XOXOdrama Privacy Policy

Key points

• XOXO Drama Media s.r.o., established in the Czech Republic, controls the personal information processed for XOXOdrama. The GDPR applies to processing in the context of our EU establishment; additional mandatory local laws apply where relevant.
• You can watch without an account. Our launch age check is self-declaration and does not collect ID, a photo or date of birth. We do not offer access where that method is insufficient under applicable local rules.
• We collect very little: your email address (and Google account ID) if you sign in, technical and security data, your age-confirmation and cookie choices, and whatever you send us in reports or requests.
• We keep a viewing history (the episodes you watched and where you stopped) linked to your guest profile or account so you can continue watching, and you can clear it at any time. Optional analytics run only if you turn them on in Cookie Settings. We do not sell personal information, share it for cross-context behavioral advertising, infer sexual orientation or use visitor information to train AI models. We disclose necessary information to service providers and in the circumstances explained below.
• You may request access, correction, deletion or portability and withdraw consent where it is the basis for processing. We normally respond within 30 days, within one calendar month where the GDPR requires it, or sooner where applicable law requires.

1. Who We Are

1.1 XOXO Drama Media s.r.o., U Průhonu 800, 170 00 Praha 7-Holešovice, Czech Republic, Company ID (IČO) 29354379 ("XOXO Drama Media," "we," "us" or "our"), operates the XOXOdrama website at https://xoxodrama.com (the "Service") and is the controller of your personal information. This Privacy Policy explains what personal information we collect, why, how we protect it and the rights you have.

1.2 Privacy contacts. Tereza Dvořáková, Privacy and Compliance Lead, is our Privacy Officer and the person responsible for personal-information protection: xoxodramaprivacy@proton.me. Our Data Protection Officer is Adam Král and can be contacted at doxoxodrama@proton.me. You may contact the DPO directly about data protection or your rights.

1.3 This Privacy Policy applies to the Service. It does not apply to third-party services, such as Google, which have their own privacy policies.

2. Information We Collect

2.1 We collect only the information we need to run the Service. Depending on how you use it, this includes:

2.2 What we do not collect. We do not collect government ID, selfies, face scans or other biometric data, your date of birth, precise location, payment information or your contacts.

2.3 Required and optional information. No account information is required to watch, but technical information such as an IP address is processed to deliver and secure the Service. An email address, or the necessary Google sign-in details, is needed to create an account. Reports and requests need enough information for us to handle them; only provide what is relevant.

2.4 Sensitivity. Information about use of an adult service may be particularly sensitive. We minimize it and restrict access; we do not infer sex life or sexual orientation. If particular processing reveals special-category data under GDPR Article 9, an Article 6 legal basis alone is insufficient. We rely on an applicable Article 9 condition, such as separate explicit consent where required or necessity for legal claims. Sensitive information in reports is limited to what is needed to protect rights and deal with the case. Browsing, accepting Terms or signing in is not blanket consent to all sensitive-data processing.

3. How We Use Information and Our Legal Bases

3.1 We use personal information only for the purposes below. The table also shows our legal basis under the GDPR.

3.2 Legitimate interests and sensitive information. Our interests are delivering a secure adult service, preventing abuse, responding to reports and defending legal rights. We assess necessity and balance those interests against individual rights. You may object to processing based on legitimate interests. Where Article 9 applies, we also need the separate condition described in Section 2.4. Optional processing does not start merely because you read this policy.

3.3 Canada and other consent-based laws. We obtain meaningful consent where required, including express consent for sensitive processing unless a lawful exception applies. We do not assume that a visit or acceptance of the Terms is sufficient for every use. You can withdraw consent, subject to lawful restrictions; we explain any resulting inability to provide a requested feature. Optional analytics run only after you turn them on in Cookie Settings, and you can turn them off at any time.

4. What We Do Not Do

• We do not sell, rent or trade your personal information.
• We do not share your personal information for cross-context behavioral advertising. We show no third-party advertising and use no advertising cookies or pixels.
• We do not use session-recording tools that capture your mouse movements, clicks or keystrokes.
• We do not use your personal information to infer your sex life, sexual orientation or other sensitive characteristics.
• We do not use your personal information or age-confirmation records to train artificial intelligence models.
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you (see Section 13).

5. Video Viewing Information

5.1 "Video viewing information" means information that identifies a person as having requested or obtained specific video content.

5.2 We keep a viewing history linked to your guest profile or account: which episodes you watched and where you stopped. We use it only to show History and Continue Watching. Our video delivery providers process delivery logs only to deliver video and keep the Service secure, and these logs are not linked to accounts. We do not disclose information that identifies you as having requested or obtained specific videos to anyone except: (a) service providers acting on our behalf under confidentiality obligations, to the extent needed to deliver the Service; (b) where the law requires it, such as under a valid warrant or court order; or (c) with your separate, informed written consent.

5.3 You can clear your viewing history at any time on the History page. Clearing it removes it from History and Continue Watching. If you ask us to delete your account or guest profile, we delete its viewing history too.

6. How We Disclose Information

6.1 We disclose personal information only to the following categories of recipients:

6.2 Our service providers may use personal information only to provide services to us, under written contracts that require them to protect it. You can ask for the current list of our service providers at xoxodramaprivacy@proton.me.

7. Cookies and Similar Technologies

7.1 We use necessary cookies or similar storage for security, sign-in, age confirmation and privacy choices. A language preference may be remembered when you choose it. We do not use advertising cookies, third-party advertising pixels or session recording. Optional analytics (Google Analytics 4 and our measurement SDK) run only if you turn them on in Cookie Settings; they are off by default and stay off when your browser sends a Global Privacy Control signal. The Cookie Policy lists each cookie, its provider and how long it lasts.

7.2 Cookie controls and GPC. You may clear or block cookies using your browser and contact us about privacy choices. Necessary cookies do not require optional-tracking consent merely because the site uses them. A Global Privacy Control signal does not authorize new tracking or override a prior refusal. We honor legally applicable opt-out signals; we do not sell or share data for cross-context behavioral advertising. Our Cookie Policy is at https://xoxodrama.com/cookies.

8. How Long We Keep Information

We may keep information for longer where the law requires it, where it is subject to a legal hold or a preservation request from authorities, or where it is needed to establish or defend legal claims. When the retention period ends, we delete or de-identify the information.

9. Where We Process Information

9.1 Processing locations. We are established in the Czech Republic and use service providers for hosting, content delivery, authentication, email and security. A provider’s processing locations, including support access, determine where information is handled; the location of our registered office alone does not establish that all data stays in the Czech Republic. You may request information about recipients and processing locations using our privacy contact. We describe the safeguards for transfers outside the EEA below.

9.2 Transfers outside the EEA. Where such a transfer occurs, we use a valid transfer mechanism and appropriate safeguards. An adequacy decision applies only within its actual scope; for example, not every Canadian organization or U.S. provider is covered. Where needed, we use the European Commission’s Standard Contractual Clauses, assess transfer risks and apply supplementary measures. We do not claim a particular provider is certified without checking it. You may request information about relevant safeguards at xoxodramaprivacy@proton.me.

9.3 Canadian users. Providers may process information outside your province or Canada. Foreign laws and lawful government-access powers may apply there. Where Quebec law applies, a required privacy impact assessment and appropriate contractual protection must precede a transfer outside Quebec. We do not treat acceptance of this policy as a waiver of those safeguards.

10. Your Rights and Choices

10.1 Rights. Subject to applicable conditions and exceptions, you may ask to access, correct, delete, obtain a portable copy of or restrict use of your information; object to legitimate-interest processing; and withdraw consent. You may request account deletion at xoxodramaprivacy@proton.me. A request does not necessarily require an account. We explain any lawful refusal or limited retention, including legal holds; we do not promise immediate removal from every backup.

10.2 European complaints. You may complain to a competent supervisory authority, including the authority where you live or work or where an alleged infringement occurred. In the Czech Republic, contact the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic; https://uoou.gov.cz/en/consultation/contact. We do not assume it is the lead authority for every possible cross-border processing operation.

10.3 Canada. You may contact the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca or the competent provincial authority. Where Quebec law applies, the Commission d’accès à l’information is at https://www.cai.gouv.qc.ca. Additional Quebec rights, including requests concerning dissemination or de-indexing, apply when their statutory conditions are met.

10.4 United States and other locations. Local law may provide access, deletion, correction, portability, consent, objection, opt-out, sensitive-information or appeal rights. Their scope depends on the law and the processing involved. We do not sell data, share it for cross-context behavioral advertising or carry out targeted advertising. We will not unlawfully discriminate against you for a request. Contact us to exercise an applicable right or appeal a refusal.

10.5 California disclosures. The categories described in Section 2 are identifiers, technical or network activity, approximate location and information contained in correspondence. Their sources, uses, recipients and retention are described in Sections 2, 3, 6 and 8. We do not sell personal information, share it for cross-context behavioral advertising or disclose it to third parties for their own direct marketing. These descriptions do not mean that every statutory threshold is met or that every category is collected from every person.

10.6 Requests. Visit https://xoxodrama.com/privacy-request for instructions or email xoxodramaprivacy@proton.me. You do not need an account. We use checks proportionate to the risk, normally confirmation through the email address linked to the information. Do not send identity documents unless we explain why they are strictly necessary and provide a suitable method. Authorized agents may act where allowed. We respond without undue delay, normally within 30 days and, where the GDPR applies, within one calendar month, or any shorter period required by applicable law. If an extension is legally permitted, we explain the reason and revised deadline within the initial period. GDPR requests are normally free; any lawful charge or refusal will be explained. Different local rules remain applicable.

10.7 Appeals. If we decline your request, we will explain why. You can appeal by replying to our decision or by emailing xoxodramaprivacy@proton.me with the subject "Privacy Appeal." We will respond within the time required by applicable law. If you are not satisfied, you may contact the authorities listed in this Section or your state Attorney General.

10.8 Browser choices. You can clear cookies or use browser privacy controls. Clearing an age-confirmation or sign-in cookie may require a fresh confirmation or sign-in. Optional analytics are off unless you turn them on in Cookie Settings, and you can change that choice at any time.

11. Minors

The Service is for adults who meet the applicable minimum age. It is not directed to minors, and we do not knowingly collect personal information from them for ordinary use. If we learn a minor has used it, we restrict access and delete information that is not required for a lawful safety report, legal hold or other obligation. Contact xoxodramaprivacy@proton.me with the subject “Minor Safety” or “Privacy Request.”

12. Security

12.1 We use administrative, technical and organizational measures appropriate to the risks and sensitivity of the information, and restrict access to people who need it for authorized work. We minimize unnecessary information in records and require suitable provider safeguards. No system is completely secure. This policy does not claim a particular certification or guarantee absolute security.

12.2 If a security incident affects your personal information, we will notify you and the relevant authorities as required by applicable law.

12.3 Tips for your privacy. Consider using an email address you keep for this purpose, sign out on shared devices, and clear your browser data if others use your device.

13. Automated Processing and Location Technology

We use IP-derived country and state or province information to apply location restrictions, appropriate notices and security controls. This is approximate location, not continuous GPS tracking. Automated security checks may limit repeated sign-in attempts. If a decision significantly affects you and applicable law provides a right to human intervention, review or explanation, you may request it at xoxodramaprivacy@proton.me, subject to legal conditions. Contact us with the subject “Access Review” if you believe a location block is wrong.

14. Changes to This Privacy Policy

We may update this Privacy Policy. We will post the new version with a new "Last Updated" date. For material changes, we will notify account holders by email and post a notice on the Service at least 30 days before the change takes effect. Where the law requires your consent, we will ask for it.

15. Contact Us

XOXO Drama Media s.r.o., U Průhonu 800, 170 00 Praha 7-Holešovice, Czech Republic · Company ID (IČO): 29354379

• Privacy requests and general contact: xoxodramaprivacy@proton.me; instructions at https://xoxodrama.com/privacy-request
• Privacy Officer: Tereza Dvořáková, Privacy and Compliance Lead, xoxodramaprivacy@proton.me
• Data Protection Officer: Adam Král, doxoxodrama@proton.me
• Copyright: Eliška Horáková, dmcaxoxodrama@proton.me; safety, accessibility and support: xoxodramaprivacy@proton.me with the relevant subject.