Privacy policy

2. Privacy Policy

2.1. This Privacy Policy describes how we collect, use, and share your personal data when you visit, use, or make a purchase through the Klara Popel website interface or otherwise communicate with us.

2.2. The Seller, acting as the controller of personal data (hereinafter also referred to as the “Personal Data Controller”), cooperates in the course of its business activities carried out through the Klara Popel website interface with the Shopify platform.

2.3. The Personal Data Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “GDPR”), Act No. 89/2012 Coll., the Civil Code, and other related legal regulations.

2.4. Below is a list of personal data, the method of its processing, the period for which your personal data is processed, the purpose of the processing, as well as information provided to you as data subjects by the controller.

2.5. The controller processes only the basic data strictly necessary, namely:

2.6. identification data (your first and last name, business name, residential or registered office address, where applicable also your delivery address, company registration number, tax identification number, and, where relevant for a specific business case, date of birth),

2.7. contact data (your e-mail address and telephone number, where applicable IP address and other technical data to the extent necessary for the functioning of the website interface and compliance with legal obligations).

2.8. The controller processes personal data that you have provided to it or personal data obtained by the controller on the basis of fulfilling your order.

2.9. The legal basis for the processing of personal data is:

2.10. performance of the contract between the seller and the customer,

2.11. compliance with the legal obligations of the controller.

2.12. Personal data is processed by the controller for the purpose of handling your order, delivering goods or digital content, communicating with the customer, and complying with the controller’s own legal obligations towards the state.

2.13. Your personal data is stored by the Controller for the period necessary to exercise rights and obligations arising from the contractual relationship or for the period necessary to fulfil archival obligations under other legal regulations.

2.14. After the retention period for personal data expires, your personal data will be deleted.

2.15. The controller transfers personal data in particular to the following recipients: the provider of the Shopify e-commerce platform, payment service providers, the provider of fulfilment and production services Printful, carriers, and other processors where necessary for the performance of the contract or compliance with the controller’s legal obligations.

2.16. Pursuant to Article 15 GDPR, the customer has the right to request access to the personal data being processed concerning them and to the following information:
2.16.1. the purpose of the processing of personal data,
2.16.2. the category of personal data being processed,
2.16.3. the categories of recipients to whom personal data has been or will be disclosed,
2.16.4. the period of processing and storage of personal data,
2.16.5. all available information about the source of the personal data, if it was not obtained from you,
2.16.6. whether automated decision-making, including profiling, takes place.

2.17. Article 16 GDPR grants the customer the right to rectification of personal data if it is inaccurate, incomplete, or outdated.

2.18. Pursuant to Article 17 GDPR, the customer has the right to erasure of personal data if:
2.18.1. the data is no longer necessary for the purpose for which it was collected or otherwise processed,
2.18.2. the customer has withdrawn consent to the processing of the data,
2.18.3. the data has been processed unlawfully,
2.18.4. the data must be erased in order to comply with a legal obligation under EU or Member State law applicable to the controller, or
2.18.5. the customer has objected to the processing under Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the customer has objected to the processing under Article 21(2) GDPR.

2.19. The customer is granted the right to restriction of processing of personal data (Article 18 GDPR) if:
2.19.1. the customer contests the accuracy of the personal data, for a period enabling the Seller to verify the accuracy of the personal data,
2.19.2. the processing is unlawful and the Customer opposes the erasure of the personal data and requests the restriction of its use instead,
2.19.3. the Seller no longer needs the personal data for the purposes of processing, but the Customer requires it for the establishment, exercise, or defence of legal claims,
2.19.4. the Customer has objected to processing pursuant to Article 21(1) GDPR pending verification whether the legitimate grounds of the Seller override those of the Customer.

2.20. Pursuant to Article 20 GDPR, the Customer may request that their personal data be provided in a structured, commonly used, and machine-readable format or that such data be transmitted directly to another controller where:
2.20.1. the processing is based on consent under Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, or on a contract under Article 6(1)(b) GDPR, and
2.20.2. the processing is carried out by automated means.

2.21. Pursuant to Article 21 GDPR, the Customer has the right, on grounds relating to their particular situation, to object to processing of personal data concerning them based on Article 6(1)(e) or (f), including profiling based on those provisions.

2.21.1. Unless compelling legitimate grounds for the processing of personal data are demonstrated which override the interests or rights and freedoms of the data subject, or for the establishment, exercise, or defence of legal claims, the personal data will no longer be processed.

2.22. The Privacy Policy may be updated. The latest binding version will always be published on the Klara Popel website interface.