Privacy and Cookie Notice
English version
This Notice explains how Certifago processes personal data relating to visitors and Platform users, persons seeking services, Providers and persons acting for them. It also covers cookies and browser storage.
1 Controller and scope
The controller is Certifago s.r.o., Company ID No. 299 36 101, with its registered office at Varšavská 715/36, Vinohrady, 120 00 Prague 2, Czech Republic, registered with the Municipal Court in Prague, Section C, File 453786. For questions or to exercise rights: info@certifago.com, +420 774 554 630.
This Notice applies to Certifago’s website, applications, Provider portal and related communications. A Provider contacted by a User is normally an independent controller for data used to offer and perform the Provider’s own service and has its own transparency duties.
2 Data we obtain and its sources
| Data group | Examples and source |
|---|---|
| User and connection | Name, mobile number, selected service and Provider, language and visit source, verification status and time, contact display, connection record, feedback, job description, amount, photographs and complaints. Data are supplied by the User, by the Provider later in the process, or generated through use of the Platform. |
| Provider | Identity, contact, registration and billing data; authorised persons; services, areas, languages and availability; profile, media, references, screening documents, contract, signature and billing. Data come from the Provider, references, public registers and other lawful sources. |
| Device and security | IP address, time, browser and device, logs, security and anti-bot signals, cookie choices and data held in local or session storage. Data are generated automatically when the Platform is used. |
| Communications | Emails, messages, support records, complaints, notices of illegal content and information needed to resolve them. Data come from the persons communicating, notifiers and the parties involved. |
3 Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Mobile-number verification, contact display and making the User’s name and mobile number available to the selected Provider at the User’s request | Performance of the agreement with the User or steps requested by the User before entering into it (Article 6(1)(b) GDPR). |
| Recording a request and connection, the User’s confirmation of whether contact or a service took place, quality control and preventing abuse | Legitimate interests in operating and securing the Platform and resolving discrepancies (Article 6(1)(f) GDPR). |
| Monitoring Providers’ compliance with their contractual obligations, including the accuracy of their reporting and billing | Legitimate interests in the proper performance of contracts with Providers and in protecting legal claims ((f)); for Provider data, contract performance and legal duties ((b) and (c)). |
| Provider recruitment, screening, administration and billing | Pre-contractual steps and contract performance, legitimate interests and legal duties, including accounting and tax duties ((b), (c) and (f)). |
| Reviews and service quality | Legitimate interests in Platform trust, keeping Users informed and resolving discrepancies ((f)); consent where specifically requested for public display of a name or photograph ((a)). |
| Security, fraud prevention, protection of rights and complaint handling | Legitimate interests in security and legal claims; where applicable, compliance with a legal duty ((f) and (c)). |
| Handling notices of illegal content, content moderation and providing statements of reasons | Legal duty under Articles 16 and 17 of Regulation (EU) 2022/2065 on digital services ((c)); legitimate interests in Platform integrity ((f)). |
| Operational communications | Contract performance, steps requested by the person or legitimate interests in handling a request ((b) and (f)). |
| Optional marketing and non-essential technologies | Consent, which may be withdrawn at any time ((a)); in limited cases concerning existing customers, legitimate interests where permitted by law and with an easy opt-out in every message. |
Where processing relies on legitimate interests, we balance those interests against the rights of affected persons and use only data proportionate to the purpose. Further information about that assessment is available on request.
4 Connecting a User with a Provider
To access the selected Provider’s contact details, the User provides their name and mobile number and verifies the number with a one-time code. After verification, we display the selected Provider’s contact details and indicative availability to the User.
At the same time, we make only the User’s name and mobile number available to the selected Provider so that the Provider can respond to the contact request. The selected service and other request details are not shared through this transfer; the Provider obtains them directly from the User. The Provider is an independent controller for its subsequent use of these data and may not use them for unrelated marketing or disclose them without a lawful basis.
Certifago separately keeps an internal record of the selected Provider and service, verification and connection outcome, and any feedback, review or complaint. We use this record to operate the Platform, verify reviews, monitor quality, monitor Providers’ compliance with their obligations, including the accuracy of their reporting and billing, prevent abuse and protect legal claims. If a discrepancy arises with a Provider concerning compliance with its obligations, we may disclose to that Provider, to the extent necessary, whether the User confirmed that the service took place and the information the User provided about it. Retention periods are set out in section 6.
5 Recipients and transfers outside the EEA
We make data available only to the extent necessary for the relevant purpose. Principal recipients and processors include:
| Recipient / category | Role |
|---|---|
| Selected Provider | The User’s name and mobile number so that the Provider can respond to the contact request. The Provider obtains the selected service and other details directly from the User. Where there is a discrepancy concerning the Provider’s compliance with its obligations, to the extent necessary, whether the User confirmed that the service took place and the information the User provided about it. |
| IT and communications providers | Hosting, databases, security including tools protecting against bots and abuse, delivery of verification codes, and operation of the website, applications and Provider portal. |
| Business and document-service providers | Business records, email, internal documents, contracts and electronic signatures. |
| Advisers, insurers, courts and public authorities | Protecting rights, complying with legal duties and resolving disputes. |
Some suppliers may process data outside the European Economic Area. In that case we use an adequacy decision, European Commission Standard Contractual Clauses or another lawful mechanism, together with supplementary measures where appropriate. Information about the relevant mechanism is available on request.
6 Retention
| Data | Usual period |
|---|---|
| One-time verification code | Until used or expired; security and verification logs for no more than 6 months unless needed to investigate an incident. |
| Abandoned contact request | 90 days after the last activity. |
| Connection, feedback, complaint, dispute and notice of illegal content | Normally 4 years after closure or last activity; longer only while a dispute or legal duty continues. |
| Unsuccessful Provider application | 24 months; copies of screening evidence normally 90 days after the final decision unless longer retention is necessary. |
| Active Provider | For the contractual relationship and normally 4 years after it ends. |
| Contract, accounting and tax records | For the statutory period, usually up to 10 years. |
| Review and related record | For as long as it is published, which is not time-limited, until we remove or anonymise the review under the Terms of Use or following the exercise of rights; after publication ends, the review may be anonymised and a minimal non-public record normally retained for 4 years to protect rights and Platform integrity. |
| Public name, photograph and other identifying content | Until the relevant consent is withdrawn or publication ends; minimal evidence of consent or its withdrawal may normally be retained for 4 years. |
| Marketing | Until consent is withdrawn or the person opts out; a limited suppression record for as long as needed to respect the choice. |
After the period ends, data are deleted or anonymised unless limited retention is necessary to demonstrate compliance, protect rights or meet a legal requirement.
7 Cookies and browser storage
The Platform uses essential cookies and storage to provide a requested function, security and sign-in. As at 24 September 2026, no analytics or advertising technologies are active on the public Platform. If we add them, we will update this Notice and obtain prior consent before activation where required.
| Technology | Purpose | Duration |
|---|---|---|
| Cookie choice (local storage) | Stores the choice of essential-only or all permitted technologies. | Until the choice is changed or storage is cleared. |
| Temporary contact access (session storage) | Temporarily preserves verified access to the selected Provider’s contact details. | Up to 30 minutes or until the session or tab closes. |
| Verification and security limits (session storage) | Limits repeated delivery of verification codes and protects against abuse. | Until the time limit expires or the session ends. |
| Provider or administrator sign-in (local storage) | Maintains a signed-in session. | Until sign-out, expiry or storage is cleared. |
| Security technologies | Protects forms and the Platform against bots, fraud and abuse; this may be a technology provided by a third party. | For the necessary technical period. |
Essential technologies cannot be disabled through the banner because the requested function or security would not work without them. They can be limited in browser settings, but this may disable part of the Platform. For optional technologies, rejecting will be as easy as accepting, and consent will not be pre-selected or inferred from continued browsing.
8 Reviews, photographs and communications
Only a User with a verified connection to the relevant Provider may submit a public review. The connection record verifies the review’s source, not every statement or the quality of the service. We process review text, and publish it without time limit, for our legitimate interest in Platform trust and keeping Users informed. We publish identifying content, such as a name or photograph, only as selected by the User and on an appropriate legal basis, normally consent. Withdrawal of consent does not affect prior lawful processing. At the User’s request, instead of removing a review we may remove or anonymise the data identifying the User. We may retain an anonymised review or a minimal non-public record to protect rights and Platform integrity.
Operational messages concerning verification, security, a request, support or a contract are not marketing. Marketing is sent only on an appropriate legal basis and every message provides an easy opt-out.
9 Rights, required data and automation
Subject to the GDPR, individuals may request access, rectification, erasure, restriction or portability and withdraw consent at any time. Send requests to info@certifago.com; we may verify identity. Complaints may be lodged with the Czech Office for Personal Data Protection (www.uoou.gov.cz) or the competent EU authority.
Right to object. On grounds relating to your particular situation, you may object at any time to processing based on legitimate interests, including the publication of reviews. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time and without giving reasons. Send objections to info@certifago.com.
The User’s name, mobile number, selected Provider and service are needed to verify the User and display the Provider’s contact details; without them this function is unavailable. Required Provider data are needed for screening, contract or legal compliance; other fields are optional.
We make no solely automated decisions with legal or similarly significant effects. Security signals may temporarily block or refer a request; support can provide human review on request.
10 Security, children and changes
We use proportionate safeguards, including access controls, verification, encrypted transmission, logging and data minimisation. No system is risk-free. The Platform is not intended for persons under 18; if we obtain a child’s data without a lawful basis, we will take steps to delete it.
We may update this Notice and will highlight material changes. The Czech version prevails; the English text is a corresponding translation.