Privacy policy
This policy describes how Dlúhé Grefty s.r.o. processes the personal data of customers and visitors of the e-shop www.grefty.bio in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Czech Act No. 110/2019 Coll., on Personal Data Processing.
1. Data controller
Dlúhé Grefty s.r.o., Masarykova 55, 696 11 Mutěnice, Czech Republic, Company ID (IČO) 29266629, registered in the Commercial Register under file no. C 69395 kept by the Regional Court in Brno (the “Controller” or “We”).
Contact for personal data questions: info@grefty.bio, +420 773 527 687.
We have not appointed a data protection officer, as we are not required to do so.
2. What data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Processing orders, delivery, payment, complaints and withdrawals | name, surname, delivery and billing address, e-mail, phone, order content, payment details | performance of a contract (Art. 6(1)(b) GDPR) | for the duration of the contract and up to 4 years after it ends, for possible claims |
| Accounting and taxes | invoice details | legal obligation (Art. 6(1)(c) GDPR) | 10 years (VAT and accounting laws) |
| Customer account | e-mail, name, addresses, order history | performance of a contract | until the account is closed |
| Replying to enquiries via the contact form or e-mail | name, e-mail, phone, message | legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR) | as long as needed to handle it, max. 1 year |
| Newsletter | your consent (Art. 6(1)(a) GDPR); for customers also legitimate interest under Section 7(3) of Act No. 480/2004 Coll. | until you withdraw consent or unsubscribe | |
| Blog comments | name, e-mail, comment text | your consent | as long as the comment is published |
| Age verification (18+) | record of your age confirmation stored in your browser | legal obligation and legitimate interest in not selling alcohol to minors | until deleted in your browser |
| Website operation, statistics and marketing (cookies) | device identifiers, visit data | necessary cookies: legitimate interest; others: your consent in the cookie banner | depending on the cookie, max. 2 years |
Providing data for an order is necessary to conclude the contract; without it we cannot deliver the goods. All other data is provided voluntarily. We do not carry out automated decision-making or profiling with legal effects.
3. Who we share data with
We share data only to the extent necessary for the given purpose with these processors and recipients:
- Shopify International Ltd. (Ireland) – operator of the e-shop platform, including sending e-mails;
- TOPTRANS EU, a.s. – parcel delivery;
- the payment gateway provider offered at checkout – online card payments;
- external accountant – accounting and tax records;
- Google Ireland Ltd. – displaying the map on the Contact page (loaded only after you click it or consent to cookies);
- public authorities where required by law.
Shopify and Google may also process data outside the European Economic Area (in particular in the USA). Such transfers are covered by a European Commission adequacy decision (EU-US Data Privacy Framework) or by standard contractual clauses.
4. Cookies
The website uses necessary cookies without which the cart, checkout and login do not work. We use analytics and marketing cookies only with your consent, which you give or refuse in the cookie banner and can change at any time via the “Cookie settings” link in the website footer.
5. Your rights
You have the right:
- to access your personal data and obtain a copy;
- to have inaccurate data corrected;
- to erasure, if we no longer need the data or its processing is not lawful;
- to restriction of processing;
- to data portability;
- to object to processing based on legitimate interest, including direct marketing;
- to withdraw your consent at any time (e.g. via the link in every newsletter or by e-mail); withdrawal does not affect processing carried out before it;
- to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
You can exercise your rights by e-mail at info@grefty.bio. We will reply within one month at the latest.
6. Security
We have adopted technical and organisational measures to protect personal data. Card payments are processed by the payment gateway; we neither see nor store card numbers.
7. Final provisions
We may update this policy. The current version is always published on the e-shop. This policy takes effect on the date of its publication on the e-shop.