This Policy describes how Daniela Křivanová, ID No.: 73407925, registered office Svahová 1015/16, 360 01 Karlovy Vary (hereinafter “we” or the “Controller”), processes personal data in connection with the online store www.leaudespa.com in accordance with Regulation (EU) 2016/679 (GDPR) and Czech law.

1. Controller and contacts

Controller: Daniela Křivanová, ID No.: 73407925
Registered office: Svahová 1015/16, 360 01 Karlovy Vary
E-mail: [email protected]
Phone: +420 608 914 814
Data Protection Officer (DPO): not appointed.

2. Categories of data, purposes, legal bases, and retention periods

• Orders and contract performance
  • Data: first name, last name, billing/shipping address, e-mail, phone, cart contents, purchase history, payment details (via payment gateway), IP address.
  • Purpose: receipt and processing of orders, delivery, invoicing, claims handling.
  • Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations in accounting and tax (Art. 6(1)(c) GDPR).
  • Retention: documents and transaction data for 10 years after the end of the accounting period; inactive user accounts up to 24 months.
• Customer support
  • Data: name, e-mail, phone, contents of communication.
  • Purpose: handling enquiries and requests.
  • Legal basis: performance of a contract or legitimate interest in providing support (Art. 6(1)(f) GDPR).
  • Retention: for the necessary period, typically up to 24 months from last contact.
• Product reviews
  • Data: display name, IP address (stored internally in WordPress), review content.
  • Purpose: publishing reviews.
  • Legal basis: consent granted by submitting a review (Art. 6(1)(a) GDPR).
  • Retention: until consent is withdrawn or a deletion request is made, or for as long as the review remains relevant.
• Analytics and traffic measurement
  • Data: identifiers of cookies and similar technologies, IP address, device and browser information, traffic events (GA4).
  • Purpose: measuring website use and improving services.
  • Legal basis: consent to analytics cookies (Art. 6(1)(a) GDPR). Without consent, analytics tools are not run.
  • Retention: according to tool settings, up to 14 months for GA4.
• Marketing and personalization
  • Data: cookie identifiers (e.g., _gcl_*, _fbp), information about interactions with the website and ads, purchase history for segmentation.
  • Purpose: conversion measurement, remarketing, audience building, offer personalization.
  • Legal basis: consent to marketing cookies (Art. 6(1)(a) GDPR). You may withdraw consent at any time.
  • Retention: per cookie lifetimes and partner rules, typically 3–13 months.

3. Services used and recipients of personal data

We share personal data only with necessary partners under data processing agreements:

• Payment services: Stripe Payments Europe, Ltd. and Stripe, Inc. (USA), including the domains stripe.com and m.stripe.com; Google Pay (Google Ireland Limited / Google LLC).
• Shipping: DPD, Czech Post, DHL, FedEx – delivery data.
• IT and hosting: Blueboard.cz (hosting), WordPress/WooCommerce.
• Maps: Google Maps API (Google Ireland Limited / Google LLC).
• Bot protection: hCaptcha (Intuition Machines, Inc.).
• Measurement and marketing:
  • Google Tag Manager – tag management; typically does not store cookies itself, deploys other scripts.
  • Google Analytics 4 – web analytics (only with your consent).
  • Google Ads – conversion measurement and remarketing (only with consent).
  • Meta Pixel (Facebook/Instagram) – measurement and remarketing (only with consent). The “Facebook for WooCommerce” integration syncs the product catalog to Meta Commerce Manager.
• Accounting services: external accountant – order and payment data.

4. Transfers to third countries

For some partners, data may be transferred to the USA (Google, Meta, Stripe, hCaptcha). Transfers take place on the basis of Standard Contractual Clauses (SCC) and partners’ supplementary measures. A lower level of protection in the destination country cannot be entirely ruled out.

5. Cookies and similar technologies

Details on cookies, their purposes, and lifetimes are set out in our Cookie Policy. Non-essential (analytics and marketing) cookies are set only after consent.

6. Your rights

• right of access, rectification, erasure, restriction of processing, objection, and data portability;
• right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal;
• right to lodge a complaint with the Office for Personal Data Protection (ÚOOÚ) (www.uoou.cz).

7. Exercising your rights

Write to [email protected] or call +420 608 914 814. Requests are handled without undue delay, no later than 1 month.

8. Security

• HTTPS/SSL, firewall, limited access, regular backups.
• Security measures of providers (Stripe, Google, Meta, hCaptcha).

9. Automated decision-making

We carry out basic profiling for marketing after consent. We do not perform automated decision-making producing legal effects.