Who stores your data.
The data controller is DUEVO 2000 s.r.o., my own company, which I run myself, as Edith. No marketing team, no CRM with ten seats. When I write back, I'm the one reading your message.
- — Controller
- DUEVO 2000 s.r.o.
registered in the Commercial Register kept by the Regional Court in Brno, file C 113214 - — Company ID
- 08349550
- — VAT ID
- CZ08349550
- — Registered address
- Přístavní 323/39, Brno-Bystrc, 635 00, Czech Republic
- edithvodova@gmail.com
- — Phone
- +420 731 330 086
Given the size of the operation, I don't have a Data Protection Officer. For anything related to this text, write to me directly, I reply myself.
What data I receive from you.
Three kinds. No fourth.
When you submit an enquiry
- Name, so I know what to call you.
- Email and/or phone, so I can reply.
- Date and type of event, headcount, venue, what you have in mind, so I can even tell you whether I can make the date and what it will cost.
When we keep writing
Anything you tell me yourself by email, text or phone: typically menu refinements, guest allergies, dietary requirements, billing details. Special-category data (e.g. health information about allergies) is given voluntarily and I use it only to prepare your specific event.
When you browse the site
Aggregated data about which pages get opened, how long people stay, what device and what country. None of it is linked to you, and nothing is stored on your device, see Cookies and analytics below.
Why I need it.
Every piece of data has a reason and a legal basis. Here they all are:
- Preparing a proposal and contract: without contact details I simply can't send you anything. Legal basis: steps prior to entering into a contract (Art. 6(1)(b) GDPR).
- Performing the contract and the catering itself: once we agree, I need the data to deliver the event, issue the invoice and process payment. Legal basis: performance of a contract.
- Accounting and taxes: I have to archive invoices and records by law. Legal basis: legal obligation (Czech Accounting Act, VAT Act).
- Improving the website: so I can see what visitors are interested in and what bores them. Legal basis: legitimate interest (Art. 6(1)(f)), anonymous and aggregated.
- References and photos from events: if I want to publish a photo from your event, I always ask first. Without your consent, nothing goes anywhere.
Who I share with.
Only those without whom the site and my work wouldn't function. No one else. No selling, no databases, no „partners get the newsletter“.
- Web hosting providerHosting, email inboxes and backups. They could technically access message contents, but they have contracted not to.— EU / CZ
- Vercel Inc.Site hosting and traffic measurement. Every request to the site passes through it. The analytics is cookieless and aggregated. The transfer to the USA is covered by the EU Standard Contractual Clauses.— USA
- AccountantInvoices and records for accounting purposes. Sees only what's on them: billing details, event description.— CZ
- Bank and payment servicesBank transfer payments. Sees who paid me and how much, nothing more.— CZ / EU
- Event subcontractorsIf I work with a florist, photographer or service staff on a specific event, I share only what's necessary: typically time, place, headcount.— CZ · per event
Some data is processed in the USA: the site runs on Vercel and every request passes through it. Their data processing agreement states that their primary processing facilities are in the United States, and they offer no EU data residency. The transfer is covered by the Standard Contractual Clauses approved by the European Commission (decision 2021/914). I pass data to no other recipient outside the EEA.
How long I keep it.
Principle: as briefly as it makes sense, no longer than the law requires.
- Enquiries without a booking: 1 year from the last contact. After that I ask whether you're still planning, or delete it all.
- Contract and invoicing: for the duration of the engagement + 10 years for accounting and tax archiving.
- Cookies: the language cookie until you close the browser. Analytics sets no cookies at all.
- Email correspondence: 3 years from the last reply, then I remove it from the inbox.
- Photos from events: if you've consented to publication, until you withdraw consent.
Your rights.
GDPR gives you seven concrete rights. Just write and I'll have it handled within a week.
Right of access
You can ask what I hold about you. I'll send you an export.
Right to rectification
Wrong phone number, typo in your name? I'll fix it straight away.
Right to erasure
„Forget me.“ I delete everything I'm not required by law to keep.
Right to restriction
Don't delete, but pause use. For instance while something is being sorted out.
Right to portability
I'll send your data to you in a structured format.
Right to object
Analytics keeps no record of you to object to, it is aggregated. You can block it in your browser.
Right to withdraw consent
Wherever you've given consent (cookies, photos), you can take it back the same way.
Right to complain
If something doesn't sit right, you can file a complaint with the Czech Data Protection Authority (ÚOOÚ).
How to reach me.
For anything about your data (access, correction, erasure, any question from here), just write. No form. No ticketing system. Email or phone.
- edithvodova@gmail.com
usually a reply within 24 hours - — Phone
- +420 731 330 086
Mon–Fri, 9–18 - — Post
- DUEVO 2000 s.r.o., Přístavní 323/39, Brno-Bystrc, 635 00, Czech Republic
Changes to this text.
If I ever start using a new tool, or the operation grows to the point where I'm no longer handling the data alone, I'll update this text and change the date at the top. No silent changes.
I won't email you about it (I don't want to spam), but if it's a truly material change (an additional processor outside the EEA, say), I'll write separately to those affected.