drokie.Controller and privacy contact
The controller is Smartquot e.U.. For privacy requests, use the address or email in the contact block. Identifying this contact does not imply that a data protection officer has been appointed.
What data is processed?
Page access generates connection and security data, including IP address, time, requested resource and technical browser information. Accounts process email, authentication data, name, language and, where applicable, profile, portfolio and MFA factors. Creators submit text, files, product ideas, approvals and selected alternatives. Orders process contact details, shipping address, goods, variants, amounts, currency, payment references and fulfilment status. Withdrawal declarations contain the identification and contact details supplied, their content and receipt time. Full card details are not stored in the Drokie database. Drokie Business requests process contact name and email, company or organisation, sector, project description and, if you provide them, phone, country, product type, approximate quantity and budget, target date and a reference file (stored in a private space).
Purposes and legal bases
Account services, requested product development, order fulfilment and necessary communications: Article 6(1)(b) GDPR. Statutory information, conformity, withdrawal, tax and record-keeping duties: Article 6(1)(c). Providing and securing the service, preventing abuse and defending legal claims: Article 6(1)(f), subject to balancing the interests involved. Optional technologies requiring consent would rely on Article 6(1)(a) and valid prior consent; no analytics or marketing tools are currently integrated. The relevant function cannot be provided without necessary order or authentication data. Drokie Business requests: answering your enquiry and preparing a proposal at your request, Article 6(1)(b) GDPR, and commercial management of the relationship, Article 6(1)(f). Marketing communications are not sent merely because you submit a request.
Integrated services and recipients
Railway hosts the application after deployment. Supabase provides PostgreSQL, authentication, private storage and backend functions; development and production projects are in eu-west-1 (Ireland). Stripe Checkout processes hosted payments and payment details when purchases are enabled. Elastic Email provides authentication SMTP and transactional emails; application code disables open and click tracking. DeepL API Free translates selected public presentation and offer text; original private references, files, buyer data and internal costs are not sent. Fonts are served locally. If you accept, Umami Cloud (Umami Software, Inc.) processes statistics from the public pages (page visited, link clicked, country, browser and device); accounts, orders and administration are not measured. Production and shipping partners receive only data needed for the specific order; actual partners and contractual roles must be identified before use. Stripe may be an independent controller for its own statutory purposes; not every service is automatically a processor.
Processing outside the EEA
A European project location does not mean all support, subprocessor or administrative processing occurs exclusively in the EEA. Before live operation, contracting entities, recipients, processing agreements, actual regions and any Chapter V GDPR transfer grounds must be confirmed. Where required, an applicable adequacy decision or appropriate safeguards such as standard contractual clauses with supplementary assessment may be used. This policy does not claim certifications or agreements are already in place. Information about safeguards actually used can be requested from the privacy contact.
Retention
Data is retained for as long as needed for the stated purposes, statutory duties or legal claims. Austrian accounting records generally require seven years of retention; applicable exceptions or ongoing proceedings may require longer. Code makes guest access links valid for seven days and abuse counters for 15 minutes; the scheduled worker removes expired entries. Accounts remain until termination or lawful deletion. Binding retention and deletion procedures for hosting and authentication logs, backups, drafts, translation caches and withdrawal cases must be finalised before live operation. Browser storage periods are explained in the cookie policy. Drokie Business requests are kept for as long as needed to answer and manage them; the specific period is still to be defined.
Your rights
Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction and portability. You may object to legitimate-interest processing based on your particular situation and to direct marketing at any time. Consent can be withdrawn for the future. Contact the privacy contact; proportionate identity verification may be required. Requests are normally answered within one month, with any statutory extension explained. You may complain to the Austrian Data Protection Authority or another competent supervisory authority. No solely automated decisions producing legal or similarly significant effects are represented as an implemented feature.
Österreichische Datenschutzbehörde ↗Security and confidential content
Server permissions, database rules and expiring file links control access to private data. Administrators require MFA. Drafts and original files are not automatically public; approved publication includes content intended for that purpose. Security measures reduce risk but do not guarantee absolute security. Do not include unnecessary sensitive data in drafts or free-text fields.
Changes and outstanding details
New purposes or additional services require updated information and, where necessary, fresh consent. Confirmed processing and transfer arrangements, retention periods, and specific production, shipping and support-mailbox providers remain outstanding before launch. The review notice above also applies to these details.
Contact
Smartquot e.U.Oscar Lee Corradine
Kokoschkastraße 19/2.ST 9, 4020 Linz, Austria
[email protected]
+43 676 5777358