Privacy policy
Effective from: 18 September 2026
This policy describes how Treasures (hereinafter "we", "Treasures" or the "controller") processes the personal data of visitors and customers of the treasuresprague.com online store in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter "GDPR") and Czech Act No. 110/2019 Coll., on the processing of personal data.
1. Who is the controller of your data
Tina Tobolová
Company ID (IČO): 19554681
Registered address: Holubova 844, Holice, 534 01, Czech Republic
Contact e-mail: hello@treasuresprague.com
Given the scope and nature of the processing, Treasures has not appointed a data protection officer (DPO). In all matters relating to personal data protection, you can contact us directly at the e-mail address above.
2. What personal data we process
- Identification and contact details: first name, surname, billing and delivery address, e-mail, phone number
- Order data: ordered goods, purchase history, order value, payment and shipping method
- Payment data: payments are processed exclusively by the payment gateway integrated into the Shopify platform; Treasures has no access to payment card numbers and does not store them
- Communication data: the content of e-mail or other correspondence if you contact us (enquiries, complaints, etc.)
- Newsletter data: e-mail address and, where applicable, name, if you subscribe to our newsletter
- Data from cookies and similar technologies: IP address, device identifiers, behaviour on the website, source of the visit – see Article 7
- Customer account data, if you create an account in the online store, including the related order history
Treasures does not process special categories of personal data (e.g. health data) and does not intentionally target its services at persons under 16.
3. Where we obtain personal data
Primarily directly from you – when you place an order, register an account, subscribe to the newsletter or communicate with us. In addition, automatically through cookies and similar technologies when you visit the website (see Article 7).
4. Purposes and legal basis of processing
| Purpose | Legal basis | Retention period |
|---|---|---|
| Processing orders, delivering goods, communication about the order | Performance of a contract (Art. 6(1)(b) GDPR) | For the duration of the contractual relationship and thereafter as set out in Article 8 |
| Accounting and tax obligations | Compliance with a legal obligation (Art. 6(1)(c)) | 10 years from the end of the tax period |
| Handling complaints and warranty claims | Performance of a contract and legal obligation (Art. 6(1)(b), (c)) | Warranty period + 3 years |
| Fraud prevention, authentication of goods, debt collection | Legitimate interest of the controller (Art. 6(1)(f)) | Max. 3 years from the end of the contractual relationship |
| Sending newsletters and commercial communications | Consent (Art. 6(1)(a)), or legitimate interest for existing customers | Until consent is withdrawn / an objection is raised |
| Website traffic analysis (Google Analytics) | Consent given via the cookie banner | Until consent is withdrawn, at most for the validity of the cookie |
| Targeted advertising and remarketing (Meta/Instagram Pixel) | Consent given via the cookie banner | Until consent is withdrawn, at most for the validity of the cookie |
5. Who we share personal data with
To fulfil the purposes above, personal data may be made available to the following categories of recipients and processors, always only to the extent necessary and on the basis of a data processing agreement:
- Shopify (Shopify Inc. / Shopify International Ltd.) – online store platform and hosting
- the provider of the payment gateway integrated into Shopify – payment processing
- shipping companies and pickup points, depending on the chosen delivery method
- Google Ireland Limited (Google Analytics) – website traffic analysis
- Meta Platforms Ireland Limited (Facebook/Instagram Pixel) – advertising and remarketing
- the provider of the e-mail marketing tool – sending newsletters and commercial communications
- accountant/tax advisor – bookkeeping and tax matters
- public authorities, where required by law
6. Transfers of personal data to third countries
Some of the processors listed above (in particular Shopify, Google and Meta) may process data on servers outside the European Economic Area, including the USA. Such transfers are safeguarded by standard contractual clauses approved by the European Commission or another appropriate mechanism under the GDPR.
7. Cookies and similar technologies
The treasuresprague.com website uses cookies and similar technologies to ensure the website works, to analyse traffic and to personalise advertising. An overview of the cookies used and the option to set or withdraw your consent at any time can be found in the cookie banner shown when you visit the website. We distinguish:
- Necessary cookies – required for the online store to function (e.g. cart, login); no consent is required
- Analytics cookies (Google Analytics) – require your consent
- Marketing / advertising cookies (Meta/Instagram Pixel) – require your consent
You can withdraw your consent to optional cookies at any time via the cookie banner settings or in your browser settings.
8. How long we keep personal data
We keep personal data only for as long as necessary to fulfil the purpose for which it was collected (see the table in Article 4), or for the period required by law (e.g. accounting and tax documents for 10 years). After this period, the data is securely deleted or anonymised.
9. Your rights
In connection with the processing of your personal data, you have the right:
- of access to your personal data (Art. 15 GDPR)
- to rectification of inaccurate or incomplete data (Art. 16)
- to erasure ("right to be forgotten"), unless this conflicts with another legal obligation of Treasures (Art. 17)
- to restriction of processing (Art. 18)
- to data portability (Art. 20)
- to object to processing based on legitimate interest, including direct marketing (Art. 21)
- to withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal (Art. 7(3))
- to lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.cz) if you believe your right to personal data protection has been violated
You can exercise your rights by sending a request to the contact e-mail stated in Article 1. We will respond without undue delay, at the latest within 1 month of receiving the request.
10. Data security
Treasures takes appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure, including by using the security provided by the Shopify platform.
11. Automated decision-making
Treasures does not carry out automated decision-making or profiling that would have legal effects on you or similarly significantly affect you.
12. Changes to this policy
We may update this policy from time to time, in particular in connection with changes in legislation or in the way we process data. The current version is always available on this page; the date of the last update is stated at the top of the document.
13. Contact
If you have any questions regarding personal data protection, please contact us at: hello@treasuresprague.com
This is an English translation. In case of any discrepancy, the Czech version prevails.