GDPR

PRIVACY POLICY (GDPR)

1. IDENTITY AND CONTACT DETAILS OF THE CONTROLLER

1.1. The controller of your personal data is the company ARTURE Art & Nature s.r.o., with its registered office at U Pískovny 376, 344 01 Domažlice, Czech Republic, ID: 26366282, registered in the Commercial Register at the Regional Court in Plzeň, Section C, Insert 15616 (hereinafter referred to as the "Controller").

1.2. The contact details of the Controller are:

Delivery address: U Pískovny 376, 344 01 Domažlice, Czech Republic
E-mail address: eshop@a-n.cz
Phone: +420 379 794 621

1.3. The Controller has not appointed a data protection officer.

2. LEGAL BASIS FOR PROCESSING PERSONAL DATA

2.1. The legal basis for processing your personal data is:

Performance of a contract between you and the Controller or taking steps by the Controller prior to entering into such a contract within the meaning of Art. 6 (1) (b) GDPR.
Compliance with a legal obligation to which the Controller is subject (in particular accounting and tax obligations) within the meaning of Art. 6 (1) (c) GDPR.
Legitimate interest of the Controller for the purposes of direct marketing (especially for sending commercial messages and newsletters) within the meaning of Art. 6 (1) (f) GDPR.

3. PURPOSE OF PROCESSING PERSONAL DATA

3.1. The purpose of processing your personal data is:

Execution of your order and exercise of rights and obligations arising from the contractual relationship between you and the Controller (including logistics and potential claims).
Customer account management (if you choose to register).
Sending commercial messages and performing other marketing activities (only if permitted by legitimate interest or explicit consent).

4. DATA RETENTION PERIOD

4.1. Your personal data will be processed:

For the period necessary to exercise the rights and obligations arising from the contractual relationship and to assert claims under these relationships (for a period of 10 years from the termination of the contract due to tax and accounting regulations).
For a period until consent to the processing of personal data for marketing purposes is withdrawn, but no longer than 5 years, if the personal data is processed based on consent.

5. RECIPIENTS OF PERSONAL DATA (PROCESSORS)

5.1. The recipients of your personal data are persons/companies:

Involved in the delivery of goods and execution of payments based on the contract (courier services like GLS, freight forwarders, payment gateway ComGate).
Providing e-shop operation services (BSSHOP platform) and other technical services related to the operation of the e-shop.
Providing accounting and legal services.
Providing marketing services (e.g., Google Analytics, Meta).

5.2. The Controller does not intend to transfer personal data to a third country (to a country outside the EU) or to an international organization, except for the use of standard analytical and marketing tools (Google, Meta).

6. YOUR RIGHTS

6.1. Under the conditions set out in the GDPR, you have:

The right of access to your personal data.
The right to rectification or erasure of personal data.
The right to restriction of processing.
The right to object to the processing of your personal data.
The right to data portability.
The right to withdraw consent to processing in writing or by e-mail to the Controller's address.

6.2. You also have the right to lodge a complaint with the Office for Personal Data Protection (www.uoou.cz) if you believe that your right to personal data protection has been violated.

7. DATA SECURITY

7.1. The Controller declares that it has taken all appropriate technical and organizational measures to secure personal data. 7.2. The Controller has taken technical measures to secure data storage and storage of personal data in paper form (encryption, passwords, physical security).

8. FINAL PROVISIONS

8.1. By submitting an order from the online order form, you confirm that you are familiar with the privacy policy and that you accept it in its entirety. 8.2. The Controller is entitled to change these terms. The new version of the privacy policy will be published on the Controller's website.

Effective date: March 31, 2026