Privacy policy

Personal Data Protection (GDPR)

Information on the Processing of Personal Data

Effective from: 1 January 2026

1. Basic Provisions

1.1. The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter "GDPR") is Poctailor s.r.o., Company ID: 22097643, with registered office at Sokolovská 428/130, Karlín, 186 00 Prague (hereinafter "Controller").

1.2. Contact details of the Controller:

2. Sources and Categories of Processed Personal Data

2.1. The Controller processes personal data that you have provided, or personal data obtained on the basis of fulfilling your order:

  • first and last name
  • billing and delivery address
  • e-mail address
  • phone number
  • Company ID, VAT ID (for business customers)
  • bank details (for bank transfer payments)

3. Legal Basis and Purpose of Processing

3.1. The legal basis for processing is:

  • performance of the contract pursuant to Article 6(1)(b) GDPR
  • legitimate interest of the Controller pursuant to Article 6(1)(f) GDPR
  • your consent pursuant to Article 6(1)(a) GDPR for marketing purposes
  • fulfilment of legal obligations pursuant to Article 6(1)(c) GDPR

3.2. The purpose of processing personal data is to fulfil your order, exercise rights and obligations arising from the contractual relationship, and send commercial communications.

4. Data Retention Period

4.1. The Controller retains personal data:

  • for the period necessary to exercise rights and obligations from the contractual relationship (maximum 10 years — in accordance with tax regulations)
  • for a period of 5 years when processing based on consent for marketing

5. Recipients of Personal Data

5.1. Recipients of personal data are:

  • delivery companies: Zásilkovna, PPL, Czech Post
  • payment gateway: Comgate, a.s.
  • e-shop platform: Shopify Inc.
  • CRM system: Raynet s.r.o.
  • marketing services (email, analytics, advertising)

6. Your Rights

6.1. Under the conditions set out in the GDPR, you have:

  • the right of access to your personal data pursuant to Article 15 GDPR
  • the right to rectification of personal data pursuant to Article 16 GDPR
  • the right to erasure pursuant to Article 17 GDPR
  • the right to object pursuant to Article 21 GDPR
  • the right to data portability pursuant to Article 20 GDPR
  • the right to withdraw consent to processing

6.2. You have the right to lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.cz.

7. Personal Data Security Conditions

7.1. The Controller declares that it has taken all appropriate technical and organisational measures to secure personal data (encryption, HTTPS, access passwords, role-restricted access).

8. Cookies

8.1. Our website uses cookies for:

  • Necessary cookies — website functionality
  • Analytical cookies — traffic measurement (Google Analytics)
  • Marketing cookies — targeted advertising

8.2. You may change your cookie consent at any time in the cookie settings in the website footer.

9. Final Provisions

9.1. By submitting an order, you confirm that you have familiarised yourself with the personal data protection terms and that you accept them in full.

These terms take effect on 1 January 2026.