Data Protection Policy - GDPR

1. General Provisions

This Privacy Policy explains how personal data relating to customers and other individuals is processed in connection with the operation of the Knihyzpudy.cz online store.

1.1 Data Controller

The data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (hereinafter referred to as the “GDPR”), is:

Mgr. Jana Vejříková – Knihyzpudy.cz 
Company ID: 69959641
Registered Address: Obětí nacismu 1, 350 02 Cheb

Registered in the Czech Trade Licensing Register maintained by the Municipal Office of Cheb, under reference No. 0021/2011/CH, pursuant to Section 71(2) of the Czech Trade Licensing Act.

(hereinafter referred to as the “Controller”).

1.2 Contact details of the controller

Registered Address: Jana Vejříková – Knihyzpudy.cz, Obětí nacismu 1, 350 02 Cheb
Email: info@knihyzpudy.cz
Phone: (+420) 608 129 774

The Controller operates the Knihy z půdy online second-hand bookshop, available at https://www.knihyzpudy.cz/.

If you have any questions regarding the processing of personal data or wish to exercise your rights under applicable law, you can contact us using the contact details provided above.

1.3 Data Protection Officer

The Controller is not required to appoint a Data Protection Officer and has not appointed one.

2. What personal data we process

The Controller processes personal data provided by customers when using the online store, particularly when placing an order or communicating with the Controller.

2.1 Categories of personal data processed

In connection with an order, the Controller may process, in particular, the following personal data:

  • first and last name;

  • company or organisation name, where the customer makes a purchase on behalf of a business;

  • company identification number (IČO), VAT identification number (DIČ), where applicable, and other information necessary to issue accounting or tax documents, where relevant for the purpose concerned;

  • billing and delivery address;

  • email address;

  • telephone number;

  • information relating to the order, its processing and the goods purchased;

  • information relating to the selected delivery and payment methods;

  • information relating to complaints, withdrawal from a contract or the exercise of other customer rights;

  • any other information the customer provides in the course of communication with the Controller.

We obtain personal data primarily directly from customers when they place an order, register a customer account or communicate with us.

The scope of personal data processed may vary depending on the nature of the order, the selected delivery or payment method, and any additional services used.

2.2 Scope of personal data processing

The Controller processes only personal data that is relevant to the specific purpose of processing and does so in accordance with the principle of data minimisation.

3. Purposes and Legal Bases for Processing Personal Data

3.1 Order Processing and Contract Performance

Providing the personal data necessary to enter into and perform a contract is a prerequisite for processing an order. If a customer does not provide the information required to process an order, it may not be possible to accept the order, enter into a purchase contract or duly fulfil it.

Personal data is processed primarily for the purposes of receiving, processing and fulfilling orders, entering into and performing purchase contracts, delivering the goods ordered, arranging payment and communicating with the customer.

The legal basis for this processing is Article 6(1)(b) of the GDPR, namely processing that is necessary for the performance of a contract to which the customer is a party or in order to take steps at the customer's request prior to entering into a contract.

The customer's consent is not required for this processing.

3.2 Compliance with Legal Obligations

Personal data may also be processed for the purpose of complying with legal obligations to which the Controller is subject, particularly obligations arising under accounting and tax legislation and obligations relating to the recording of completed transactions.

The legal basis for this processing is compliance with the Controller's legal obligations.

3.3 Protection of Rights and the Controller's Legitimate Interests

Personal data may also be processed to the extent necessary to protect the Controller's rights and legitimate interests, particularly to demonstrate that a contract was entered into and performed, handle complaints and disputes, deal with contract withdrawals, establish or defend legal claims, and protect against potential misuse of the services.

The legal basis for this processing is the Controller's legitimate interest in protecting its rights and legal claims.

3.4 Communication with Customers

Customers' contact details may also be used for communications relating to their orders, such as order confirmations and updates on order status, payment, dispatch and delivery, as well as responses to customer requests.

3.5 Purchase Reviews

If the online store participates in the Verified by Customers (Ověřeno zákazníky) programme, customers may receive an email questionnaire after completing a purchase asking them to rate their shopping experience.

For this purpose, the customer's email address and information relating to the completed order, including details of the goods purchased, may be provided to Heureka Group a.s., the operator of the Verified by Customers service. Only the information necessary to create and send the questionnaire, collect feedback and evaluate it will be provided.

We process personal data for this purpose on the basis of our legitimate interest, namely assessing customer satisfaction with their purchases and improving our services.

Customers may opt out of receiving the questionnaire before submitting their order by selecting the relevant checkbox during checkout. If a customer does not opt out at that stage, they may still opt out of receiving further questionnaires at any time by using the link included in the questionnaire email.

4. Commercial Communications

If the Controller uses a customer's email address to send commercial communications about its own similar products or services, it does so in accordance with the applicable legislation, in particular Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services.

Customers may opt out of receiving further commercial communications at any time by following the instructions provided in the relevant communication.

The processing of contact details for direct marketing purposes is based on the Controller's legitimate interest under Article 6(1)(f) of the GDPR, provided that the legal requirements for sending such communications are met. Customers have the right to object at any time to the processing of their personal data for direct marketing purposes.

5. Disclosure of Personal Data to Other Parties

Personal data may be disclosed or transferred to other parties to the extent necessary for a specific processing purpose, particularly to process orders, deliver goods, process payments, operate the online store or comply with legal obligations.

5.1 Who May Receive Personal Data

In connection with the operation of the online store, personal data may be disclosed in particular to:

a) delivery service providers, depending on the shipping method selected. Only the information necessary to deliver the parcel is provided;

b) payment service providers, where the customer uses the relevant payment method;

c) the provider of web hosting and the online store's technical infrastructure, where personal data is processed or stored as part of the services provided;

d) other service providers, where applicable, who process personal data on behalf of the Controller under a contractual arrangement.

The Controller provides each recipient only with the data necessary for the specific processing purpose.

5.2 Processing by Other Parties and Transfers of Personal Data Abroad

Where another party processes personal data on behalf of the Controller as a processor, the Controller has entered into the relevant contractual arrangement with that processor in accordance with Article 28 of the GDPR, where such an arrangement is required under the GDPR.

In justified cases, personal data may be transferred to countries outside the European Economic Area where this is necessary to provide a specific service or for another legitimate processing purpose. Such transfers are carried out only in compliance with the requirements of the GDPR, in particular on the basis of an adequacy decision adopted by the European Commission or other safeguards provided for by law.

5.3 Current Data Processors

We currently work with the following companies:

  • Czech Post (Česká pošta), s. p., Politických vězňů 909/4, 225 99 Praha 1
  • Packeta (Zásilkovna) s. r. o., Českomoravská 2408/1a, 190 00 Praha 9, and its subcontractors (eg. Packeta Slovakia, s. r. o., Österreicher Post, DPD Austria, Packeta Poland sp. z o.o., Packeta eCommerce GmbH, InPost S.A., Poczta Polska, Hermes, and any other relevant parties) 
  • GoPay s. r. o., Planá 67, 370 01 Planá
  • Wedos Internet, a. s., Masarykova 1230, Hluboká nad Vltavou, 373 41
  • Heureka Group, a. s., Karolinská 706/3, 186 00 Praha 8 – Karlín

6. Retention Period for Personal Data

The Controller retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or for as long as its retention is required by law or necessary to protect the Controller's legitimate interests.

Data relating to orders may be retained for as long as necessary to process the order, handle claims relating to defective goods or other customer rights, protect the Controller's legal claims, and comply with obligations arising under accounting, tax and other applicable legislation.

Once the relevant retention period has expired, personal data is deleted, anonymised or otherwise securely disposed of, unless further retention is necessary on another legal basis.

The actual retention period may vary for different types of data depending on the purpose for which they are processed. Data contained in accounting records and other documents required by law is retained for the periods specified by the relevant legislation. Data necessary to protect legal claims may be retained for as long as necessary to pursue, resolve or defend those claims.

7. Data Subject Rights

Subject to the conditions laid down by applicable law, you have the following rights in relation to the processing of your personal data:

  • the right to request access to your personal data;

  • the right to request the rectification of inaccurate or incomplete data;

  • the right to request the erasure of your personal data where there is no legal basis for its continued processing;

  • the right to request restriction of processing;

  • the right to receive your personal data in a structured, commonly used format and to request its transfer, where the legal conditions are met;

  • the right to object to processing based on the Controller's legitimate interests.

These rights are not absolute and may be subject to the conditions and limitations set out in the GDPR or other applicable legislation. In particular, data cannot be erased where its continued retention is necessary for the Controller to comply with a legal obligation or to protect its legal claims.

Where a particular processing activity is based on consent, you also have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

You may exercise your rights using the contact details provided in this Privacy Policy.

8. Right to lodge a complaint

If a customer believes that the processing of their personal data has infringed the GDPR or other personal data protection legislation, they have the right to lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů).

Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27
170 00 Praha 7
Website: https://www.uoou.cz/

Customers may also contact the Controller directly with any request or question using the contact details provided in this Privacy Policy.

9. Security of Personal Data

The Controller has implemented appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, destruction or other unauthorised processing.

Access to personal data is limited to individuals who need it to fulfil their work-related or contractual duties, as well as service providers who process personal data under the relevant legal arrangements and only to the extent necessary to provide the service concerned.

When data is transmitted through the online store, we use appropriate technical measures to secure communications.

10. Automated Decision-Making and Profiling

In the ordinary operation of the online store, no automated individual decision-making or profiling takes place that produces legal effects concerning customers or similarly significantly affects them.

11. Cookies

The online store may use cookies and similar technologies that are necessary for its proper functioning, as well as other cookies depending on the settings of the services used on the website.

Information about the use of cookies and similar technologies is provided in a separate document, Cookies Policy.

12. Final Provisions

The Controller may update or amend this Privacy Policy, particularly if there are changes to the services or technologies used, applicable legislation or the way personal data is processed.

The current version of this Privacy Policy is always published on the Controller's website.

Effective date of the current version: 14 October 2026