Privacy notice
Effective from 16 October 2026. This notice explains how we process personal data when you visit karel-novotny.cz, shop, use a customer account or subscribe to news. It provides information about processing; it is not consent that you must give to make a purchase.
1. Controller and contact details
The controller is Karel Novotný, a sole trader, business identification number 75568900, VAT identification number CZ8412034246, with registered office at Šidleny 617, 696 05 Milotice, Czech Republic. For privacy matters, contact info@karel-novotny.cz, call +420 773 684 685 or write to that postal address.
2. Data we collect
We primarily process your name, delivery and billing addresses, country, email, telephone number, any business details, order contents, notes and related correspondence. Order data also includes prices, delivery and payment methods and status. Information entered directly into a payment gateway is processed by its provider under its own terms.
For customer accounts, we process registration and login information and data needed to maintain the account. When you contact us, we process what you provide. Newsletter data mainly comprises your email and consent or withdrawal records. Website use may generate technical records, including IP addresses, request times, browser information and cookies.
We usually obtain data from you; payment and delivery confirmations also come from the relevant providers. If you specify another recipient, supply only the details needed for delivery and give that person this notice.
3. Purposes and legal bases
- Orders, delivery, payments and purchase correspondence: processing is necessary for steps before entering into a contract and its performance under Article 6(1)(b) GDPR. Consent is not required.
- Invoicing and statutory duties: processing required by tax, accounting and other legislation relies on Article 6(1)(c) GDPR.
- Customer accounts and requests: data needed to provide a requested service is processed for contract performance; general enquiries are also handled under our legitimate interest in appropriate communication.
- Legal claims and security: necessary records for disputes, claims and website protection are processed under our legitimate interests pursuant to Article 6(1)(f) GDPR, taking your rights into account.
- Optional newsletters, analytics and marketing: the relevant processing relies on consent under Article 6(1)(a) GDPR, as explained below.
We need mandatory checkout information to fulfil your order; without it, ordering or delivery may be impossible. Business details are needed when purchasing for a business. Newsletter subscription and consent to analytics or marketing cookies are optional and do not affect your ability to purchase.
4. Newsletters and marketing messages
Subscription is voluntary, through a separate subscription form or an express choice where offered. Ordering or creating an account does not constitute subscription consent. SmartEmailing handles newsletter distribution. Withdraw consent through the unsubscribe link in a message or by emailing the controller. Withdrawal does not affect the lawfulness of earlier processing.
After unsubscribing, your contact must not be used for further marketing emails. We may retain a necessary suppression record to respect your choice. Essential order correspondence is unaffected.
5. Recipients
Data is disclosed where necessary to fulfilment and customer support personnel, couriers, payment providers and banks, accountants, and hosting, email and website support providers. Services used include Comgate for payments, Fakturoid and iDoklad (Seyfor, a. s.) for invoicing, Balíkobot for shipment processing and SmartEmailing for newsletters. Each provider receives only data needed for its service.
Processors must be subject to appropriate contractual arrangements. Some recipients, particularly payment providers, banks and couriers, may also act as independent controllers for their own statutory purposes. Information may be disclosed to public authorities where required by law. Further information is available from Comgate, Fakturoid, iDoklad and SmartEmailing.
6. Cookies, embedded services and international providers
Essential cookies and similar storage support sessions, carts, login, security and remembering your choices. Consent is not required for those essential purposes. Analytics and marketing tools, particularly Google Analytics 4, Meta Pixel and Barion Pixel, may activate only after appropriate consent. They may process identifiers and visit information or create advertising audiences. Reject or change your choice in the website's cookie settings.
Displaying an embedded Google map connects to Google, which may receive your IP address and technical information. Loading photographs, video or other files from external content delivery networks provides their operators with data needed for transmission. These technical transfers should be distinguished from optional advertising tracking.
Global services may involve processing outside the European Economic Area. Transfers are permitted only under Chapter V GDPR, for example through an applicable adequacy decision or standard contractual clauses with any necessary supplementary measures. Ask the controller for information on specific recipients and safeguards, or a copy of those safeguards.
7. Retention
Data needed for a contract is retained during performance. Necessary legal claims records are generally retained for another three years after performance, or for ongoing disputes and related statutory periods. VAT documents are retained for ten years from the end of the tax period in which the transaction occurred. Other mandatory records follow the relevant statutory periods.
Accounts are maintained until cancellation; inactive accounts must be reviewed proportionately. Newsletter contact data is processed until consent is withdrawn. Necessary consent and withdrawal evidence may remain for the period needed to demonstrate lawfulness and handle claims. Technical records and cookies should remain only as long as their purposes require. Data must then be deleted or anonymised unless another legal basis justifies retention.
8. Your rights
Subject to GDPR conditions, you have rights of access, rectification, erasure and restriction. Portability applies to data you provide that is processed automatically on the basis of consent or a contract. You may object to legitimate interest processing, and to direct marketing at any time. You may withdraw consent at any time. Erasure does not override statutory record retention or necessary protection of legal claims.
Send requests to the controller's contact details. We may reasonably verify your identity. We normally respond within one month and must explain any lawful extension. You may complain to the Czech Office for Personal Data Protection or the competent supervisory authority in your country of habitual residence or work.
The shop does not use solely automated decisions about customers with legal or similarly significant effects, or automatically personalise prices for individuals. This does not exclude the optional analytics and marketing described above. We will update this notice when processing changes.