 20)

You have the right to receive your data in a structured, commonly used format and transmit it to another service.

How to exercise: Settings → Export My Data (JSON format)

7.5 Right to Object (Art. 21)

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

How to exercise: Email privacy@doggyq.com or unsubscribe from marketing emails

7.6 Right to Restrict Processing (Art. 18)

You have the right to request restriction of processing in certain circumstances (e.g., while we verify accuracy of data you contested).

7.7 Right to Withdraw Consent

For consent-based processing (marketing, cookies), you can withdraw consent at any time without affecting lawfulness of prior processing.

7.8 Right to Lodge a Complaint

If you believe we violate GDPR, you have the right to lodge a complaint with your local data protection authority:

Czech Republic: Úřad pro ochranu osobních údajů (ÚOOÚ) Pplk. Sochora 27 170 00 Praha 7 Website: www.uoou.cz Email: posta@uoou.cz

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

8.1 Technical Measures

Encryption: TLS/SSL for data in transit, AES-256 for data at rest

Authentication: Secure password hashing (bcrypt), optional 2FA

Access Controls: Role-based access, principle of least privilege

Monitoring: Security logs, intrusion detection

Backups: Encrypted, geographically distributed

8.2 Organizational Measures

• Regular security audits and updates

• Data processing agreements with third parties

• Employee training on data protection

• Incident response procedures

8.3 Data Breach Notification

In case of a data breach likely to result in high risk to your rights, we will:

• Notify the supervisory authority within 72 hours

• Notify affected users without undue delay

• Provide information on measures taken

IMPORTANT: No security is 100% guaranteed. While we implement industry best practices, you are responsible for keeping your password secure and logging out of shared devices.

9. Cookies and Tracking

We use cookies and similar technologies. See our Cookie Policy for detailed information. Key points:

9.1 Essential Cookies (No Consent Required)

• Authentication and session management

• Security and fraud prevention

• Load balancing

9.2 Analytics Cookies (Consent Required)

• Google Analytics (anonymized IP)

• Usage statistics and performance monitoring

You can manage cookie preferences in our cookie banner or browser settings.

10. Children's Privacy

DoggyQ is NOT intended for children under 16 years old. We do not knowingly collect personal data from children. If we discover we have collected data from a child, we will delete it immediately.

Parents/guardians who believe we may have collected data from a child should contact privacy@doggyq.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified via:

• Email to registered users

• Prominent notice on the website

• Update to "Last Updated" date

Continued use after changes constitutes acceptance. If you don't agree, stop using the Service and contact us to delete your data.

12. Contact Information

For questions about this Privacy Policy or to exercise your rights:

Data Controller: Jan & Mark Solutions s.r.o. Kouřimská 2242/21, Vinohrady 130 00 Praha, Czech Republic IČO: 21285969 Privacy Contact: Email: privacy@doggyq.com Data Box: ke9hczs Response Time: Within 30 days

Back to App