Legal
Privacy Policy
What personal data Moriarty Karabinier processes, why, on what legal basis, for how long, who receives it, and how you exercise your rights under the GDPR.
Template prepared for the operator — to be reviewed by a lawyer before launch.
1. Controller
The controller of your personal data is Moriarty Karabinier, test-street, 66677 test-city, test-country, company ID 12222, e-mail [email protected]. We have not appointed a data protection officer; write to the address above with any privacy question.
2. What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Processing and delivering orders, payment, customer service | name, e-mail, phone, delivery and billing address, order contents, payment status (no card numbers) | Performance of a contract — Art. 6(1)(b) GDPR | For the duration of the contract and the limitation period for claims (typically 4 years) |
| Accounting and tax records (invoices) | invoice data, order data | Legal obligation — Art. 6(1)(c); Act 563/1991 Coll. on accounting, Act 235/2004 Coll. on VAT | 10 years from the end of the year the invoice relates to |
| Customer account | name, e-mail, password (stored only as an Argon2 hash), order history, delivery and billing details you chose to save for the next checkout | Contract — Art. 6(1)(b) | Until you delete the account |
| Selected pieces for customer groups | membership in customer groups we form from purchase history (e.g. total spent), so that we can offer some pieces only to their members; no automated decision with legal effect, you can object at any time | Legitimate interest — Art. 6(1)(f) | Until you delete the account or we remove you from the group |
| Complaints and withdrawals | contact data, order, description of the defect, correspondence | Legal obligation — Art. 6(1)(c); Act 89/2012 Coll. (Civil Code) and Act 634/1992 Coll. | 5 years from the resolution of the complaint |
| Mailing list | e-mail, language, date of consent | Consent — Art. 6(1)(a) (at checkout: Art. 6(1)(f) with § 7(3) Act 480/2004 Coll. for our own similar products) | Until you unsubscribe (every e-mail contains a link) |
| Statistics (only if you allow statistics cookies) | random visitor ID, pages and products viewed, add-to-bag and checkout steps, referring website, campaign tags, device type, browser, language — no IP address | Consent — Art. 6(1)(a) and § 89(3) Act 127/2005 Coll. | 13 months |
| Proof of cookie consent | choice made, policy version, time, random visitor ID | Legal obligation to demonstrate consent — Art. 7(1) GDPR | 5 years |
| Security, fraud and abuse prevention | IP address in the web server access log; warnings and errors of the application (no IP address); rate-limit counters; staff sign-ins | Legitimate interest — Art. 6(1)(f) | Access log 30 days; application log 90 days; counters minutes |
Providing data marked as required at checkout is necessary to conclude the contract; without it we cannot process the order. We do not use automated decision-making or profiling with legal effects.
3. Recipients
- Stripe Payments Europe, Ltd. (Ireland) — card payments. Stripe may transfer data to Stripe, Inc. (USA) under the EU–US Data Privacy Framework and standard contractual clauses.
- The carrier you choose (the carriers offered are listed on the Shipping page) — name, delivery address, phone, e-mail, and the amount to collect for cash on delivery.
- Hetzner Online GmbH (Germany) — servers, database, backups, mailboxes and delivery of order e-mails; processor under Art. 28 GDPR.
- Brevo (Sendinblue SAS, France) — delivery of mailing-list e-mails, only if you subscribe; processor under Art. 28 GDPR.
- When you choose pickup-point delivery at checkout, the pickup-point map is loaded from Packeta (Zásilkovna s.r.o., Czech Republic) with map tiles from the OpenStreetMap Foundation (United Kingdom, covered by an EU adequacy decision); your browser then sends them your IP address.
- Our accountant and public authorities where the law requires it.
We never sell personal data and use no advertising networks or third-party analytics.
4. Your rights
You have the right of access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20), to object to processing based on legitimate interest (21), and to withdraw consent at any time without affecting prior processing (7(3)).
Signed-in customers can download all their data and delete their account themselves under Account → Your data. Cookie consent can be changed at any time via “Cookie settings” in the footer. Otherwise write to [email protected]; we reply within one month.
You may lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz — or with the authority in your EU country of residence.
5. Security
Connections are encrypted (HTTPS/HSTS); passwords are stored only as Argon2 hashes; the administration is reachable only from a private network; access is logged. Card data never touches our systems.