Privacy Policy

1. What data we process and why

Orders in the online shop

• Data: name, e-mail, phone, delivery address, optionally company name and ID, order contents, order number, payment details (without your bank account number unless you provide it).
• Purpose and legal basis: conclusion and performance of the purchase contract (Art. 6(1)(b) GDPR) – order confirmation, delivery, handling of complaints or withdrawal; compliance with legal obligations, in particular accounting and tax records (Art. 6(1)(c) GDPR).
• Retention: for the duration of the contract and the limitation periods arising from it (usually 3 years from delivery); accounting and tax documents for the period required by Czech accounting and tax law (usually 5 to 10 years).

Contact form and enquiries

• Data: name, phone or e-mail and the content of your message.
• Purpose and legal basis: replying to your enquiry and pre-contractual negotiations (Art. 6(1)(b) GDPR) or our legitimate interest in communicating with customers (Art. 6(1)(f) GDPR).
• Retention: for the time needed to handle the enquiry and then at most 1 year if no contract is concluded.

Website operation

• Data: IP address, browser and device type, pages visited and time of visit – as technical hosting logs.
• Purpose and legal basis: security and functionality of the website, defence against attacks (Art. 6(1)(f) GDPR – legitimate interest).
• Retention: hosting logs are deleted automatically, usually within 30 days.

Reorder reminders

• When you buy consumables from us (such as coffee or a water filter for a coffee machine), we will send you an e-mail reminder when, based on typical use, you are likely to be running out, with a link to the same or similar products.
• Data: e-mail, name, the products purchased and the order date.
• Purpose and legal basis: offering similar products to our customers (Section 7(3) of Czech Act No. 480/2004 Coll., on certain information society services) and our legitimate interest in customer care (Art. 6(1)(f) GDPR).
• How to opt out: tick "I don't want reminders or offers of similar products by e-mail" at checkout, use the unsubscribe link in any such e-mail, or write to info@opravdukafe.cz. Opting out is free and order confirmations will still be sent.
• Retention: for as long as the order data is kept; we keep the opt-out record for as long as it applies so that we do not contact you again.

2. Who we share data with

We do not pass personal data to anyone for their own marketing. To operate the shop we use the following processors and recipients, who process data only on our instructions:

• Vercel Inc. (USA) – website hosting and image storage; servers are operated in the EU (Frankfurt); transfers to the USA are covered by standard contractual clauses and the EU-U.S. Data Privacy Framework.
• Neon Inc. (USA) – shop database, operated in an EU data centre (Frankfurt).
• Resend Inc. (USA) – sending order confirmations and reorder reminders by e-mail; transfers covered by standard contractual clauses.
• Carriers PPL CZ s.r.o. and Direct Parcel Distribution CZ s.r.o. – name, address, phone and e-mail for parcel delivery.
• Supabase Inc. (USA) – database of our internal system (CRM), to which orders are passed for invoicing; data is stored in the EU (Ireland).
• Seznam.cz, a.s. (Czech Republic) – sending invoices and credit notes by e-mail from our internal system.
• Comgate, a.s. (Czech Republic), payment gateway operator – for online payments: name, e-mail, phone, order number, amount and delivery address. You enter card details directly on the payment gateway; we never receive them.
• External accountant and tax adviser – invoicing data for bookkeeping.
• Czech Office for Surveying, Mapping and Cadastre (RÚIAN) and the Ministry of Finance (ARES) – when you fill in the order form, the text you type into the address field and the company ID you enter are sent to these public registers so the website can suggest the address and fill in company details. No other data is passed to them.
• Only if you consent to cookies: Google Ireland Ltd. (Google Analytics, Google Ads), Meta Platforms Ireland Ltd. (Meta Pixel) and Seznam.cz, a.s. (Sklik) – see Section 3.
• Public authorities where required by law (e.g. tax office, Czech Trade Inspection Authority).

3. Cookies and analytics

Cookies are small files that a website stores in your browser. We use essential cookies and storage without consent because the website cannot work without them (Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications). We use other cookies and similar technologies only with your consent (Art. 6(1)(a) GDPR), which you give in the banner on your first visit.

Essential:

• cart contents – stored locally in your browser (localStorage), not with us; until the cart is emptied,
• ok_consent – stores your cookie choice; 6 months, after which we ask again,
• administration login cookie and the preview-mode access cookie – for authorised persons only.

We also measure traffic with Vercel Web Analytics, which uses no cookies and stores no visitor identifiers; the data is anonymous and aggregated.

Analytics (only with consent):

• Google Analytics 4 (Google Ireland Ltd.) – traffic statistics: pages and products you view, items you add to the cart, checkout starts and completed purchases (order number, items and value, without your name or contact details), where you came from, device type and approximate location based on IP address. Cookies _ga and _ga_*; 13 months.

Marketing (only with consent):

• Google Ads (Google Ireland Ltd.) – measuring ad performance and remarketing. Cookies _gcl_* and Google cookies; up to 13 months.
• Meta Pixel (Meta Platforms Ireland Ltd.) – measuring ads and showing ads on Facebook and Instagram to people who have visited our website. Cookies _fbp and _fbc; 3 months.
• Sklik (Seznam.cz, a.s.) – retargeting: showing ads in the Seznam network to people who have visited our website. Seznam cookies; up to 1 year.

Google and Meta may transfer data to the USA; transfers are covered by the EU-U.S. Data Privacy Framework and standard contractual clauses. We see data from these tools only in aggregated form and do not use it for automated decision-making.

You can change or withdraw your consent at any time via “Cookie settings” in the website footer; withdrawal does not affect the lawfulness of processing before it. You can also delete or block cookies in your browser settings.

The Contact page includes a Google Maps map. It loads only after you click “Show map”; only then does Google process your IP address and browser data under its own privacy policy. We remember this choice in your browser (ok_maps in localStorage) until you clear it.

4. Security

Communication with the website is encrypted (HTTPS). Orders are accessible only to the controller's authorised person through a password-protected administration. We do not process payment card data – for online payments you enter it directly on the secure Comgate payment gateway.

5. Your rights

Under the GDPR you have the right:

• to access the personal data we process about you and obtain a copy,
• to rectification of inaccurate or completion of incomplete data,
• to erasure where the data is no longer needed for its purpose and no legal obligation (e.g. invoice archiving) prevents it,
• to restriction of processing,
• to portability of the data you provided, in a machine-readable format,
• to object to processing based on legitimate interest,
• to lodge a complaint with the supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

You can exercise your rights by e-mail at info@opravdukafe.cz or in writing to our premises. We reply within 1 month at the latest; for complex requests we may extend this by a further 2 months and will inform you. We may ask for additional information to verify your identity.

Providing the data marked as required in the order or contact form is necessary to conclude the contract or handle the enquiry. We do not carry out automated decision-making with legal or similarly significant effects. If you consent to marketing cookies, advertising platforms (Google, Meta, Seznam) may tailor the ads they show you based on your visit to our website.

6. Changes to this policy

We may update this policy, for example when changing suppliers. The current version is always available at www.opravdukafe.cz/en/privacy-policy. This version takes effect on 23 October 2026.