Privacy Policy

1. Data controller

The controller is the Seller identified in our Terms & Conditions: a private individual based in the Czech Republic. Contact: popstrap.sale@gmail.com.

2. What we collect

• Order data: name, email, shipping address, phone (optional), items ordered, order amount.
• Payment confirmation: Stripe payment ID and status. We do not see or store your card number, CVC or expiry — those are handled by Stripe.
• Communication: emails you send us regarding your order.

3. Why and on what legal basis

• Performance of the contract (Art. 6(1)(b) GDPR): to process and ship your order, handle returns and complaints.
• Legal obligation (Art. 6(1)(c) GDPR): to keep accounting records and tax documentation as required by Czech law.
• Legitimate interest (Art. 6(1)(f) GDPR): to prevent fraud and maintain the security of the site.

4. Recipients & processors

We share your data only with the following categories of recipients, all bound by appropriate agreements:

• Stripe Payments Europe, Ltd. — payment processing.
• Hosting & email provider — to operate the website and send transactional emails.
• Shipping carrier — to deliver your order (name and address only).

We do not sell, rent or share your data for marketing.

5. International transfers

Stripe and our hosting provider may process data outside the EEA. Such transfers are protected by Standard Contractual Clauses approved by the European Commission.

6. Retention

• Order records: 5 years (income tax) / 10 years (accounting) as required by Czech law.
• Email correspondence: up to 3 years after the last contact.
• Stripe payment records: per Stripe's own retention policy.

7. Your rights

Under GDPR you have the right to: access your data, rectify inaccurate data, erase data ("right to be forgotten" — subject to our legal retention obligations), restrict processing, data portability, and object to processing. To exercise any right, write to popstrap.sale@gmail.com. You also have the right to lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů).

8. Cookies

This site uses only strictly necessary cookies required for the cart and checkout to function. We do not use analytics, advertising or tracking cookies, so no consent banner is required under § 89 of Czech Act No. 127/2005 Sb.