Privacy Policy
Privacy Policy
Effective from 16 September 2026.
1. Controller
The controller is PIKASTORE s.r.o., registered office Rybná 716/24, Staré Město, 110 00 Prague 1, Czech Republic, Company ID 19693311, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 390268 (“we”). For personal data matters, contact us at info@pikastore.cz, by phone at +420 775 942 931 or in writing at our registered office.
2. What we process, why, on what legal basis and for how long
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Processing and delivering orders | name, e-mail, phone, delivery and billing address, order contents, chosen delivery and payment method, payment and delivery status, order-related communication | performance of a contract (Art. 6(1)(b) GDPR) | for the duration of the contract and then 4 years (3-year limitation period under Section 629 of the Czech Civil Code plus one year to bring a claim to court); tax documents see Accounting and taxes |
| Payment | payment and transaction result data; card details are processed directly by the payment provider and we do not see them | performance of a contract (Art. 6(1)(b) GDPR) | as for orders |
| Customer account | e-mail, name, addresses, order history | performance of a contract – providing the account (Art. 6(1)(b) GDPR) | until the account is deleted; we may delete an account unused for more than 5 years |
| Withdrawals, claims and refunds | order details, content of the withdrawal or claim, description and photos of the defect, bank account number (if you provide it for a refund), communication | performance of a contract and legal obligations under the Czech Civil Code and Consumer Protection Act (Art. 6(1)(b) and (c) GDPR) | 4 years after settlement; documents forming part of the accounts see Accounting and taxes |
| Accounting and taxes | data on tax and accounting documents (invoices, credit notes) | legal obligation (Art. 6(1)(c) GDPR; Czech Accounting Act, VAT Act) | 10 years from the end of the tax period in which the supply took place (Section 35 of Czech Act No. 235/2004 Coll., on VAT) |
| Customer support | data from messages you send us by e-mail, phone, contact form or social media | performance of a contract where the query concerns an order; otherwise our legitimate interest in answering (Art. 6(1)(b) and (f) GDPR) | 4 years after the query is resolved |
| Newsletter and marketing e-mails | e-mail, name if provided, and e-mail open and link click data | consent (Art. 6(1)(a) GDPR) given by subscribing in the website footer, when registering an account or by ticking the consent box at checkout | until consent is withdrawn (unsubscribe via the link in every e-mail or at info@pikastore.cz) |
| Reviews | data for sending a review invitation (name, e-mail, ordered goods); published review: name as you enter it, rating, text, photos if any | invitation: legitimate interest in obtaining feedback (Art. 6(1)(f) GDPR, Section 7(3) of Czech Act No. 480/2004 Coll.), you can unsubscribe from invitations at any time; publication: your consent given by submitting the review (Art. 6(1)(a) GDPR) | invitations: as for orders; reviews: while published, until you withdraw consent |
| Loyalty programme | e-mail, name, points balance and history, VIP tier, referrals (who referred whom), date of birth if you voluntarily provide it | performance of a contract – programme rules in the Terms and Conditions (Art. 6(1)(b) GDPR); date of birth based on consent (Art. 6(1)(a) GDPR) | for the duration of membership; date of birth until consent is withdrawn |
| Back-in-stock notifications | e-mail, product and size you are interested in | fulfilling your request (Art. 6(1)(b) GDPR) | until the notification is sent or you unsubscribe |
| Analytics and advertising (cookies and pixels) | cookie and device identifiers, IP address, browser information, pages visited, products viewed and added to cart, purchases; for the Meta and TikTok pixels also e-mail and phone from the order to match the purchase (advanced matching) | consent (Art. 6(1)(a) GDPR, Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications) | until consent is withdrawn, at most for the lifetime of the individual cookies (see section 5) |
| Operation and security of the store | technical data (IP address, device and browser data), login and order records for fraud prevention | legitimate interest in secure operation (Art. 6(1)(f) GDPR); strictly necessary cookies under Section 89(3) of the Electronic Communications Act | as long as necessary for security, at most 4 years |
| Internal order-management system | order, customer, shipment and claim data transferred from Shopify to our internal system, its backups and internal notifications for our team | legitimate interest in efficient order processing (Art. 6(1)(f) GDPR) | same as for the purpose the data serves (order, claim, accounting) |
| Defence of legal claims | data needed to establish, exercise or defend claims | legitimate interest (Art. 6(1)(f) GDPR) | for the duration of the dispute and the limitation period |
The data required for an order (name, contact details, address) is necessary to conclude and perform the contract; without it we cannot process the order. Other data (newsletter, date of birth, reviews, cookies) is provided voluntarily.
Profiling. Based on your purchase history, we may assess which offers might interest you (legitimate interest, Art. 6(1)(f) GDPR). You can object to this at any time. There is no automated decision-making producing legal effects concerning you or similarly significantly affecting you.
3. Recipients
We share data only to the extent necessary with the following recipients. Processors have a data processing agreement with us; independent controllers process data under their own policies.
| Recipient | Purpose | Role | Transfers outside the EEA and safeguards |
|---|---|---|---|
| Shopify International Limited (Ireland) | store platform: website, cart, checkout, customer accounts, order e-mails, store statistics | processor | Canada (Shopify Inc.) – European Commission adequacy decision; other sub-processors – standard contractual clauses |
| Stripe Payments Europe, Ltd. (Ireland) via Shopify Payments | processing card, Apple Pay, Google Pay, Shop Pay and other online payments | payment service provider | EEA; outside the EEA under the provider's policies |
| Klarna Bank AB (publ) (Sweden) | if you choose to pay with Klarna at checkout | independent controller | EEA |
| Carriers: Zásilkovna/Packeta, PPL, DPD, GLS, DHL and, abroad, the carriers listed in our Shipping Policy | delivering the parcel, delivery notifications, collecting cash on delivery | independent controllers or processors | country of delivery |
| Shipdock app (ShipD Delivery) | passing shipment data to carriers, printing labels, shipping confirmation e-mail | processor | EEA |
| Google Ireland Limited (Ireland) | Google Analytics 4, Google Ads, Google Tag Manager and Merchant Center (only with cookie consent); the info@pikastore.cz mailbox (Google Workspace) | processor; independent controller for advertising | USA (Google LLC) – EU-US Data Privacy Framework |
| Meta Platforms Ireland Limited (Ireland) | Meta Pixel for Facebook and Instagram (only with cookie consent) | joint controller for collection and transmission, then independent controller | USA (Meta Platforms, Inc.) – EU-US Data Privacy Framework |
| TikTok Technology Limited (Ireland) | TikTok Pixel (only with cookie consent) | joint controller for collection and transmission, then independent controller | outside the EEA – standard contractual clauses |
| Inspigroup s.r.o., Company ID 24263532, Křižíkova 148/34, 186 00 Prague 8, Czech Republic (GLAMI) | GLAMI piXel – conversion tracking from the GLAMI comparison site (only with cookie consent) | independent controller | EEA |
| Judge.me | sending review invitations, collecting and displaying reviews | processor | outside the EEA – standard contractual clauses |
| Trustpilot A/S (Denmark) | invitations to review us on Trustpilot (name, e-mail, order number) | processor for invitations; publishes reviews on Trustpilot as an independent controller | EEA |
| BON Loyalty (Hanoi, Vietnam) | loyalty programme (points, VIP tiers, referrals, birthday bonus) | processor | Vietnam – standard contractual clauses under Commission Decision (EU) 2021/914 (Annex I of the data processing agreement); provider's servers in the USA |
| Kbite (Back In Stock, Notify Me) | back-in-stock e-mail notifications | processor | according to the provider |
| Other apps loaded on the website: Instafeed (Instagram posts), SEOAnt Trust Badges, MBC Bundles (bundles), Multifeeds (product feeds) | displaying website content and features; when a page loads they may process your IP address and technical device data | processors | according to the provider |
| netcup GmbH (Germany) | hosting of our internal order-management system | processor | EEA (Germany) |
| Cloudflare, Inc. | storage of internal system backups | processor | USA – EU-US Data Privacy Framework |
| Discord (Discord Netherlands B.V. / Discord Inc.) | internal notifications for our team about orders and system operation | processor | USA (Discord Inc.) – EU-US Data Privacy Framework |
| Public authorities, courts, lawyers, tax and accounting advisers | where required by law or necessary to defend our rights | independent controllers | Czech Republic |
4. Transfers outside the European Economic Area
Where a recipient processes data outside the EEA, this happens only on the basis of a European Commission adequacy decision (Art. 45 GDPR; for example Canada or US companies certified under the EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission (Art. 46 GDPR). We will provide a copy of the safeguards on request.
5. Cookies and similar technologies
Cookies are small files stored in your browser. We use strictly necessary cookies without consent because the store cannot work without them (cart, checkout, login, security, storing your cookie choice). We use analytics and marketing cookies and pixels only with your consent, which you give or refuse in the cookie banner. You can change your choice at any time via the “Cookie preferences” link in the website footer; withdrawing consent does not affect processing before the withdrawal.
| Category | Tools and example cookies | Purpose | Basis |
|---|---|---|---|
| Strictly necessary | Shopify | cart, checkout and account functions, security, storing your cookie choice | no consent needed (Section 89(3) of the Electronic Communications Act) |
| Analytics | Google Analytics 4 (e.g. _ga, _ga_*), Shopify statistics | measuring traffic and purchases | consent |
| Marketing | Google Ads (e.g. _gcl_au), Meta Pixel, TikTok Pixel (e.g. _ttp, _tt_enable_cookie, ttcsid), GLAMI piXel | measuring ad performance and showing relevant ads | consent |
Data from analytics and marketing tools is processed by the providers listed in section 3.
6. Your rights
- Access – you can find out whether and what data we process about you and obtain a copy (Art. 15 GDPR).
- Rectification of inaccurate or completion of incomplete data (Art. 16 GDPR).
- Erasure of data we no longer need or process without a legal basis; data we must keep by law will be deleted when the statutory period ends (Art. 17 GDPR).
- Restriction of processing, for example while the accuracy of data is being verified (Art. 18 GDPR).
- Data portability – data you provided and that we process by automated means on the basis of a contract or consent will be given to you in a structured, machine-readable format (Art. 20 GDPR).
- Objection to processing based on legitimate interest, including profiling; you can object to direct marketing at any time and we will stop processing for that purpose (Art. 21 GDPR).
- Withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3) GDPR).
- Complaint to the supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 727/27, 170 00 Prague 7, Czech Republic, uoou.gov.cz (Art. 77 GDPR).
Exercise your rights by e-mail at info@pikastore.cz or in writing at our registered office; some data can also be edited in your customer account. We respond without undue delay and within one month at the latest; in complex cases this may be extended by two further months, and we will inform you (Art. 12(3) GDPR). To avoid disclosing data to someone else, we may ask you to verify your identity.
7. Sources of data
Most data is provided by you. We also receive data from payment providers (payment result), carriers (delivery status), the review and loyalty apps, and analytics tools if you have consented to cookies.
8. Security
Only authorised staff have access to data, to the extent needed for their work. We use secure connections, access control and backups.
9. Changes
We may update this policy, for example when the services we use change. The current version is always on this page. This policy is effective from 16 September 2026.