Privacy Policy (GDPR)

Data protection and privacy policy in accordance with Regulation (EU) 2016/679 (GDPR) • Effective from 22 March 2026

1. Data Controller

The Controller has not appointed a Data Protection Officer (DPO), as it does not fall within the categories of entities for which the appointment of a DPO is mandatory under Article 37 of the GDPR. For all matters relating to personal data protection, please contact us at info@painto.cz.

2. Scope of Processed Data

In connection with the operation of the PAINTO.cz e-shop, we process the following personal data:

2.1 Identification Data

• First and last name
• Company name (for business customers)
• Company ID and VAT ID (for business customers)

2.2 Contact Data

• Email address
• Phone number
• Billing address
• Delivery address (if different from billing address)

2.3 Order Data

• Order history (contents, date, price, status)
• Payment data (payment method, payment status — not payment card details)

2.4 Technical Data

• IP address
• Browser type and operating system
• Date and time of access
• Cookies and session identifiers

3. Purpose of Processing

We process personal data exclusively for the following purposes:

1. Performance of a contract — processing orders, delivering goods, communicating about order status, handling complaints and returns
2. Compliance with legal obligations — accounting, issuing tax documents, archiving as required by law
3. Legitimate interest of the Controller — fraud prevention, dispute resolution, service improvement, direct marketing of own products to existing customers
4. Consent of the data subject — sending commercial communications and marketing offers (only with consent), analytical cookies

4. Legal Basis for Processing

We process personal data based on Article 6(1) of the GDPR:

5. Data Retention Period

After the retention period expires, data is securely deleted or anonymised.

6. Recipients of Personal Data

Your personal data may be shared with the following categories of recipients (processors):

• Delivery services — DPD, PPL, Zasilkovna (name, address, phone, email for delivery purposes)
• Hosting provider — cesky-hosting.cz (technical operation of the website and databases)
• Accountant and tax advisor — processing accounting documents as required by law
• Payment gateway — in the future, for processing online payments (card details are processed exclusively by the payment gateway provider; the Controller has no access to them)

7. Cookies

7.1 What Are Cookies

Cookies are small text files stored in your browser when you visit a website. They serve to ensure proper website functionality and to improve the user experience.

7.2 Types of Cookies We Use

• Technical (essential) cookies
  Ensure basic e-shop functions — login, shopping cart, session. The website cannot function properly without them. They do not require consent.
  • PHPSESSID — session identifier, valid until the browser is closed
  • painto_consent — stores your cookie preference, validity: 1 year
• Analytical cookies
  Help us understand how visitors use the website. They are activated only with your consent. Maximum validity: 13 months.
  • _ga, _ga_* — Google Analytics 4 (Google Ireland Ltd.) — anonymised traffic measurement
• Functional cookies
  If you visit our website via a link in an e-mail we sent you (e.g. with a wholesale offer), we store the identifier of that offer so we can provide you with the promised conditions (e.g. a wholesale discount upon registration).
  • painto_ref — e-mail offer identifier, validity: 30 days

7.3 Managing Cookies

You can change your cookie settings at any time in your browser settings. However, blocking technical cookies may limit the functionality of the e-shop. You can reset your choice in our cookie bar at any time by deleting the painto_consent cookie in your browser — the bar will appear again on your next visit.

8. Your Rights

As a data subject, you have the following rights under the GDPR:

1. Right of access (Article 15 GDPR)
   You have the right to obtain confirmation as to whether we process your personal data, and if so, to access that data and information about the processing.
2. Right to rectification (Article 16 GDPR)
   You have the right to request correction of inaccurate personal data or completion of incomplete data.
3. Right to erasure (Article 17 GDPR)
   You have the right to request erasure of your personal data if the purpose of processing no longer applies, you have withdrawn your consent, or the data is no longer needed. This right cannot be exercised if processing is necessary for compliance with a legal obligation (e.g. invoice archiving).
4. Right to restriction of processing (Article 18 GDPR)
   You have the right to request restriction of processing, for example if you contest the accuracy of the data or object to the processing.
5. Right to data portability (Article 20 GDPR)
   You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.
6. Right to object (Article 21 GDPR)
   You have the right to object at any time to processing based on legitimate interest, including direct marketing.
7. Right to withdraw consent (Article 7(3) GDPR)
   If processing is based on consent, you have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
8. Right to lodge a complaint
   You have the right to lodge a complaint with a supervisory authority — see section 9.

9. Supervisory Authority

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the relevant supervisory authority.

10. Data Security

We have implemented appropriate technical and organisational measures to protect your personal data:

• Encryption in transit — all communication with the website takes place via the encrypted HTTPS protocol (SSL/TLS certificate)
• Password hashing — user account passwords are stored exclusively in hashed form (bcrypt), not in readable form
• Restricted access — only authorised persons who are bound by confidentiality obligations have access to personal data
• Server security — hosting provides regular backups, firewall and monitoring
• Updates — we regularly update software and fix security vulnerabilities

11. Final Provisions

This Privacy Policy is valid and effective from 22 March 2026.

The Controller reserves the right to update this policy. The current version will always be available on this page. Registered users will be informed of material changes by email.

This policy was last updated on 22 March 2026.