Europe Services, SE and REP27 LTD — version 2.0, last updated 29 September 2026
This website, gdprrepresentative.com, is operated by Europe Services, SE, a European company registered in the Czech Republic, IČO 03571785, file H 1486 at the Municipal Court in Prague, registered office Na Čečeličce 425/4, Smíchov, 150 00 Praha 5, Czech Republic (“Europe Services”, “we”). Europe Services is the controller of the personal data described in this notice.
For services concerning the United Kingdom (representative under Article 27 UK GDPR, UK responsible person for products and for cosmetics), REP27 LTD, company number 17385889, Unit 82a James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom, is the controller of the data it needs to act in that role, jointly with Europe Services for the shared client files.
Contact for any privacy question: info@gdprrepresentative.com, or by post to either address above. We have not appointed a data protection officer, as we are not required to; privacy questions are handled directly by the management.
As controller we process the data of visitors, people who contact us, prospects, clients and their staff, partners and suppliers. This notice describes that processing.
As representative or responsible person appointed by a client (under Article 27 GDPR or UK GDPR, Article 16 of Regulation (EU) 2023/988, Article 4 of Regulation (EC) 1223/2009 and similar laws), we receive messages from individuals and authorities addressed to that client. When you write to us about a company we represent, that company remains the controller of its own processing and its privacy notice applies. We process your message only to register it, forward it to the client, answer or cooperate with authorities where the law requires, and keep a record that it was handled (see section 11).
| Activity | Main data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Website operation and security logs | IP address, time, page, referrer, browser | Art. 6(1)(f) security and operation | 12 months |
| Traffic source (which ad, campaign or site brought you) | Click identifiers, campaign, keyword, landing page, referrer | Art. 6(1)(f); cookies as in section 13 | 90 days in your browser; 24 months in our records |
| Advertising measurement (Google Ads) | Cookie identifiers, conversion events | Art. 6(1)(a) consent | Until consent is withdrawn; Google’s own periods |
| Click-fraud prevention | IP address, time, campaign, keyword, visit length, browser marker | Art. 6(1)(f) protecting our advertising spend | Up to 12 months |
| Enquiries, quotes, chat, call booking | Name, email, company, country, phone, message | Art. 6(1)(b) and (f) | 24 months if no contract follows |
| Client area login | Email, verification code, login link, session | Art. 6(1)(b) | Life of the account |
| Designation and onboarding | Company data, signatory, e-signature record, ID document where required, processing description | Art. 6(1)(b) and (c) | Mandate + 10 years |
| Payments and invoices | Billing details, VAT number, amounts, transaction reference | Art. 6(1)(b) and (c) | 10 years (Czech accounting and VAT law) |
| Delivering the representative service | Requests from individuals and authorities, correspondence, product documentation | Art. 6(1)(c) and (f); Art. 9(2)(i) for health data in cosmetic incident reports | Mandate + 10 years (PIF: 10 years after last batch) |
| Review invitations | Name, email, order reference | Art. 6(1)(f) | Sent once; held by the review platform |
Our web server records, for each request, the IP address, date and time, page requested, response code, referring page and browser string. We use these logs to run the site, to find errors and to detect attacks. Legal basis: Article 6(1)(f), our interest in a secure and working website. Logs are kept for twelve months.
To show prices in your currency and the site in your language we store your choice in your browser (section 13). We use an approximate location derived from your IP address (country and, at most, city) to pre-select a currency and to count visits by country; we do not store precise location.
We keep aggregated statistics of visits: pages seen, time spent on the site, device type (computer, tablet, phone), approximate city, currency chosen and which information panels were opened. These statistics are linked to the IP address for up to twelve months and are used to improve the site and to understand which content helps visitors. Legal basis: Article 6(1)(f).
Some pages load flag images from flagcdn.com; your browser then connects to that service, which receives your IP address as part of the request.
When you arrive, a first-party script records where the visit came from: advertising click identifiers (such as Google’s gclid, Microsoft’s msclkid, Meta’s fbclid, LinkedIn or TikTok identifiers), campaign parameters (utm_source, utm_medium, utm_campaign, utm_term) or, if none, the referring site, together with the landing page. The first and the latest source are kept in two first-party cookies for 90 days and sent to our server, where they are attached to any enquiry, lead or designation you later send. This tells us which campaigns bring real clients and which should be stopped.
We use Google Ads with Consent Mode. Until you accept advertising cookies, the Google tag runs with advertising and analytics storage refused, so no advertising cookies are written. If you accept, Google may set its cookies to measure which ads lead to a request or a payment. When a payment is completed we send Google a conversion event for the campaign that brought you. Legal basis: Article 6(1)(a) consent, which you can withdraw at any time from the cookie settings or your browser; withdrawal does not affect earlier processing. Google Ireland Limited is an independent controller for its own advertising purposes.
If you fill in a lead form shown inside a Google advertisement, Google sends us the fields you completed (for example name, email, country and message) together with the campaign. We use them only to answer your enquiry. Legal basis: Article 6(1)(b) and (f).
Paid clicks cost us money, and automated or repeated clicks are a known problem. For visits that arrive from our advertisements we record, at the moment of the click, the IP address, date and time, campaign, ad group, keyword, match type, network and device, and we measure how long the visit lasts.
IP addresses that show a pattern typical of invalid traffic — for example leaving within a few seconds of a paid click, clicking our ads repeatedly within a short time, or appearing to belong to a competitor repeatedly opening our ads — are added to the IP exclusion list of the relevant Google Ads campaign, so that our ads are no longer shown to that address. To recognise the same device when its IP address changes, a random marker may be stored in the browser that clicked; it contains no name or contact data and is used only for this purpose.
The only effect for you is that you may no longer see our advertisements; the website stays fully accessible, including through VPNs and corporate networks. Our own addresses and Google’s systems are never excluded. Legal basis: Article 6(1)(f), our interest in preventing fraud and waste of advertising spend. Data are kept for up to twelve months. You may object at any time (section 17) and we will remove your address from the lists.
Name, email address, company, website, country of establishment, telephone number if you give it, and your message. For product services (GPSR, cosmetics) also the number and type of products, markets, safety assessor and launch dates you indicate. We use them to answer, prepare a quote and, if you go ahead, the designation. Legal basis: Article 6(1)(b) steps at your request, and Article 6(1)(f) our interest in answering business enquiries.
Before a payment starts we check that the email address you typed can receive mail (format, domain, known typing mistakes and disposable-address services). Only the address is checked; nothing else is stored for this purpose.
Name, email, the time slots you propose, the channel you choose and, for WhatsApp or phone, your number. Used to arrange the call. We do not record calls. Legal basis: Article 6(1)(b).
Messages you type in the chat window, the page you were on, the time, and, if you came from an ad, the campaign keyword. Replies may be drafted by an AI assistant that works from our own service documents; a person reviews conversations and takes over where needed. We use the conversations to answer you and, in aggregated form (search keywords only, never your name or contact details), to decide which advertising keywords to use or exclude. Legal basis: Article 6(1)(f). Chat data are kept for 24 months, or longer as part of a client file.
When you use our free checks (policy scan, category checker, AI Act checker), we process the web address or answers you enter to produce the result. We do not store the content of the pages we scan.
The designation form asks you to confirm your email with a 6-digit code. The client area has no passwords: you enter your verified email and receive a personal sign-in link, valid for 30 minutes; the session lasts up to 30 days on that browser. We store the verified email, the time of verification, the time and IP address of each sign-in and the session identifier. Legal basis: Article 6(1)(b). Sign-in records are kept for the life of the account and 12 months after.
To accept a mandate we need: company name, registration and VAT numbers, registered address, website or sales channels, a description of the processing or of the products, the countries concerned, contact person, signatory name and role, and the electronic signature record (name, date, time and IP address). For sole traders and private individuals, and where a signatory’s authority must be checked, we may ask for an identity document or company registration extract.
We use these data to verify who is appointing us, draw up the designation, issue the certificate and answer authorities. Before accepting, and periodically after, we screen the company and signatory against EU, UK and UN sanctions lists. Legal basis: Article 6(1)(b) for the contract and Article 6(1)(c) for the checks required by law. Identity documents are stored outside the public website, in a restricted area, and are kept only as long as needed to show that the check was made.
Each designation has a verification code. The public verification page shows the company name, the service, the territory and the status (active, suspended, expired or revoked), so that authorities and marketplaces can check it. The names of individuals are not shown unless required. Listing in our public client register is optional and depends on the client’s choice in the form.
Payments are processed by Mollie B.V. (Netherlands). We never see or store full card numbers. We receive and keep the payment reference, method, amount, currency, date and status. Where you give an EU VAT number we check it through the European Commission’s VIES service to apply the reverse charge. Invoices contain the billing name, address, VAT number and amounts. Legal basis: Article 6(1)(b) and (c). Accounting and VAT records are kept for ten years under Czech law.
As representative or responsible person we receive requests and correspondence from individuals and from authorities about our clients. We record the sender’s name and contact details, the date, the content of the request and what was done with it, forward it to the client and, where the law requires, answer or cooperate with the authority. Legal basis: Article 6(1)(c) where the law gives us that role, and Article 6(1)(f) for keeping evidence that each request was handled. These records are kept for the life of the mandate and ten years after.
For product services we keep the technical documentation or Product Information File supplied by the client, for ten years after the last product was placed on the market, as the law requires.
Cosmetic incident reports. If a consumer or professional reports a serious undesirable effect of a cosmetic product we represent, the report may contain health information. We use it only to notify the competent authority and the brand owner and to keep the record the law requires. Legal basis: Article 6(1)(c) and Article 9(2)(i) GDPR (public interest in public health, under Regulation (EC) 1223/2009 and the UK Cosmetic Products Regulation). Access is limited to the people handling the report.
Review invitations. After a completed service we may ask Trustpilot A/S (Denmark) to send you one invitation to review us, by copying its invitation address in our email. Trustpilot receives your name, email and a reference. Legal basis: Article 6(1)(f), our interest in genuine public feedback; you can ignore the invitation or object at any time.
Affiliates and referral partners. If you join our affiliate programme we process your name, contact details, payment details for commissions and the referrals made with your link or code. If you arrive through a partner’s link, we record the partner code with your order so that the partner can be paid; the partner does not receive your contact details. Legal basis: Article 6(1)(b) and (f).
| Name | Type | Purpose | Duration |
|---|---|---|---|
| rep27consent | Local storage | Remembers your cookie choice | Until you clear it |
| r27src, r27last | First-party cookies | First and latest traffic source (section 5) | 90 days |
| pfx_cur and language setting | Local storage | Your currency and language | Until you clear it |
| Client area session | First-party cookie | Keeps you signed in | Up to 30 days |
| Click-fraud marker | Local storage | Recognises a device that repeatedly clicks our ads (section 6) | Up to 12 months |
| Google Ads cookies (for example _gcl_au) | Third-party / first-party | Advertising measurement | Only with consent; Google’s periods |
You can refuse or withdraw consent to advertising cookies at any time and delete cookies and local storage from your browser settings. Essential items needed for the site and the client area to work do not require consent.
We share data only with the providers we need, bound by data processing agreements, and with authorities where the law requires. We never sell personal data.
| Recipient | Role | Location |
|---|---|---|
| Contabo GmbH | Server hosting of the website, forms and client files | Germany (EU) |
| Hostinger | Domain, DNS and email | EU |
| Mollie B.V. | Payment processing | Netherlands (EU) |
| Google Ireland Limited | Advertising, lead forms, measurement (independent controller for its own purposes) | Ireland (EU), with transfers to the US |
| Amazon Web Services | Hosting of the chat service | EU / US |
| MongoDB (Atlas) | Database of the chat service | EU / US |
| OpenAI and other AI model providers | Optional draft assistant in the designation form and chat replies | US |
| Trustpilot A/S | Review invitations (independent controller) | Denmark (EU) |
| European Commission (VIES) | VAT number check | EU |
| Our clients | Receive the requests and reports addressed to them | Worldwide |
| Authorities, courts, auditors and professional advisers | Where the law requires or to establish, exercise or defend legal claims | EU / UK |
Where a recipient is outside the EEA, the transfer relies on an adequacy decision (for example for the United Kingdom, or for US companies certified under the EU-US Data Privacy Framework) or on the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, with supplementary measures where needed. When we forward a request to a client established outside the EEA, the transfer is necessary for the performance of the representation the client asked for and for the exercise of the requester’s rights. A copy of the relevant safeguards is available on request.
After these periods, data are deleted or anonymised, unless a longer period is needed for a pending legal claim.
You have the right to: access your data and receive a copy; have inaccurate data corrected; have data erased; restrict processing; receive data you gave us in a portable format; and object at any time to processing based on our legitimate interests, including traffic-source recording and click-fraud lists. Where processing is based on consent, you can withdraw it at any time. In the United Kingdom you have the same rights under the UK GDPR.
Write to info@gdprrepresentative.com. We answer within one month (extendable by two months for complex requests, in which case we tell you why). We may ask for information to confirm your identity. Exercising your rights is free.
You can complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz; for REP27 LTD, to the UK Information Commissioner’s Office, ico.org.uk; or to the authority where you live or work. We would appreciate the chance to address your concern first.
We do not take decisions that produce legal or similarly significant effects about you by automated means alone. The click-fraud rules in section 6 run automatically, but their only effect is that our ads may stop being shown to an IP address. The AI assistants suggest text; a person decides.
The site runs only over HTTPS. Client files and identity documents are stored outside the public web folder, readable only by the server process; administrative pages are protected by authentication; access is limited to the people who need it; backups are kept on restricted storage. The client area uses one-time sign-in links instead of passwords, so no passwords can leak. If a personal data breach occurs that is likely to result in a risk to you, we notify the supervisory authority and, where required, you.
Our services are for businesses and are not directed at children; we do not knowingly collect children’s data.
If we change this notice we update the version and date at the top; material changes are also announced on this page.
Questions: info@gdprrepresentative.com · +420 775 397 884 · Europe Services, SE, Na Čečeličce 425/4, 150 00 Praha 5, Czech Republic · REP27 LTD, Unit 82a James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom.