Privacy policy
PRIVACY POLICY
Last updated: August 11, 2026
I. DATA CONTROLLER
The controller of personal data is:
Vintage therapy s.r.o.
Registered office: Rybná 716/24, Prague 1, Czech Republic
Company Registration Number (IČO): 19759142
Represented by its Managing Director, Hana Sarvajová
Hereinafter referred to as the "Controller", "we", "us", or "our".
This Privacy Policy describes how the Controller collects, uses, stores, and, where applicable, shares the personal data of visitors and customers of the online store www.vintagetherapy.cz.
Our online store operates on the Shopify platform. In connection with the operation of our store, personal data may also be processed by Shopify and other service providers that we use, particularly for order processing, payments, shipping, customer communication, analytics, marketing, and website operations.
This Privacy Policy applies primarily to the processing of personal data when you visit our online store, create a customer account, place an order, return or make a complaint about a product, contact customer support, subscribe to marketing communications, or use other features of our online store.
The processing of personal data in connection with our online store is subject to the General Data Protection Regulation (GDPR).
II. PERSONAL DATA WE PROCESS
Depending on how you use our online store or communicate with us, we may process the following categories of personal data:
Identification and contact information, including:
-
First and last name
-
Billing and shipping addresses
-
Email address
-
Telephone number
Order and transaction information, including:
-
Order number and details
-
Products ordered
-
Prices
-
Payment and shipping methods
-
Payment confirmation information
-
Order history
-
Information relating to product returns, withdrawal from contracts, or complaints
Payment information
Information necessary to process payments may be handled by the relevant payment service providers. As a rule, the Controller does not have access to your complete payment card number.
Customer account information, if you create an account, including:
-
Login information
-
Order history
-
Account settings and preferences
Information you voluntarily provide when communicating with us, such as:
-
Email correspondence
-
Customer support messages
-
Information submitted through return and withdrawal forms
-
Information relating to product complaints
Technical and website usage information, including:
-
IP address
-
Device and browser information
-
Device identifiers
-
Information about how you use our online store
-
Information collected through cookies and similar technologies
III. SOURCES OF PERSONAL DATA
We primarily collect personal data:
-
Directly from you when you place an order, register an account, contact us, or complete a form
-
Automatically when you use our online store, through cookies and similar technologies
-
From service providers responsible for payment processing, platform operations, shipping, or other technical services
-
Where applicable, from other partners, provided that such processing complies with applicable law
IV. PURPOSES AND LEGAL BASES FOR PROCESSING
We process personal data only where an appropriate legal basis exists.
1. Performance of a Contract
We process personal data for the purposes of:
-
Receiving and fulfilling orders
-
Processing payments
-
Delivering products
-
Communicating about orders
-
Managing customer accounts
-
Processing product returns
-
Handling withdrawals from contracts
-
Handling complaints and warranty claims
-
Providing customer support
If you do not provide the information necessary to enter into or perform a contract, we may be unable to process your order.
2. Compliance with Legal Obligations
We process certain personal data where required by law, particularly in connection with:
-
Accounting
-
Tax obligations
-
Consumer protection
-
Handling customer complaints
-
Demonstrating compliance with our legal obligations
3. Legitimate Interests
Where permitted by applicable law, we may process personal data based on our legitimate interests, particularly for:
-
Protecting our rights and legal claims
-
Preventing and detecting fraudulent activities
-
Securing our online store
-
Resolving disputes
-
Protecting our property and systems
-
Improving the operation of our services to a reasonable extent
4. Consent
Where consent is the applicable legal basis, we process personal data only within the scope of the consent provided.
This may apply in particular to:
-
Newsletter subscriptions
-
Certain marketing activities
-
Analytical and marketing cookies
You may withdraw your consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
V. MARKETING AND COMMERCIAL COMMUNICATIONS
If you subscribe to our newsletter or other marketing communications, we may send you information about our products, new arrivals, events, promotions, and other offers.
You may unsubscribe at any time by using the unsubscribe link included in our marketing emails or by contacting us directly.
In circumstances permitted by law, we may also use the electronic contact details of our existing customers to send commercial communications concerning our own similar products or services.
In such cases, you will always have a simple way to opt out of receiving these communications.
The GDPR governs the legal basis for processing contact information, while Czech Act No. 480/2004 Coll. also regulates the sending of electronic commercial communications.
VI. COOKIES AND SIMILAR TECHNOLOGIES
Our online store uses cookies and similar technologies.
Some cookies are necessary for the proper functioning of the online store, including:
-
Shopping cart functionality
-
Website security
-
Customer login
-
Storage of technical preferences
Other cookies may be used for purposes such as:
-
Website analytics and traffic measurement
-
Content personalization
-
Marketing
-
Displaying targeted advertising
We use non-essential cookies that require consent under applicable law only after you have provided such consent.
You may refuse consent or subsequently modify your cookie preferences through the cookie settings available on our website.
The Czech Data Protection Authority states that consent to analytical or marketing cookies must be freely given, specific, and informed, and that users must be able to refuse or withdraw their consent easily.
VII. RECIPIENTS OF PERSONAL DATA
Where necessary, we may disclose personal data to the following categories of recipients:
-
Shopify, the platform through which we operate our online store
-
Payment service providers
-
Shipping carriers and logistics service providers
-
IT, hosting, and cloud service providers
-
Email and customer communication service providers
-
Analytics and marketing service providers
-
Accounting, tax, and legal advisers
-
Public authorities, where disclosure is required by law
We share personal data only to the extent necessary for the relevant purpose.
VIII. SHOPIFY
Our online store, www.vintagetherapy.cz, operates on the Shopify platform.
Shopify processes certain personal data of customers and website visitors in connection with the operation of our online store.
According to information provided by Shopify, personal data relating to customers in the European Economic Area is initially processed by Shopify International Limited in Ireland. Other companies within the Shopify group and its subcontractors may also be involved in processing.
In certain circumstances, Shopify may also process personal data for its own purposes in accordance with its applicable terms and privacy policies.
Further information about how Shopify processes personal data can be found in its current Consumer Privacy Policy.
Shopify Consumer Privacy Policy:
https://privacy.shopify.com/en
IX. INTERNATIONAL TRANSFERS OF PERSONAL DATA
Due to our use of Shopify and certain other technology services, personal data may, in some circumstances, be processed outside the European Economic Area.
Where personal data is transferred to a country that has not been recognized by the European Commission as providing an adequate level of data protection, such transfers must be based on an appropriate legal mechanism, such as Standard Contractual Clauses or another mechanism recognized by applicable law.
Shopify states that it uses safeguards for international transfers of personal data in accordance with applicable legal requirements.
X. RETENTION OF PERSONAL DATA
We retain personal data only for as long as necessary for the purposes for which it was collected or for the period required by applicable law.
Retention periods may vary depending on whether the personal data relates to:
-
Orders
-
Accounting or tax documents
-
Customer accounts
-
Product complaints or withdrawal from contracts
-
Legal claims or disputes
-
Marketing consent
Information required to comply with accounting, tax, or other legal obligations is retained for the periods specified by applicable law.
Personal data processed based on consent is retained until consent is withdrawn or until the relevant processing purpose no longer applies, as appropriate.
After the applicable retention period expires, personal data is deleted or anonymized unless further retention is necessary for another lawful reason.
XI. PERSONAL DATA SECURITY
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.
However, no method of electronic transmission or information storage can guarantee absolute security.
Access to personal data is restricted to individuals who require it to perform their employment or contractual duties.
XII. RIGHTS OF DATA SUBJECTS
Subject to the conditions established by the GDPR, you have the following rights in relation to your personal data:
-
Right of access – the right to obtain information about the personal data we process about you
-
Right to rectification – the right to have inaccurate or incomplete personal data corrected
-
Right to erasure – the right to request the deletion of your personal data
-
Right to restriction of processing – the right to request that the processing of your personal data be restricted
-
Right to data portability – the right to receive your personal data in a portable format, where applicable
-
Right to object – the right to object to processing based on legitimate interests
-
Right to withdraw consent – where processing is based on consent
-
Right to lodge a complaint – the right to file a complaint with a competent supervisory authority
These rights are not absolute, and their application may depend on the specific circumstances and the legal basis for processing.
Among other things, the GDPR grants data subjects the right to obtain information about the purposes of processing, the categories of personal data processed, and the recipients of such data.
You will not be disadvantaged for exercising your rights.
Where necessary to protect personal data, we may request reasonable verification of your identity before processing your request.
XIII. AUTOMATED DECISION-MAKING
The Controller does not carry out automated individual decision-making that produces legal effects concerning customers or similarly significantly affects them within the meaning of Article 22 of the GDPR.
Certain technologies used in our online store may automatically recommend products, analyze website traffic, or personalize advertising content.
Such functions do not, in themselves, constitute automated individual decision-making producing the legal effects described above.
XIV. CHILDREN'S PRIVACY
Our online store is not primarily intended for children who are not legally capable of independently entering into the relevant contract.
We do not knowingly collect personal data from children beyond circumstances permitted by applicable law.
If a parent or legal guardian believes that a child has provided us with personal data without appropriate authorization, they may contact us to request that the matter be addressed.
XV. THIRD-PARTY LINKS AND SERVICES
Our online store may contain links to or integrations with third-party services, including social media platforms.
If you leave our website through such a link, the processing of your personal data may be subject to the privacy policies of the relevant third-party provider.
We are not responsible for the processing of personal data by independent third parties.
XVI. COMPLAINTS TO A SUPERVISORY AUTHORITY
If you believe that your personal data is being processed in violation of applicable data protection laws, you may contact:
Czech Data Protection Authority (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27
170 00 Prague 7
Czech Republic
Your right to lodge a complaint with a supervisory authority does not prevent you from contacting us directly first.
XVII. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time, particularly in response to changes in applicable laws, our services, technologies, or personal data processing practices.
The current version will always be published on www.vintagetherapy.cz, together with the date of the latest update.
XVIII. CONTACT
If you have any questions regarding the processing of your personal data or wish to exercise any of your rights, please contact:
Vintage therapy s.r.o.
Rybná 716/24
Prague 1
Czech Republic
Company Registration Number (IČO): 19759142
Email: zakaznici@vintagetherapy.cz
For the purposes of applicable data protection laws, the controller of your personal data is Vintage therapy s.r.o.
