Privacy and cookies

Who processes your data

The controller of your personal data is David Johanes, Company ID (IČO) 64099431, with registered address at Polská 528/43, 779 00 Olomouc ("we").

Contact for personal data matters: johanes-sklo@seznam.cz, phone +420777284739. We have not appointed a data protection officer, because the law does not require us to.

What data, why and on what legal basis

Handling the order, delivery, payment, communication about the order – Data: name, email, phone, billing and delivery address, pickup point, order contents, note, payment status; Legal basis: performance of a contract – Art. 6(1)(b) GDPR; How long: while the order is being handled, then for the periods stated below for accounting and claims
Issuing invoices and keeping accounts – Data: invoice details, payments, refunds; Legal basis: legal obligation – Art. 6(1)(c) GDPR; How long: 10 years from the end of the year in which the invoice was issued
Withdrawal from the contract and defect claims – Data: order details, contents of the notice, photographs, account number for the refund; Legal basis: performance of a contract and legal obligation – Art. 6(1)(b) and (c) GDPR; How long: 3 years from the withdrawal or defect claim being settled
Customer account (if created) – Data: email, login details (the password only in irreversibly encrypted form), order history; Legal basis: performance of the contract for keeping the account – Art. 6(1)(b) GDPR; How long: until the account is closed; orders then only for the periods in the rows above
Replying to a question from the contact form or by email – Data: name, email, text of the message; Legal basis: legitimate interest in replying to the question – Art. 6(1)(f) GDPR; for a question about a purchase also (b); How long: 1 year from the question being dealt with
Security of the shop, protection against misuse of forms and logins – Data: IP address, browser identification, time of the request; Legal basis: legitimate interest in security – Art. 6(1)(f) GDPR; How long: at most 1 year; when a specific security incident is being investigated, until it is closed
Establishing and defending legal claims – Data: data from the order and communication; Legal basis: legitimate interest – Art. 6(1)(f) GDPR; How long: for the limitation period, usually 3 years

The data needed for an order is a requirement for concluding the contract – without it we cannot accept the order. The phone number is optional, but the carrier needs it for delivery to an address.

Automatic emails about orders are sent through a sending queue. Emails with login links and links to an order are deleted after they leave the queue. We keep a record of other sent emails (to whom, when and with what content they were sent) for 12 months after sending, so that we can prove that an email was sent; after that we delete it.

We do not send commercial communications or a newsletter, and we do not make automated decisions about you or profile you.

Who we share data with

We share data only with those who need it to handle the order or to run the shop:

Carrier – Zásilkovna s.r.o. (Packeta), and for delivery to an address the carrier we choose for the parcel (e.g. Česká pošta, PPL): name, phone, email, delivery address or pickup point, and for cash on delivery the amount.
Hosting and database – Roští.cz, s.r.o., Company ID 04173571, Veverkova 1343/1, 500 02 Hradec Králové; servers in the Czech Republic. The processing is governed by a data processing agreement that forms part of Rosti's terms and conditions.
Sending emails – Roští.cz, s.r.o. (a mailbox on the shop's domain).
Backups – we store encrypted backups of the database and invoices with Google (Google Drive). The backups are encrypted before they are sent, and Google cannot read their contents.
Bank – MONETA Money Bank, a.s., for payment by transfer and for refunds.
Public authorities – only where the law requires it.

The pickup point selection at checkout opens directly from the Zásilkovna website (widget.packeta.com). This service may process technical data about your browser during the selection under its own policy. Zásilkovna itself shows its cookie consent bar in this window and decides on any analytics cookies; our shop has no access to them. You can find Zásilkovna's policy directly in the point selection window.

We do not transfer data outside the European Union / European Economic Area.

Cookies

We use only cookies that are necessary for the shop to work. By law we do not need your consent to store them, and therefore we do not show a consent bar. We do not use analytics, advertising or other tracking cookies.

skloshop_cart – What it is for: remembers the contents of the cart; Lifetime: 30 days
__Host-skloshop_customer_session – What it is for: signing in to the customer account; Lifetime: at most 90 days (signed out after 30 days of inactivity)
__Host-skloshop_guest_order – What it is for: showing an order without an account after opening a link from an email; Lifetime: at most 30 minutes from requesting the link
__Host-skloshop_admin_session – What it is for: signing in for the shop's administrators (does not concern customers); Lifetime: 12 hours
preferred_locale – What it is for: remembers the chosen language of the website (Czech / English); Lifetime: 1 year

You can delete or block cookies in your browser at any time. Without them, however, the cart and signing in will not work.

Your rights

You have the right:

of access to your personal data (Art. 15 GDPR),
to rectification of inaccurate data (Art. 16),
to erasure, if we no longer need the data or may not process it (Art. 17),
to restriction of processing (Art. 18),
to portability of data that we process on the basis of a contract (Art. 20),
to object to processing based on legitimate interest (Art. 21).

Just write to johanes-sklo@seznam.cz. We reply without undue delay and no later than within one month (Art. 12(3) GDPR). Data that we must keep by law (for example invoices) cannot be deleted until the statutory period has expired.

If you believe that we process data unlawfully, you can lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), www.uoou.gov.cz (Art. 77 GDPR).

This information is valid from 13th October 2026.