Privacy Policy

Last update:
January 8, 2026

1. Introduction and Controller Identity

WDF s.r.o. ("Company," "we," "us," or "our"), a limited liability company incorporated under the laws of the Czech Republic, is the Data Controller regarding your personal data.

  • Registered Office: Lazarská 13/8, 120 00 Prague 2, Czech Republic
  • Company ID (IČO): 24836974
  • VAT ID: CZ24836974
  • File Number: C 178933, maintained by the Municipal Court in Prague
  • Email: hello@wdf.cz
  • Phone: +420 732 777 791

We are committed to protecting the privacy and security of our clients, website visitors, and job applicants. This Privacy Policy outlines how we collect, process, and protect your personal data in compliance with Regulation (EU) 2016/679 (GDPR) and Act No. 110/2019 Coll., on Personal Data Processing.

2. Categories of Personal Data We Collect

We collect and process the following categories of personal data depending on your interaction with our website and services:

  • Identity Data: First name, last name, username, or similar identifier. (Source: Provided by you via Contact Form).
  • Contact Data: Email address, telephone number, billing address, delivery address. (Source: Provided by you via Contact Form/Contract).
  • Professional Data: Company name, job title, project requirements, budget estimates. (Source: Provided by you via B2B Inquiry).
  • Recruitment Data: CVs, cover letters, education history, employment history, LinkedIn profile URL. (Source: Job Application).
  • Technical Data: IP address (anonymized), browser type and version, time zone setting, operating system, device type. (Source: Collected automatically via Analytics).
  • Usage Data: Information about how you use our website, clickstreams, time spent on pages, page interaction data. (Source: Collected automatically via Analytics).

3. Purposes and Legal Basis for Processing

We process your data for the following purposes based on the legal grounds listed below:

3.1. Provision of Services and Pre-Contractual Measures
  • Purpose: To respond to your inquiries submitted via our contact forms regarding our software development and UX/UI design services; to prepare price quotations; to conclude Service Level Agreements (SLAs).
  • Legal Basis: Performance of a Contract (Art. 6(1)(b) GDPR). Processing is necessary to take steps at your request prior to entering into a contract.
3.2. Recruitment and Talent Acquisition
  • Purpose: To evaluate your application for positions such as "Senior IT Project Manager" or developer roles; to schedule interviews.
  • Legal Basis: Performance of a Contract (Art. 6(1)(b) GDPR) for the duration of the selection process.
  • Extended Retention: If you wish for us to keep your CV on file for future opportunities after a specific recruitment drive has ended, we process this based on your Explicit Consent (Art. 6(1)(a) GDPR).
3.3. Website Analytics and Performance
  • Purpose: To analyze website traffic using Google Analytics 4; to improve user experience; to identify popular content.
  • Legal Basis: Consent (Art. 6(1)(a) GDPR). We do not process this data unless you have clicked "Accept" on our Cookie Banner.
3.4. Marketing and Business Development
  • Purpose: To send newsletters, case studies, or invitations to industry events.
  • Legal Basis:
    • For existing clients: Legitimate Interest (Art. 6(1)(f) GDPR), subject to your right to opt-out.
    • For new prospects: Consent (Art. 6(1)(a) GDPR) obtained via a checkbox in our contact forms.
3.5. Legal Compliance and Defense
  • Purpose: To comply with tax and accounting obligations; to defend legal claims.
  • Legal Basis: Legal Obligation (Art. 6(1)(c) GDPR) and Legitimate Interest (Art. 6(1)(f) GDPR).

4. Use of Cookies and Tracking Technologies

Our website uses cookies to distinguish you from other users. Due to the requirements of the Czech Electronic Communications Act, we categorize cookies as follows:

  1. Strictly Necessary Cookies: Essential for the operation of the website (e.g., security tokens, load balancing). These do not require consent.
  2. Analytical Cookies (Google Analytics): Used to track visitor behavior. These are disabled by default and are only activated upon your explicit consent via our Consent Management Platform (CMP).

Google Analytics 4 (GA4): We use GA4 to collect anonymized statistical data. We have configured GA4 to:

  • Anonymize IP addresses (IP Masking).
  • Retain data for a maximum of 14 months before automatic deletion.
  • Disable data sharing with other Google services unless explicitly authorized.

You may withdraw your consent for cookies at any time via the "Privacy Settings" link in the footer of our website.

5. Data Sharing and International Transfers

We may share your personal data with selected third parties:

5.1. Internal Group Transfers

As a global company, we may share administrative data with our branch offices:

  • Scandinavia (Oslo, Norway): Norway is a member of the EEA. Data flows between Prague and Oslo are treated as intra-EU transfers.
  • USA (Charlotte, NC): Transfers to our US office are safeguarded by Standard Contractual Clauses (SCCs) adopted by the European Commission, ensuring an adequate level of protection comparable to the EU.
5.2. External Service Providers

We utilize third-party processors to support our operations (e.g., Hosting Services, CRM Systems). Where these providers are located outside the EEA (specifically in the USA), we rely on the EU-US Data Privacy Framework (for certified entities) or SCCs to legitimize the transfer.

6. Data Retention

We retain personal data only as long as necessary:

  • Client Inquiries: Deleted 3 years after the last interaction if no contract is concluded.
  • Contractual Data: Retained for 10 years as required by the Czech VAT Act and Accounting Act.
  • Recruitment Data: Deleted immediately after the position is filled, unless consent is given for archiving (typically 1 year).

7. Your Rights

Under the GDPR, you have the following rights regarding your data:

  • Right of Access: Request a copy of the data we hold about you.
  • Right to Rectification: Correct inaccurate data.
  • Right to Erasure: Request deletion of data ("Right to be Forgotten").
  • Right to Restriction: Pause processing under certain conditions.
  • Right to Object: Object to processing based on legitimate interest or for direct marketing.
  • Right to Data Portability: Receive your data in a machine-readable format.

To exercise these rights, please contact us at hello@wdf.cz. We will respond within one month.