Privacy Policy

1. Who We Are

SpezKr s.r.o.

U Borku 552, Bradlec, 293 06, Czech Republic

Company ID (IČO): 24373869

VAT ID (DIČ): CZ24373869

Registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert No. 440096

Represented by: Ing. Martin Kohuš, executive (jednatel)

Email: spezkr@seznam.cz

We are the data controller for personal data collected through spezkr.com and our related sales and support channels. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.

2. What We Collect

2.1 Data you give us

Order data — first and last name, delivery and billing address, email address, telephone number, order contents and value.
Account data, if you create an account — name, email, password (stored hashed by Shopify), saved addresses, order history.
Communications — the content of emails, contact form submissions, and Instagram or WhatsApp messages you send us, including any photos or documents you attach to a return or complaint.
Newsletter — your email address and the record of your marketing consent.
Reviews — display name, email, rating and review text, if you choose to review a product.

2.2 Data collected automatically

Technical data — IP address, browser type and version, device type, operating system, language and country settings.
Usage data — pages visited, products viewed, referring site, time on site, cart and checkout actions.
Cookies and similar technologies — see section 9 and our Cookie Policy.

2.3 What we never receive

We do not receive or store your full payment card number. Card details are entered directly into the payment provider's environment. We see only the payment result, the card brand and the last four digits.

3. Why We Process It, and On What Legal Basis

Purpose	Data	Legal basis
Processing and fulfilling your order, delivery, and communication about it	Order data, contact data	Art. 6(1)(b) — performance of a contract
Managing your customer account	Account data	Art. 6(1)(b)
Handling withdrawals, returns, warranty claims and complaints	Order data, communications, photos	Art. 6(1)(b) and Art. 6(1)(c)
Issuing invoices, keeping tax and accounting records	Order and billing data	Art. 6(1)(c) — legal obligation (Czech Act No. 235/2004 Coll. on VAT; Act No. 563/1991 Coll. on Accounting)
Sending marketing emails and our newsletter	Email address	Art. 6(1)(a) — consent
Publishing product reviews	Display name, rating, review text	Art. 6(1)(a) — consent
Website security, spam and fraud prevention	Technical data, order data	Art. 6(1)(f) — our legitimate interest in protecting the store from fraud and abuse
Analytics and improving the store	Usage data, cookies	Art. 6(1)(a) — consent, given through the cookie banner
Establishing, exercising or defending legal claims	Whichever of the above is relevant	Art. 6(1)(f) — legitimate interest

Where we rely on legitimate interest, we have weighed that interest against your rights and concluded it does not override them. You can object at any time — see section 8.

4. Who We Share Data With

We do not sell your personal data. We share it only with the recipients below, and only to the extent needed.

4.1 Platform and hosting

Shopify International Limited (Ireland), together with Shopify Inc. (Canada) and its group companies, operates the e-commerce platform, hosts the store and processes orders on our behalf. Shopify also runs automated fraud analysis on incoming orders — see section 7.

4.2 Payments

Shopify Payments, and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). PayPal acts as an independent controller for payments made through it and processes your data under its own privacy statement.

4.3 Delivery

Česká pošta, s.p., PPL CZ s.r.o., Zásilkovna s.r.o., and — depending on destination and parcel size — DPD, GLS or DHL, along with their partner carriers in the destination country (for example Parcelforce in the United Kingdom, USPS in the United States, China Post, or Chunghwa Post in Taiwan). We pass on the recipient's name, delivery address, email address and telephone number so the parcel can be delivered and so the final carrier can contact you.

4.4 Product reviews

Judge.me Ltd (United Kingdom) collects and displays product reviews. It may receive your name, email address, telephone number and order details in order to send review invitations.

4.5 Spam protection

Google Ireland Limited. We use reCAPTCHA on our contact form to tell humans apart from automated abuse. reCAPTCHA collects your IP address and data about how you interact with the page. Google's Privacy Policy and Terms of Service apply.

4.6 Fonts

Our store loads typefaces from Google Fonts (Google Ireland Limited), which means your IP address is transmitted to Google when a page loads.

4.7 Messaging channels

If you contact us on Instagram or WhatsApp, Meta Platforms Ireland Limited processes those messages under its own terms, as an independent controller. We only see and keep the conversation itself.

4.8 Authorities and advisers

Tax authorities, the Czech Trade Inspection Authority, courts, and our accountants and legal advisers — where we are legally required to disclose data, or where it is necessary to establish or defend legal claims.

5. International Transfers

Some of our providers process data outside the European Economic Area. In every case a transfer mechanism recognised under Chapter V GDPR applies:

Canada (Shopify Inc.) — European Commission adequacy decision for commercial organisations.
United Kingdom (Judge.me) — European Commission adequacy decision. Should that decision lapse, we rely on Standard Contractual Clauses.
United States (Shopify sub-processors, Google) — the EU–U.S. Data Privacy Framework where the recipient is certified under it, and otherwise the European Commission's Standard Contractual Clauses together with supplementary technical and organisational measures.

Separately, when we ship goods outside the EEA — for example to the United Kingdom, the United States or Asia — we transmit your name, address and contact details to the carrier and, where required, to the customs authorities of the destination country, so the goods can be cleared and delivered. That transfer is necessary to perform your contract with us (Art. 49(1)(b) GDPR).

You may request a copy of the safeguards we rely on by writing to spezkr@seznam.cz.

6. How Long We Keep Data

Data	Retention period
Invoices and other tax documents	10 years from the end of the tax period in which the transaction took place (Czech VAT Act)
Accounting records	5 years; financial statements 10 years (Czech Accounting Act)
Order and delivery data not forming part of a tax document	4 years from delivery — covering the statutory warranty period and the general limitation period
Customer account	For as long as the account exists; deleted on request
Newsletter subscription	Until you unsubscribe or withdraw consent. We keep the record that consent was withdrawn as evidence that we acted on it.
Contact form messages and email correspondence	2 years from the last message, unless it relates to an order or a claim
Product reviews	Until you ask us to remove them
Cookie consent record	12 months, after which we ask again
Server and security logs	According to Shopify's platform retention periods

Once these periods expire, the data is deleted or irreversibly anonymised.

7. Automated Decision-Making

Shopify applies automated fraud analysis to incoming orders and gives us a risk indication. That indication does not cancel or reject your order by itself — a person at SpezKr reviews any flagged order before deciding what to do. We do not carry out automated decision-making that produces legal effects concerning you within the meaning of Article 22 GDPR, and we do not profile you for advertising purposes.

8. Your Rights

Under the GDPR you have the right to:

Access — confirmation of whether we process your data, and a copy of it.
Rectification — correction of inaccurate data, or completion of incomplete data.
Erasure — deletion of your data where we no longer have a lawful reason to keep it. We cannot delete invoices before the statutory retention period expires.
Restriction — a pause on our use of your data while a dispute about it is resolved.
Portability — the data you gave us, in a structured, machine-readable format, or sent directly to another controller.
Objection — to processing based on our legitimate interest. We will stop unless we can demonstrate compelling grounds that override your interests. Where you object to direct marketing, we stop immediately and without exception.
Withdrawal of consent — at any time, with effect for the future. Every marketing email carries an unsubscribe link, and you can change your cookie choices through the "Cookie settings" link in our footer.

To exercise any of these, write to spezkr@seznam.cz. We respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you if we do. We may ask you to confirm your identity first, so that we do not disclose your data to someone else.

If you believe we have handled your data unlawfully, you may lodge a complaint with:

Úřad pro ochranu osobních údajů (Czech Office for Personal Data Protection)

Pplk. Sochora 27, 170 00 Praha 7, Czech Republic

www.uoou.gov.cz — posta@uoou.gov.cz

If you live in another EU country, you may instead complain to your own national supervisory authority.

9. Cookies

We use cookies and similar technologies. Anything that is not strictly necessary — analytics and marketing — is set only after you accept it in the cookie banner. You can change or withdraw that choice at any time through the "Cookie settings" link in our footer. Full details are in our Cookie Policy.

10. Security

The store runs over HTTPS. Payment data is handled by PCI-DSS compliant providers and never reaches our own systems. Access to the store administration is limited to authorised people and protected by individual accounts. No transmission over the internet can be guaranteed completely secure, so please keep your account password confidential and let us know if you think someone else has used it.

11. Children

Our store is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to This Policy

We may update this policy — for example when we add a new service or provider. The current version is always published here with the "last updated" date at the top. If a change materially affects how we use your data, we will tell newsletter subscribers by email.

13. Contact

SpezKr s.r.o.