Privacy Policy

1.1. The controller of personal data is the website operator:

• Business name or full name: KEBAB HOUSE BONE’MA
• Address of the establishment: třída T. G. Masaryka 1077, 293 01 Mladá Boleslav 1
• Company ID (IČO): 03350339
• Tax ID (DIČ): CZ03350339
• Telephone: 326210955
• Website: kebab-house-bonema.vercel.app
• Contact form: Contact page
• Chat: the chat window on the website

1.2. The controller has not appointed a data protection officer, as it is not obliged to do so under Article 37 GDPR. In all matters concerning personal data protection, data subjects may contact the controller directly using any of the means of communication stated in paragraph 1.1 (the "contact details stated in Article 1").

2.1. The Policy applies to the processing of personal data in connection with the controller’s website, including its version installed as a web application, orders for goods, the customer account, the loyalty programme, customer support, the sending of notifications, courier applications, agreements with couriers and records of their work. Terms not defined in this Policy have the meaning given to them in the Terms and Conditions.

2.2. The controller processes personal data in accordance with the GDPR, Act No. 110/2019 Coll., on Personal Data Processing, Act No. 127/2005 Coll., on Electronic Communications, and Act No. 480/2004 Coll., on Certain Information Society Services.

2.3. With the exception of the processing described in Article 11, the Policy does not apply to the processing of personal data of the controller’s employees and other collaborators, about which those persons are informed separately.

3.1. The following table summarises the purposes of processing; details are set out in Articles 4 to 11.

• Purpose

  Orders

  Personal data

  name, telephone, e-mail, delivery address, order contents and notes, payment details, status history, timestamps

  Legal basis

  performance of a contract, legal obligation, legitimate interest

  Retention period

  3 years from completion or cancellation of the order; data in accounting and tax documents for the period laid down by law

• Purpose

  Customer account and loyalty programme

  Personal data

  e-mail, name, telephone, password hash, addresses, favourite dishes, cart, orders, points, language, settings, consents

  Legal basis

  performance of a contract, legitimate interest

  Retention period

  until the account is deleted

• Purpose

  Customer support

  Personal data

  name, contact details, content of messages, related order

  Legal basis

  legitimate interest, performance of a contract, legal obligation

  Retention period

  24 months from the last message; requests concerning orders and claims for defects: 3 years after they have been handled

• Purpose

  Security and prevention of misuse

  Personal data

  salted hash of the IP address, server logs, sign-in records, audit logs

  Legal basis

  legitimate interest

  Retention period

  24 hours to 3 years depending on the type of record (paragraph 5.3 and Article 7)

• Purpose

  Commercial communications

  Personal data

  e-mail, name, language, record of consent

  Legal basis

  consent

  Retention period

  until consent is withdrawn or the account is deleted

• Purpose

  Push notifications

  Personal data

  subscription address, encryption keys, link to the account, browser identification

  Legal basis

  consent

  Retention period

  until the subscription is cancelled or expires

• Purpose

  Cookies and storage on the device

  Personal data

  see the Cookie Policy

  Legal basis

  performance of a contract, legitimate interest

  Retention period

  see the Cookie Policy

• Purpose

  Courier applications

  Personal data

  name, telephone, e-mail, vehicle, area or town, availability, message, page language

  Legal basis

  steps prior to entering into a contract

  Retention period

  6 months from the last change to the application

• Purpose

  Agreements with couriers

  Personal data

  name, date of birth, citizenship, permanent address, birth number, bank account number, health insurance company, taxpayer’s declaration, driving licence and vehicle, private e-mail, record of the signing of the agreement

  Legal basis

  performance of a contract, legal obligation, legitimate interest

  Retention period

  for the duration of the agreement and thereafter for the period laid down by insurance, tax and accounting legislation; agreements not concluded: 6 months, agreements after withdrawal: 1 year

• Purpose

  Courier work

  Personal data

  sign-in e-mail, name, telephone, role, passkeys, shifts and breaks (working time records), kilometres travelled, accepted deliveries and their times, shares of orders, cash collected, settlement, location during delivery

  Legal basis

  performance of a contract, legal obligation, legitimate interest

  Retention period

  for the duration of the agreement and thereafter for the period laid down by insurance, tax and accounting legislation; location until the order is delivered or cancelled

4.1. When an order is placed, the controller processes the buyer’s name, telephone number and e-mail address; for delivery, the delivery address and the note for the courier; the contents of the order including variants, extras and notes; the price, discounts applied and loyalty points; the method of receiving the goods; the payment method and status, including the payment transaction identifier and refund details; the order number and the link to the order status page; the order status and the history of its changes, including the reason for any cancellation; timestamps and the language of the order and, for a registered buyer, also the link between the order and the customer account.

4.2. The purpose of the processing is the conclusion and performance of the purchase contract, in particular the confirmation, preparation, handover and delivery of the order, receipt of payment, providing information on the order status, handling withdrawals from the contract and claims for defects, and keeping records of orders.

4.3. The legal basis for the processing is the performance of a contract and taking steps at the request of the data subject prior to entering into it (Article 6(1)(b) GDPR), compliance with the controller’s legal obligations, in particular in the areas of accounting, taxes and consumer protection (Article 6(1)(c) GDPR), and the controller’s legitimate interest in protecting its legal claims and in preventing misuse of the ordering system (Article 6(1)(f) GDPR). Providing the name, telephone number, e-mail address and, for delivery, the delivery address is necessary; without them, an order cannot be placed.

4.4. Only authorised staff of the controller and couriers have access to order data, to the extent necessary for their work. Contact details and the delivery address are visible only to those who need them to fulfil the order, in particular the serving staff and the courier who has accepted the delivery of the order (paragraph 4.9); kitchen staff do not have access to them.

4.5. Online payments are processed by Stripe Payments Europe, Limited, with its registered office in Ireland. The data subject enters payment card details directly on the payment gateway page; the controller does not process them and has no access to them. The controller receives from the payment service provider only information on the outcome of the payment, the transaction identifier and refund details. Stripe processes payment data partly as a processor and partly as an independent controller, in particular for the purposes of complying with its legal obligations and preventing fraud; details are given in Stripe’s privacy policy.

4.6. The controller retains personal data relating to the order for the duration of the performance of the purchase contract and thereafter for 3 years from the completion or cancellation of the order, which corresponds to the general limitation period for asserting claims under the purchase contract; if proceedings concerning a claim have been initiated, it retains them until those proceedings have been finally concluded. The controller then erases or anonymises the contact details, the delivery address and the notes. Orders of a registered buyer remain part of the order history in the account until the customer account is deleted; when the account is deleted, they are anonymised in accordance with paragraph 5.5.

4.7. The controller retains data forming part of accounting records or tax documents for the period laid down by legislation, in particular 10 years from the end of the tax period in which the supply took place (Section 35 of Act No. 235/2004 Coll., on Value Added Tax) and 5 years from the end of the accounting period to which they relate (Section 31 of Act No. 563/1991 Coll., on Accounting). These records do not usually contain the buyer’s contact details.

4.8. After the order has been confirmed, a map showing the establishment is displayed on the order status page. For delivery, the courier delivering the order may share their location, whether they are a staff member of the establishment or a courier working under an agreement (Article 11); the buyer then sees the courier’s approximate location on the map, rounded to roughly 10 metres, and only for the duration of the delivery. The controller stores only the courier’s latest location, erases it after the order has been delivered or cancelled and does not keep any route history. If the buyer selects "Show me" on the map, their location is determined and processed only in their browser and is not sent to the controller. The map data are provided by the OpenFreeMap service (Article 13).

4.9. Deliveries are carried out by couriers, i.e. staff members of the establishment or couriers working for the controller under an agreement to complete a job or an agreement to perform work (Article 11), who act on behalf of the controller and are bound by a duty of confidentiality. Until a courier accepts a delivery, the courier portal shows them, for an order on offer, only the street name without the house number, the town, the number of items, the order amount, the estimated courier share and the payment method. The courier who accepts the delivery sees the buyer’s name and telephone number, the delivery address and the note for the courier, the order note, the ordered items and the amount to be paid, but only for that delivery and only while it is active. After delivery, the courier’s delivery history shows only the order number, the date and the amounts, not the buyer’s data.

5.1. In connection with the customer account, the controller processes the e-mail address, name and, where applicable, telephone number, the password in the form of a cryptographic hash, the preferred language, saved delivery addresses, favourite dishes, the contents of the saved cart, the order history, data on loyalty points and their movements, notification settings and notices in the account, the time when the installed app was last launched (used only so that the prompt to install the app is not shown in the browser), data on consents given and on the confirmation of the Terms and Conditions, including the time when they were given, any request for account deletion and technical sign-in data.

5.2. The purpose of the processing is setting up and maintaining the customer account, providing its functions, operating the loyalty programme and securing the account. The legal basis is the performance of the customer account contract, which includes the rules of the loyalty programme (Article 6(1)(b) GDPR), and the controller’s legitimate interest in securing accounts and in being able to demonstrate that the buyer has agreed to the Terms and Conditions (Article 6(1)(f) GDPR). Providing the name, e-mail address and password is necessary to set up an account; the data subject provides other data voluntarily, depending on which functions of the account they use.

5.3. Sign-in and password management are provided by the Supabase Auth authentication service. The password is stored exclusively in the form of a cryptographic hash; neither the controller nor its staff have access to it. During registration, sign-in, password reset and similar events, the authentication service records security data, in particular the time and type of the event, the IP address and browser identification, which serve to protect the account against unauthorised access. Data on an active sign-in session are retained for as long as it lasts, and records of security events for no longer than 90 days.

5.4. The controller processes personal data in the customer account for as long as the account exists. Notices displayed in the customer account are deleted automatically after 180 days. The contents of the saved cart are retained until the cart is emptied or the order is submitted.

5.5. In the Privacy & data section of the customer account, the data subject may submit a request for account deletion and withdraw it until it has been processed. The request is processed by an authorised member of the controller’s staff without undue delay and within one month at the latest. When processing the request, the controller revokes access to the account and erases the account data; in orders, it anonymises the name, telephone number, e-mail address, delivery address, note for the courier, order note and notes on individual items, anonymises the content of requests submitted via the order support form and erases chat conversations linked to the customer account. The controller retains order data necessary for compliance with accounting and tax obligations in anonymised form. Data that the controller is entitled or obliged to retain further, for example where a claim for defects or a dispute is in progress, are retained for as long as strictly necessary.

5.6. In the same section, the data subject may at any time download a copy of their personal data, in particular their profile, addresses, orders, loyalty points, support requests and chat conversations, in the machine-readable JSON format.

5.7. If the customer takes part in the BONE’MA Crew programme, the controller processes their personal referral code, data on orders placed with this code (whether it was a new customer’s first order, whether it was completed or cancelled and the result of the check that it is not the referrer’s own account, the same telephone number or the same delivery address) and the points awarded, as well as links to videos the customer sends for approval, the handle and message they provide, the consent to publishing and the result of the review. The purpose is to run the programme under its rules and to protect it against misuse. The legal basis is the performance of the customer account contract (Article 6(1)(b) GDPR) and the controller’s legitimate interest in preventing fraud (Article 6(1)(f) GDPR); the controller shows videos on the website and its social networks only with the customer’s consent (Article 6(1)(a) GDPR), which may be withdrawn at any time. The referrer only learns the number of referrals and points awarded, not the referred customer’s name or any other data. The controller processes the data for as long as the customer account exists; when it is deleted, the video links are erased and referral records are unlinked from the account.

6.1. If the data subject contacts the controller via the chat, the contact form, the order support form, e-mail or telephone, the controller processes their name, contact details, the content of the messages including their time, where applicable the number of the related order, and other data that the data subject provides themselves. The website assigns a chat conversation to a visitor who is not signed in by means of the kh_chat cookie described in the Cookie Policy.

6.2. The purpose of the processing is to handle an enquiry, request, complaint or claim for defects. The legal basis is the controller’s legitimate interest in communicating with customers and in handling their submissions (Article 6(1)(f) GDPR); where the communication concerns the conclusion or performance of a contract, also Article 6(1)(b) GDPR; and, when handling claims for defects, compliance with legal obligations under Act No. 634/1992 Coll., on Consumer Protection (Article 6(1)(c) GDPR).

6.3. Chat messages are answered by the controller’s staff. For frequently asked questions, for example about opening hours, the address, delivery or the order status, the chat may provide automatic replies with pre-prepared content. The controller does not currently use artificial intelligence tools to communicate with data subjects; if it introduces an assistant using artificial intelligence in the future, the data subject will be informed of this clearly and in advance, and this Policy will be supplemented accordingly.

6.4. The controller retains chat messages, messages from the contact form and related data for 24 months from the last message in the conversation concerned. It retains requests submitted via the order support form and other documentation relating to claims for defects for 3 years after they have been handled.

7.1. To protect the website against automated attacks and misuse, for example mass sign-in attempts, repeated submission of orders or guessing of discount codes, the controller limits the number of requests from a single source. For this purpose, the IP address is stored only in the form of a one-way hash created with a secret key (a so-called salted hash), from which the IP address cannot be determined without knowledge of that key; the records are deleted after 24 hours at the latest.

7.2. When requests are made to the website, the hosting provider records technical data, in particular the IP address, date and time, the requested address, browser identification and the result of the request, in server logs, which serve to ensure operation, detect errors and protect against attacks. These logs are retained for a short time, usually for no longer than 30 days. Application error logs do not contain e-mail addresses or telephone numbers.

7.3. Actions taken by the controller’s staff in the ordering system, for example changes of status and cancellations of orders, refunds or the processing of account deletion requests, are recorded in audit logs stating the time and the person who performed the action. Audit logs serve to ensure accountability and security and to demonstrate the proper handling of orders, and are retained for 3 years.

7.4. Staff accounts are protected by two-step verification (mandatory for accounts with access to the administration); couriers and other users may turn it on voluntarily. The secret key of the authenticator app is stored by the Supabase Auth authentication service. Users may also sign in with a passkey: the key is created and stored by their device or password manager, which protects it with a fingerprint, facial recognition or the device PIN. Only the public part of the key, its name and the time it was created and last used are transmitted to the controller and stored by the Supabase Auth service; the device does not send biometric data to the controller, and the controller does not process them. When a staff member or courier signs in, the controller records the time of sign-in, a description of the device (browser and operating system) and a one-way hash of a random device identifier stored in a cookie, in order to warn about sign-ins from a new device. Security records further include changes of permissions, enabling and removal of two-step verification, addition and removal of passkeys, repeated failed sign-in attempts (with a hash of the IP address) and blocked attempts to load disallowed content on the website (without personal data). Security records and device data are kept for 1 year.

7.5. The controller also uses the telephone number stated in the order to limit the number of simultaneously open orders placed without registration.

7.6. The legal basis for the processing under this Article is the controller’s legitimate interest in ensuring the security and functionality of the website and in protecting against misuse, fraud and attacks (Article 6(1)(f) GDPR); the processing also serves to ensure the security of personal data under Article 32 GDPR.

8.1. If the data subject gives consent to receiving commercial communications during registration or later in the customer account settings, the controller may send them information by e-mail about the restaurant’s news, offers and promotions. The controller sends commercial communications only on the basis of consent.

8.2. The legal basis is the data subject’s consent (Article 6(1)(a) GDPR and Section 7 of Act No. 480/2004 Coll.). Giving consent is voluntary and is not a condition for concluding a purchase contract or setting up a customer account.

8.3. Consent may be withdrawn at any time in the Personal details section of the customer account, via the unsubscribe link that will be included in every commercial communication, or via the contact details stated in Article 1. Withdrawal of consent does not affect the lawfulness of processing before its withdrawal.

8.4. The controller processes data for sending commercial communications until consent is withdrawn or the customer account is deleted. It retains the record of the giving and withdrawal of consent for 3 years from the withdrawal of consent in order to be able to demonstrate that the communications were sent lawfully (Article 6(1)(f) GDPR). The controller does not carry out profiling for direct marketing purposes.

9.1. If a signed-in user enables notifications (push notifications) in the browser or in the installed web application, the controller processes subscription data: the subscription address provided by the browser’s push service, encryption keys, the link to the customer account, the language, browser and device identification, and the time the subscription was created and the time of the last successful delivery. The notifications provide information about changes in the status of orders and about replies from the controller’s staff in the chat; couriers are notified during their shift about new deliveries available to be taken and that an order they have taken is ready.

9.2. The content of a notification is encrypted for the specific device and contains only the order number, the type of event and, where applicable, the amount or the number of items, and for a chat reply only the information that a reply has arrived; it does not contain the name, telephone number, address or the text of messages. Notifications are delivered by the push services of browser operators, for example Google, Apple, Mozilla or Microsoft, which cannot read the content of the notifications.

9.3. The legal basis is the data subject’s consent expressed by enabling notifications (Article 6(1)(a) GDPR). Consent may be withdrawn at any time by switching off notifications in the customer account or in the browser or device settings. The controller processes subscription data until the subscription is cancelled; subscriptions that the push service marks as invalid are deleted automatically.

9.4. The controller sends notices of changes in the status of orders in the customer account and e-mail messages relating to orders and the customer account, for example order confirmation, a change in its status, confirmation of registration, password reset or change of e-mail address, on the basis of the performance of a contract (Article 6(1)(b) GDPR); these are not commercial communications.

10.1. The website uses only necessary and functional first-party cookies and similar technologies that serve its operation, for example for signing in, keeping the cart, remembering the language and saving cookie settings. The website does not currently use analytical or advertising cookies or third-party cookies. Details are given in the Cookie Policy.

10.2. Fonts are loaded from the website’s server, not from third-party services. With the exception of the map on the order status page (paragraph 4.8), maps and social networks are only linked from the website and are not embedded in it; once the user navigates to them, the processing of personal data is governed by the terms of their operators. Online payment takes place on the pages of the Stripe payment gateway, which are subject to Stripe’s policies.

Applications

11.1. A person interested in cooperating with the controller as a courier (the "applicant") may apply using the form on the website’s page for courier applications. The controller processes the applicant’s name, telephone number and e-mail address and the type of their vehicle (car, scooter or motorbike, bicycle or other) and, where the applicant provides them, also the area or town, information on their availability and a message; the language of the page from which the application was sent is stored together with the application. Instead of filling in the form, the applicant may contact the controller by telephone.

11.2. The purpose of the processing is to assess the applicant and to agree on cooperation with them as a courier. The legal basis is taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR). Providing the name, telephone number, e-mail address and type of vehicle is necessary; without them, the application cannot be sent. The applicant fills in the other details in the form voluntarily.

11.3. Applications are stored in the controller’s database (paragraph 13.2), and only authorised members of the controller’s staff who manage the team have access to them. For each application, the controller also records the status of its handling, an internal note, who handled it and when and, for an approved application, the link to the agreement and to the courier’s account. No automated decision-making takes place when applications are assessed. The controller automatically erases an application 6 months after it was last changed, regardless of whether it was approved, rejected or left unanswered.

Agreement with a courier

11.4. Couriers work for the controller on the basis of an agreement to complete a job (dohoda o provedení práce) or an agreement to perform work (dohoda o pracovní činnosti) under the Labour Code (the "agreement"). The agreement is prepared by an authorised member of the controller’s staff; the applicant receives, at the e-mail address stated in the application, a personal signing link, which is valid for 14 days and is stored only in the form of a one-way hash.

11.5. When signing the agreement, the courier provides, and the controller processes, their full name, date of birth, citizenship, permanent address, birth number (if one has been assigned), bank account number for payment of the remuneration, health insurance company and an indication of whether they wish to sign the taxpayer’s declaration; if the courier drives a car or rides a scooter, also the categories and validity of their driving licence and the registration number of the vehicle and, where travel expense reimbursement has been agreed, the type of fuel and the average consumption of the vehicle. The courier also provides a private e-mail address to which their copy of the agreement will be delivered. The birth number, the bank account number, the address and the text of the signed agreement are stored encrypted (AES-256-GCM) with a key kept separately from the database. Only an authorised member of the controller’s staff can view the complete data, after re-authenticating with two-step verification, and each viewing is recorded.

11.6. The courier signs the agreement electronically: they confirm that they agree with its wording, type their full name and enter a one-time code sent to their private e-mail address. The agreement is signed for the controller by a person authorised to act on its behalf who is signed in with two-step verification. For each signature, the time, a hash of the text of the agreement (SHA-256), a one-way hash of the IP address and a description of the browser are recorded; the course of the agreement (sending, opening of the link, codes, signatures, delivery, termination) is written to a history protected against alteration. The controller sends a copy of the agreement in PDF format to the courier’s private e-mail address (Section 21 of the Labour Code), and the courier can also download it in the courier portal.

11.7. The purpose of the processing is the conclusion and performance of the agreement, the calculation and payment of remuneration, compliance with the controller’s obligations as an employer towards the Czech Social Security Administration, health insurance companies and the tax authority, keeping working time records and the protection of the controller’s legal claims. The legal basis is the performance of a contract (Article 6(1)(b) GDPR), compliance with the controller’s legal obligations under labour, social security and health insurance, tax and accounting legislation (Article 6(1)(c) GDPR) and the controller’s legitimate interest in being able to demonstrate the conclusion and content of the agreement and in ensuring security (Article 6(1)(f) GDPR). Providing the data referred to in paragraph 11.5 is a statutory and contractual requirement; without them, the agreement cannot be concluded. No automated decision-making takes place when the agreement is concluded.

Courier portal and working time records

11.8. After the agreement has been signed by both parties, the courier receives access to the courier portal. The courier signs in with a passkey (paragraph 7.4) or a password; they may turn on two-step verification voluntarily. Sign-in is secured by the Supabase Auth authentication service in the same way as for the customer account (paragraph 5.3). The buyers' data that a courier sees during a delivery are described in paragraph 4.9.

11.9. In the portal, the courier starts and ends shifts and breaks. The controller records the start and end of each period of work, the kilometres travelled by the courier in their own vehicle (where travel expense reimbursement has been agreed) and corrections to the records made by authorised members of the controller’s staff, including the reasons for them. These records constitute working time records under Section 96 of the Labour Code and are also used to calculate the remuneration, including the top-up to the minimum wage and pay supplements, and to monitor the extent of work permitted under the agreement. The courier can accept deliveries, and receives notifications of new deliveries, only during a shift.

11.10. With regard to couriers, the controller further processes the e-mail address used for signing in, the name, the telephone number and the role in the system; data on the deliveries the courier has accepted, i.e. the order number and the times when the delivery was accepted, when the order was picked up and when it was delivered; the courier’s share of each delivered order according to the percentage stipulated in the agreement; the cash the courier collected from buyers on delivery; and a record of its settlement.

11.11. During a delivery, the courier may share their location in accordance with paragraph 4.8: the location is processed only for the duration of the delivery, and the controller stores only the latest location, shows it to the buyer in rounded form and erases it after the order has been delivered or cancelled. The legal basis is the controller’s legitimate interest in informing the buyer about the progress of the delivery (Article 6(1)(f) GDPR).

Retention period

11.12. An agreement that has not been concluded because the controller cancelled it or the signing link expired is erased by the controller 6 months later; an agreement from which the courier has withdrawn is erased 1 year after the withdrawal. Signing links and one-time codes are stored only as hashes and are deleted no later than 90 days after they cease to be valid. The controller retains concluded agreements, the data necessary for the payment of remuneration and for insurance and tax purposes, the working time records and the delivery records for the duration of the agreement and thereafter for the period laid down by legislation on pension, sickness and health insurance, taxes and accounting; it then erases them. When the agreement ends, the courier loses access to the courier portal.

12.1. The controller does not require data concerning health. If the data subject voluntarily provides information about an allergy, intolerance or other health restriction in an order note, in the chat or in another message, the controller will use it exclusively to prepare the order or to respond to the enquiry, on the basis of the data subject’s explicit consent expressed by providing that information (Article 9(2)(a) GDPR). Consent may be withdrawn at any time; such information is retained and erased together with the order data or with the message in which it was provided. Data subjects are advised to provide only information necessary for the preparation of the dish.

12.2. The website’s services are not intended for children under 15 years of age, and a customer account may only be set up by a person who has reached 15 years of age (Section 7 of Act No. 110/2019 Coll.). If the controller discovers that an account has been set up by a person under 15 years of age, it will delete the account and erase the personal data.

13.1. The controller discloses personal data only to the extent necessary for the purpose concerned, namely to:

• authorised staff of the controller and couriers delivering on behalf of the controller (paragraph 4.9), all of whom are bound by a duty of confidentiality;
• the processors listed in paragraph 13.2, who process personal data for the controller on the basis of a data processing agreement under Article 28 GDPR;
• service providers who process personal data partly as independent controllers, in particular the payment service provider and the operators of browser push services;
• external providers of accounting, tax, legal and IT services bound by a duty of confidentiality;
• public authorities, in particular courts, law enforcement authorities, tax authorities and supervisory authorities, where required by law; in the case of couriers, also the Czech Social Security Administration and health insurance companies, to the extent required by insurance legislation.

13.2. The main processors and other recipients are:

• Recipient

  Supabase Pte. Ltd.

  Activity

  database, user authentication, file storage

  Registered office and place of processing

  Singapore; data are stored in the EU (Frankfurt am Main, Germany); technical support may also be provided by a Supabase group company in the USA

  Safeguards for transfers outside the EEA

  standard contractual clauses

• Recipient

  Vercel Inc.

  Activity

  website hosting, content delivery network (CDN), server functions

  Registered office and place of processing

  USA; the website’s server functions run in the Frankfurt am Main region

  Safeguards for transfers outside the EEA

  EU–US Data Privacy Framework, standard contractual clauses

• Recipient

  provider of the service for sending e-mails relating to orders, the customer account and agreements with couriers, if used (e.g. Resend, Inc.)

  Activity

  delivery of e-mail messages, including, for couriers, the signing code and the copy of the agreement

  Registered office and place of processing

  USA

  Safeguards for transfers outside the EEA

  EU–US Data Privacy Framework

• Recipient

  Stripe Payments Europe, Limited, if online payment is offered on the website

  Activity

  processing of online payments

  Registered office and place of processing

  Ireland

  Safeguards for transfers outside the EEA

  in accordance with Stripe’s policies, in particular the EU–US Data Privacy Framework and standard contractual clauses

• Recipient

  operators of browser push services (e.g. Google, Apple, Mozilla, Microsoft)

  Activity

  delivery of encrypted notifications

  Registered office and place of processing

  depending on the browser operator

  Safeguards for transfers outside the EEA

  in accordance with the operator’s terms

• Recipient

  Hyperknot Software Kft. (OpenFreeMap service), if the order map is displayed

  Activity

  map data for the map on the order status page; when the map is displayed, the browser connects to the service’s servers, which thereby see the IP address, browser information and the displayed map area; according to the service’s privacy policy, the IP address is stored only in error logs (for no longer than 7 days) and when security incidents are investigated (for no longer than 30 days)

  Registered office and place of processing

  Hungary (EU); the service may use the Cloudflare content delivery network

  Safeguards for transfers outside the EEA

  for the Cloudflare network, the EU–US Data Privacy Framework

13.3. The controller does not sell personal data or transfer them to third parties for their marketing purposes.

14.1. Some recipients have their registered office outside the European Economic Area or may have access to the data from countries outside it, in particular from the USA and Singapore. The controller transfers personal data to third countries only under the conditions of Chapter V GDPR, namely:

• to recipients in the USA certified under the EU–US Data Privacy Framework, on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data (Article 45 GDPR), the validity of which was confirmed by the General Court of the European Union in its judgment of 3 September 2025 in Case T-553/23;
• in other cases, on the basis of standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (Article 46(2)(c) GDPR), supplemented by additional safeguards where appropriate.

14.2. The website’s database is stored in a data centre in Germany. On request, the controller will provide a copy of the safeguards referred to in paragraph 14.1 or information on where they have been made available.

15.1. The controller does not carry out automated decision-making, including profiling, which would produce legal effects concerning data subjects or similarly significantly affect them (Article 22 GDPR).

15.2. The calculation of the order price according to published prices and discount conditions, automatic replies in the chat and technical security measures, for example temporary limits on the number of requests or of simultaneously open orders, do not constitute decision-making within the meaning of Article 22 GDPR. They are technical and temporary in nature, and the data subject may address any impact of these measures with the controller’s staff.

16.1. The controller has adopted technical and organisational measures to protect personal data, in particular encrypted data transmission (HTTPS), role-based access control with the lowest necessary level of permissions and permission checks at database level, storage of passwords only in the form of a cryptographic hash, encryption of the birth numbers, bank account numbers, addresses and agreements of couriers at application level, separate storage of contact details from orders, audit logs of staff actions and processing of payment data exclusively by the payment service provider.

16.2. After the retention period expires, the controller erases or anonymises the personal data. Data may persist in database backups for as long as the backups are retained, usually for no longer than 30 days; backups serve exclusively for data recovery.

16.3. In the event of a personal data breach, the controller proceeds in accordance with Articles 33 and 34 GDPR.

17.1. Under the conditions laid down in the GDPR, the data subject has the right:

• of access to personal data and to obtain a copy of them (Article 15 GDPR);
• to rectification of inaccurate personal data and completion of incomplete personal data (Article 16 GDPR);
• to erasure of personal data, except for data whose processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims (Article 17 GDPR);
• to restriction of processing (Article 18 GDPR);
• to portability of data processed by automated means on the basis of a contract or consent (Article 20 GDPR);
• to object to processing based on legitimate interest; an objection to processing for direct marketing purposes may be raised at any time, and the controller will then no longer process the data for that purpose (Article 21 GDPR);
• to withdraw, at any time, consent that has been given, without affecting the lawfulness of processing before its withdrawal (Article 7(3) GDPR);
• not to be subject to a decision based solely on automated processing (Article 22 GDPR);
• to lodge a complaint with a supervisory authority (Article 77 GDPR).

17.2. A registered buyer can exercise a number of rights directly in the customer account: they can correct or delete profile data and saved addresses, withdraw consent to receiving commercial communications and permission for notifications in the account settings, and, in the Privacy & data section, download a copy of their data in JSON format or request deletion of the account.

18.1. Rights may be exercised via the contact details stated in Article 1. The controller is entitled to verify the identity of the applicant, in particular by requiring that the request be sent from the e-mail address stated in the customer account or in the order, or that the applicant state the order number and other details known only to the buyer.

18.2. The controller will handle the request without undue delay and no later than one month from its receipt; taking into account the complexity and number of requests, it may extend this period by a further two months, in which case it will inform the applicant, including the reasons. Exercising rights is free of charge; where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may charge a reasonable fee or refuse to act on the requests (Article 12 GDPR).

18.3. The data subject has the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), with its registered office at Pplk. Sochora 727/27, 170 00 Praha 7, e-mail: posta@uoou.gov.cz, data box ID: qkbaa2n, website: https://uoou.gov.cz, or with the supervisory authority of the Member State of the European Union in which they have their habitual residence or place of work or in which the alleged infringement took place.

19.1. The controller is entitled to update this Policy, in particular in the event of changes to the method of processing, the recipients or the legislation. The current version is published on the website together with its effective date. The controller will inform registered buyers of material changes affecting them in the customer account or by e-mail before those changes take effect.