Privacy Policy
Privacy and cookie policy template. Replace the details in [square brackets] with your own, delete rows for purposes and services you do not use, and fill in your actual providers (hosting, payments, delivery, analytics). The template is based on Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. and is not legal advice. Then delete this box.
1. Data controller
The controller of personal data is [Operator's company / name], company ID [company ID], registered office [street, postcode, town] (the “controller”), the operator of the website [website address].
Data protection contact: e-mail [e-mail], phone [phone], registered office address. [Data protection officer: name, contact — only if appointed.]
2. What data we process, why and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Registration and user account | e-mail, name, password (stored only in irreversibly hashed form), data from a third-party sign-in service | performance of a contract (Art. 6(1)(b) GDPR) | for as long as the account exists |
| Orders, payments and delivery | name, billing and delivery address, e-mail, phone, company ID and VAT ID, payment details | performance of a contract; legal obligation (Art. 6(1)(c)) | for the term of the contract and warranty; tax documents 10 years |
| Adverts, company directory, discussion and ratings | data you publish yourself (name, contact, text, photos) | performance of a contract | until the content or account is deleted |
| Enquiries and contact forms | name, e-mail, phone, message content | legitimate interest in handling the enquiry (Art. 6(1)(f)) | [1 year] after it is handled |
| Newsletter | e-mail, name | consent (Art. 6(1)(a)); for customers, legitimate interest under Section 7 of Czech Act No. 480/2004 Coll. | until you unsubscribe |
| Security and abuse prevention | IP address, device and browser data, sign-in records | legitimate interest in securing the website | [6 months] |
| Traffic measurement and marketing | data from cookies (see chapter 5) | consent | depending on the cookie, at most until consent is withdrawn |
Providing data for an account and an order is necessary to conclude the contract; without it the contract cannot be concluded. Other data are provided voluntarily.
3. Who we share data with
We share data only to the extent necessary with processors and recipients who help us run the website or perform the contract:
- hosting provider: [name],
- payment gateways and banks: [names],
- carriers and pick-up points: [names],
- third-party sign-in providers: [Google, Facebook, Seznam, …],
- traffic measurement and e-mailing tools: [Google Analytics, …],
- accountant and tax adviser: [name],
- public authorities where required by law.
We transfer data outside the European Economic Area only to providers that ensure adequate protection (a European Commission adequacy decision, e.g. the EU–US Data Privacy Framework, or standard contractual clauses). [State which services this applies to.]
4. Your rights
In connection with the processing of personal data you have the right:
- of access to your data and a copy of it (Art. 15 GDPR),
- to rectification of inaccurate data (Art. 16),
- to erasure where the data are no longer needed or are processed unlawfully (Art. 17),
- to restriction of processing (Art. 18),
- to portability of data you provided to us (Art. 20),
- to object to processing based on legitimate interest, including newsletters (Art. 21),
- to withdraw your consent at any time without affecting the lawfulness of earlier processing.
Exercise your rights at the controller's contact e-mail; we will reply within one month. You can edit or delete some data yourself in your account settings. If you believe the processing breaches the law, you can lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz, or with the supervisory authority in your country of residence.
5. Cookies
Cookies are small files that the website stores in your browser. We use them as follows:
- Necessary — sign-in, shopping cart, form protection and storing your cookie choice. The website does not work without them, so we do not need consent for them.
- Analytics — traffic measurement so that we can improve the website [Google Analytics]. Only with your consent.
- Marketing — [ad targeting; delete this paragraph if you do not use it]. Only with your consent.
You give or refuse consent in the banner on your first visit and can change it at any time with the “Cookie settings” link in the website footer. You can also delete or block cookies in your browser settings.
[Optional: a table with the cookie name, provider, purpose and expiry.]
6. Automated decision-making and security
We do not use your data for automated decision-making or profiling with legal effects. We protect data with technical and organisational measures — encrypted connections, access control and regular backups.
7. Changes to this policy
We may update this policy; the current version is always on this page. We will inform you of significant changes.
This policy takes effect on [date].