Privacy policy
PRIVACY POLICY of vetiveria.cz
1. Controller
The controller of your personal data is Kristina Shershun, Company ID (IČO) 14163497, U Pernikářky 111/2a, 150 00 Prague 5, Czech Republic, e-mail info@vetiveria.cz, tel. +420 774 533 527. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on Personal Data Processing.
2. What data we process, why and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Processing your order, delivery, payment, complaints and returns | name, address, e-mail, phone, order contents, order number, payment details (no card number); for a gift voucher sent directly to the recipient, also the recipient's name, e-mail and message text | performance of a contract (Art. 6(1)(b) GDPR) | for 2 years for notifying a defect plus the subsequent limitation period, usually 5 years from delivery |
| Tax records and tax obligations | invoicing details, invoices | legal obligation (Art. 6(1)(c) GDPR) | for the period for assessing tax, at most 10 years |
| Customer account | login details, order history, saved addresses | performance of a contract | until the account is closed, at most 2 years after the last login |
| Marketing e-mails (newsletter) | e-mail, name | consent (Art. 6(1)(a) GDPR and Section 7(2) of Czech Act No. 480/2004 Coll.) | until consent is withdrawn |
| Enquiries and communication (e-mail, phone) | contact details, message content | legitimate interest | 1 year after the matter is closed |
| Protection of our rights (disputes, fraudulent orders) | order and communication data | legitimate interest | for the limitation period, usually 3 years; in disputes until they end |
| Advertising on Facebook and Instagram and measuring its effectiveness (Meta Pixel and Conversions API) | IP address, cookie and device identifiers, browser data, pages and products viewed, products added to the cart, checkout started and purchases (order value, currency, order number, products); for matching with your Meta account also your e-mail, phone number, name, city, postcode and country in hashed (pseudonymised) form | consent (Art. 6(1)(a) GDPR) given in the cookie banner | until consent is withdrawn; the Meta cookie (_fbp) expires after 90 days; Meta keeps data under its own policy |
| Website operation, security, statistics | IP address, cookies, device data | legitimate interest / consent (see section 5) | see cookie settings |
Providing the data needed to process your order is voluntary, but without it we cannot fulfil the order.
Newsletter: you can withdraw your consent at any time via the unsubscribe link in every marketing e-mail or by writing to info@vetiveria.cz.
3. Who we share data with
We share your data with the following processors and other recipients, only to the extent necessary for the given purpose. Some of them (in particular carriers and payment service providers) process data as independent controllers under their own policies.
- Shopify International Ltd., Ireland – operator of the e-shop platform (hosting, checkout, customer accounts, order e-mails and automation via Shopify Flow, e.g. creating the Sample Set discount code);
- Shopify Payments (and its payment service providers) – processing payments by card, Apple Pay, Google Pay and Shop Pay; you enter card details directly with them, we never see them; for payments via Shop Pay, Shopify processes data as an independent controller;
- Air Bank a.s. – receiving payments by bank transfer (payer's name and account number);
- carriers Zásilkovna s.r.o. (Packeta) and DPD (Direct Parcel Distribution CZ s.r.o., Direct Parcel Distribution SK s.r.o.) – parcel delivery (name, address or pickup point, phone, e-mail);
- Appfleece, s.r.o., Pardubice, Czech Republic (Globe pickup point and shipping app) – pickup point selection, printing shipping labels and passing data to carriers (order and delivery details);
- Google Ireland Ltd. (Google Analytics) – measuring website traffic and advertising performance, only if you consent to cookies (see Section 5);
- Meta Platforms Ireland Ltd., Dublin, Ireland (Facebook & Instagram) – displaying our ads, measuring their effectiveness and building audiences for advertising (Meta Pixel and Conversions API), only if you consent to marketing cookies (see Section 5); for collecting and transmitting this data, we and Meta are joint controllers under Art. 26 GDPR, Meta is responsible for its further processing; the essence of the arrangement is available at https://www.facebook.com/legal/controller_addendum and Meta's privacy policy at https://www.facebook.com/privacy/policy; Meta may transfer data to Meta Platforms, Inc. in the USA on the basis of the EU-US Data Privacy Framework;
- Lucie Janečková, accountant – bookkeeping and tax records (billing details);
- Fakturoid s.r.o., Prague, Czech Republic (Fakturoid app) – issuing and sending proofs of purchase (invoices) on request (billing details, order contents);
- Shopify Email – sending the newsletter (e-mail, marketing consent status);
- Google Cloud EMEA Ltd., Ireland (Google Workspace) – mailbox for communication with customers;
- Jonas Busch (BuschBytes), Cologne, Germany (Revoq app for online withdrawal from the contract) – receiving withdrawals and sending confirmations;
- public authorities where required by law.
Shopify processes some data outside the EU/EEA as well, in particular in Canada, Singapore and the USA. Transfers within the Shopify group are covered by Binding Corporate Rules approved by the Irish supervisory authority; for transfers to Canada, Shopify may also rely on a European Commission adequacy decision. Transfers to Shopify's sub-processors are covered by standard contractual clauses approved by the European Commission. The Binding Corporate Rules are available at https://www.shopify.com/legal/binding-corporate-rules and the data processing terms at https://www.shopify.com/legal/dpa.
Where other recipients listed above (for example Google or analytics and marketing services) transfer data outside the EU/EEA, they do so only on the basis of a European Commission adequacy decision (for the USA, usually the recipient's certification under the EU-US Data Privacy Framework) or standard contractual clauses. We do not sell your data.
4. Your rights
You have the right to access your data, to have it rectified or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest (including direct marketing – you can unsubscribe from the newsletter via the link in every e-mail). You may withdraw consent at any time. To exercise your rights, write to info@vetiveria.cz; we will respond without undue delay and within 1 month at the latest; in complex cases we may extend this period by a further 2 months, and we will inform you of this.
If you believe we process your data unlawfully, you may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz. Customers from Slovakia may also contact the Slovak Office for Personal Data Protection (www.dataprotection.gov.sk).
5. Cookies
The website uses cookies and similar technologies. Essential cookies (cart, login, security, payment via Shop Pay and pickup point selection via Globe Pickup Points) are used without consent because the site does not work without them. Analytics and marketing cookies (Google Analytics, Meta Pixel and Shopify analytics and marketing cookies) are used only with your consent given in the cookie banner (Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications), where you can change your choice at any time. The list of cookies used and their lifetimes are shown in the cookie settings on the website. If you consent to marketing cookies, information about your visit and purchases is also sent to Meta directly from our e-shop's server (Conversions API), including your e-mail and phone number in hashed form. Without your consent, no data is sent to Meta, either from your browser or from our server.
6. Security and changes
We protect data with technical and organisational measures appropriate to the processing (HTTPS encryption, password-protected access, a limited circle of recipients). We do not carry out automated decision-making or profiling with legal effects. We may update this Policy; the current version is always available at https://vetiveria.cz/policies/privacy-policy.
Effective from 29 October 2026.
