This Privacy Policy describes how L'EAU DE SPA s.r.o., ID No.: 24501786, with its registered office at Chebská 355/49, 360 06 Karlovy Vary, Czech Republic (hereinafter referred to as "we" or the "Controller"), processes personal data in connection with the online store www.leaudespa.com in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Czech legal regulations.

1. Controller and Contacts

Controller: L'EAU DE SPA s.r.o., ID No.: 24501786
Registered Office: Chebská 355/49, 360 06 Karlovy Vary, Czech Republic
Commercial Register: Registered at the Regional Court in Plzeň, Section C, Insert 48074
E-mail: [email protected]
Phone: +420 608 914 814
Data Protection Officer (DPO): Not appointed.

2. Data Categories, Purposes, Legal Bases, and Retention Periods

• Orders and Performance of a Contract
  • Data: first name, last name, billing/shipping address, e-mail, phone number, cart contents, purchase history, payment data (via the Stripe payment gateway), IP address.
  • Purpose: receiving and processing orders, delivery, invoicing, claims handling.
  • Legal Basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations regarding accounting and taxation.
  • Retention Period: transaction documents and data are kept for 10 years in accordance with tax regulations.
• Customer Support and Regional Settings
  • Data: name, e-mail, communication content, choice of regional website version (cookie lds_store_choice).
  • Purpose: handling inquiries and requests, ensuring the correct display of the e-shop according to your preference.
  • Legal Basis: legitimate interest in providing support and ensuring proper website functionality (Art. 6(1)(f) GDPR).
  • Retention Period: typically up to 24 months from the last contact; 12 months for regional choice.
• Statistics, Measurement, and Behavior Analysis
  • Data: cookie identifiers, IP address, device information, interactions with the website (heatmaps, session recordings via Microsoft Clarity).
  • Purpose: measuring traffic and improving user experience (UX).
  • Legal Basis: consent to analytical cookies (Art. 6(1)(a) GDPR).
  • Retention Period: according to tool settings (GA4, Clarity), up to a maximum of 14 months.
• Marketing and Personalization
  • Data: cookies (Google Ads, Meta Pixel), interaction history.
  • Purpose: remarketing and personalization of advertisements.
  • Legal Basis: consent (Art. 6(1)(a) GDPR).

3. Service Providers and Recipients of Personal Data

We use the services of verified partners based on data processing agreements:

• Payment Gateway: Stripe Payments Europe, Ltd.
• Shipping: DPD, Czech Post, DHL, FedEx, Messenger, Packeta/Zásilkovna – delivery data.
• IT and Hosting: Blueboard.cz, WordPress/WooCommerce.
• Analytics and Marketing:
  • Google Ireland Limited (GA4, Google Ads, GTM).
  • Microsoft Corporation (Microsoft Clarity – behavior analysis).
  • Meta Platforms Ireland Ltd. (Meta Pixel).
• Website Protection: hCaptcha (Intuition Machines, Inc.).

4. Transfers to Third Countries

Transfers of data to the USA may occur with partners such as Google, Meta, Microsoft, or Stripe. Transfers are carried out in compliance with GDPR based on the EU-U.S. Data Privacy Framework adequacy decision and Standard Contractual Clauses (SCC).

5. Cookies

Details can be found in our Cookie Policy. Analytical and marketing cookies are only activated with your consent.

6. Your Rights

You have the right to access your data, rectification, erasure, restriction of processing, objection to processing, and data portability. You have the right to withdraw your consent at any time and the right to lodge a complaint with the Office for Personal Data Protection (www.uoou.cz).

7. Exercise of Rights

Please send your requests to [email protected]. We process requests within 30 days.

8. Security

We use HTTPS encryption, firewalls, and regular system updates to ensure the maximum security of your data.

Last updated: May 7, 2026