1. Who we are
21dcs spol s r.o., V Malých Domech I 583/5, 147 00 Prague, Czech Republic, IČO: 289 85 460, DIČ: CZ28985460, is the controller of the personal data processed through the Retrivo service ("Retrivo", "we", "us", "our"). Retrivo is a brand of 21dcs spol s r.o.
Contact for privacy matters: info@retrivo.app. We have not appointed a Data Protection Officer, as we are not required to.
2. Who this policy applies to
This policy explains how we process personal data of: visitors to retrivo.app; Owners (users who register a QR code and use the service); and Finders (people who use the service to contact an Owner). It also briefly covers business contacts at our dealers (section 12).
We do not sell labels to consumers. Labels are sold by independent dealers and retailers. We are the controller for the registration and message-forwarding service described below, and for this website.
3. The recovery service — how your data is used
The service works as follows, and this is the central processing activity to understand:
- As an Owner, you register a QR code and may add contact details (such as a phone number or email address).
- You choose what a Finder sees: you may display selected contact details, or keep them private.
- If you display details, a Finder who scans your code contacts you directly using those details.
- If you keep your details private, a Finder can leave a message in the notice field, and we forward that message to the email address you registered. We act as the channel so you can decide whether and how to respond.
This means that when someone acts as a Finder and submits a message, we process that Finder's personal data (their message and any contact details they provide) for the sole purpose of delivering it to the relevant Owner.
What happens when a QR code is scanned
When anyone opens a Retrivo QR link (for example by scanning a label with a phone camera), we process the following data:
- the QR code identifier contained in the link, which tells us which registered item the scan relates to;
- the IP address of the device, the browser and device type (user agent), and the date and time of the request;
- a session cookie and a matching session record on our server, which also stores the IP address, browser information and time of last activity.
We do not keep a history of scans, we do not record the location of the scanning device, and we do not notify the Owner that their code was scanned. If you use the QR scanner on our website, the camera image is processed only in your browser and is not uploaded to us.
Purpose: to show the information the Owner has chosen to display (or the message form), to let a person register a not-yet-activated code they have just scanned, and to protect the service against abuse, for example by limiting how many messages can be sent from one IP address.
Retention: session records expire after 30 days of inactivity and are then deleted.
Recipients: scan data is not shared with the Owner.
4. What we process, why, and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Operating the recovery service: registration, storing your chosen contact data, displaying or forwarding it | Account and registration data; Owner contact details; visibility choice | Performance of the service relationship (Art 6(1)(b) GDPR); for displaying contact details to Finders, your consent/instruction (Art 6(1)(a)) |
| Forwarding a Finder's message to an Owner | Finder's message and any contact details; Owner email | Our and the Owner's legitimate interest in reuniting equipment with its owner (Art 6(1)(f)); the Finder's own submission as their request |
| Running, maintaining and securing the website | Technical and usage data (IP, device, log data) | Legitimate interest (Art 6(1)(f)) |
| Analytics and improvement | Usage data; pseudonymised identifiers; approximate (city/country) location | Consent (Art 6(1)(a)), via the cookie banner |
| Marketing and newsletter (opt-in) | Name, email, preferences, engagement | Consent (Art 6(1)(a)) |
| Support and communication | Contact data; your messages | Performance of contract / legitimate interest (Art 6(1)(b)/(f)) |
| Compliance (tax, accounting, legal) | Relevant transaction/contact data | Legal obligation (Art 6(1)(c)) |
5. Cookies
We use cookies and similar technologies as described in our Cookie Policy. Non-essential cookies (analytics, marketing) are set only with your consent, which you can withdraw at any time.
6. Who we share data with
We share personal data only with service providers acting on our instructions (processors), and only as needed to run the service. Categories, and the providers we use, are:
| Category | Purpose | Provider (to confirm) |
|---|---|---|
| Hosting and infrastructure | Operating the Platform | Amazon Web Services, Frankfurt region (eu-central-1) and other regions |
| Content delivery and security | Performance, protection against attacks | Cloudflare or similar service |
| Email delivery | Forwarding Finder messages; sending notifications | Active 24/Websupport email/SMTP provider |
| Analytics | Usage measurement (with consent) | Google Analytics or similar |
| Marketing | Advertising/remarketing (with consent) | Meta or similar |
| Newsletter | Sending newsletters (with consent) | MailChimp or similar |
We do not sell personal data. We disclose data to authorities only where legally required.
7. International transfers
Our primary hosting is within the EU (Germany). Some providers (for example, analytics or marketing tools, if used) may process data outside the EEA, including in the United States. Where this happens, we rely on an appropriate transfer mechanism — the EU–US Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses.
8. How long we keep data
| Data | Retention |
|---|---|
| Account and Owner registration data, including contact details linked to a QR code | For the Service Period (min. five years from first registration of the package), or until you delete the data or your account; thereafter as required by law, then deleted or anonymised |
| QR scan data (IP address, browser information, time of request) | Session records: up to 30 days after last activity |
| Finder messages and Finder contact details | Only as long as necessary to deliver the message and handle any follow-up e.g., 90 days, then deleted |
| Website and analytics data | up to 12 months |
| Marketing data | Until you unsubscribe or withdraw consent |
| Support correspondence | Up to 36 months after the matter is closed |
| Accounting and tax records | Statutory retention periods under Czech law i.e. up to 10 years |
9. Security
We apply appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, and hardened hosting. No system is perfectly secure, but we take reasonable steps appropriate to the data we hold.
10. Automated decisions and profiling
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, and we do not carry out profiling for such purposes.
11. Your rights
Subject to the conditions in the GDPR, you have the right to: access your data; have it corrected or erased; restrict or object to processing; data portability; and to withdraw consent at any time (without affecting prior processing). To exercise any right, contact info@retrivo.app; we will respond within one month, as required by law.
You also have the right to lodge a complaint with the Czech supervisory authority: Úřad pro ochranu osobních údajů (ÚOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz — or with the authority in your country of residence.
12. Dealers (business contacts)
Where we deal with dealers, we process business contact data (name, role, email, phone) and order and invoicing data to manage the dealer relationship, on the basis of contract (Art 6(1)(b)) and legal obligation (Art 6(1)(c)). The dealer is the controller for its own customers' data; we are not a party to the dealer's sales to end customers.
13. Children
The service is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
14. Changes and languages
We may update this policy; the current version, with its effective date, is published here, and we will notify registered users of material changes. This policy is prepared in Czech and offered in other languages for convenience; in case of discrepancy, the Czech version prevails.
15. Contact
21dcs spol s r.o., V Malých Domech I 583/5, 147 00 Prague, Czech Republic. Privacy contact: info@retrivo.app.
Prague, June 29, 2026