Privacy policy

Last updated: 10 November 2026. Effective from 10 November 2026.

1. Who processes your data

The controller of your personal data is:

Mgr.art. Hana Beskyd Polívková, Company ID (IČO) 01934228, Na Pískách 579, 254 01 Jílové u Prahy, Czech Republic
e-mail: hanapolivkovaeshop@gmail.com, phone: +420 777 349 436

If you have any question about data protection, write to this e-mail address.

2. What data, why and for how long

Purpose	Data	Legal basis	Retention
Processing and delivering the order	name, address, e-mail, phone, order contents	performance of contract (Art. 6(1)(b) GDPR)	for the duration of the contract
Payment	payment details. The full card number is processed by the payment provider, I do not see it	performance of contract	at the provider according to its rules, with me only the payment confirmation
Accounting and taxes	invoices, documents	legal obligation (Art. 6(1)(c))	for the period required by law, 10 years for tax documents
Withdrawals and complaints	order details, communication, photos of the defect	performance of contract, legal obligation, legitimate interest in defending claims	3 years from settlement
Customer account	name, e-mail, address, order history, login details	performance of contract	until the account is closed. Closing the account does not mean deleting documents I must or need to keep to meet legal obligations or protect legal claims
Communication with you (e-mail, phone)	message content, contact details	legitimate interest in replying, or performance of contract	3 years
Custom jewellery	brief, sizes, photos, engraving	performance of contract	for the duration of the contract and then as for complaints
Measuring traffic and behaviour on the website (Google Analytics, Contentsquare)	cookies, online identifiers, IP address, behaviour on the website	your consent	see chapter 7
Advertising and ad measurement (Meta)	cookies, identifiers, website events (product view, cart, purchase)	your consent	see chapter 8
Enhanced Shopify services (Shopify Network Intelligence)	visit and purchase data, online identifiers, device data	your consent for optional processing	see chapter 5
Website security and fraud prevention	IP address, device data	legitimate interest (Art. 6(1)(f))	according to the provider's rules (Shopify)

The legal basis "consent" means that in countries where the law requires consent, I do not process this data until you allow it in the cookie banner (see chapter 9). You can withdraw your consent at any time; withdrawal does not affect processing before it.

Providing the data needed for an order is a condition for concluding the contract. Without it, the contract cannot be concluded. You provide other data voluntarily.

No decisions about you are made solely by automated means and I do not use your data for profiling with legal effects.

3. Who I share data with

Processors and recipients I use to run the e-shop:

• Shopify (Shopify International Limited, Ireland, and affiliated companies): e-shop platform, checkout, customer accounts, order management, content translation, e-mail notifications, cookie banner with a record of your choice, and enhanced services Shopify Network Intelligence (see chapter 5).
• Payment providers: Shopify Payments (including cards, Shop Pay, Apple Pay and Google Pay) and PayPal (see chapter 6).
• Česká pošta, s.p. (Czech Post): delivery of parcels (name, address, phone).
• Meta Platforms Ireland Limited: ad measurement for Facebook and Instagram, only with consent where consent is required (see chapter 8).
• Google (Google Ireland Limited and affiliated companies): the shop's mailbox, Google Analytics, Search Console and measurement within Google Merchant Center. Measurement takes place only with consent where consent is required.
• Contentsquare (formerly Hotjar): analysis of interactions with the website, only with consent where consent is required (see chapter 7).
• External accountant and tax advisor who processes my accounts and tax documents (invoices contain name and address).
• Public authorities, where required by law.

I do not sell data.

4. Transfers outside the EU and EEA

Some recipients (Shopify, Meta, Google and others) may transfer or process data outside the EU and EEA, in particular in the USA and Canada. This is done on the basis of a European Commission adequacy decision (including the EU-U.S. Data Privacy Framework) or standard contractual clauses.

5. Shopify and Shopify Network Intelligence

I run the e-shop on the Shopify platform. Shopify International Limited, Ireland, and its service providers mainly provide the operation of the shop, checkout, customer accounts, order management and related technical services. When processing data for these purposes on my instructions, Shopify acts as a processor.

I also use Shopify Network Intelligence. Through this feature, Shopify combines data from visits and purchases in my shop with data from your interactions with other shops using Shopify and with Shopify services. The purpose is to provide and improve enhanced services, personalisation, marketing insights and ad targeting. Depending on the purpose, this mainly includes contact and order data, online identifiers, and data about your device, viewed products, use of the shop and privacy choices.

When providing these enhanced services, Shopify also acts as a controller of personal data. Processing data across shops does not mean that other merchants get access to my customer database.

For optional tracking, analytics, personalisation and ad targeting, I rely on consent under Art. 6(1)(a) GDPR (in countries where consent is required, see chapter 9). Necessary processing for the order and account is based on performance of contract, legal obligations on Art. 6(1)(c) GDPR, and necessary security and fraud prevention on legitimate interest under Art. 6(1)(f) GDPR. These other legal bases do not replace consent to optional tracking or advertising.

Shopify's own processing, its legal bases and retention rules are described in Shopify's privacy policy. Retention depends mainly on the duration of the relationship and use of the services, legal obligations and the need to protect legal claims. You can exercise your rights towards Shopify, including withdrawing consent and objecting to the relevant processing, also through the Shopify privacy portal.

This shop's data storage location in Shopify is set to the European Union. This does not exclude further processing by Shopify and its providers in other countries. Such transfers are subject to the rules and safeguards described in chapter 4.

6. Payment services

For payments I use Shopify Payments, including the supported cards Visa, Mastercard, American Express, Maestro and UnionPay and express payments Shop Pay, Apple Pay and Google Pay. Separately, I also use PayPal Express Checkout.

Shopify Payments is provided by Shopify International Limited together with the relevant payment partners. PayPal is provided to customers in the EU by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Depending on the method chosen, banks, card companies and wallet providers are also involved.

Data necessary to process the payment is shared, in particular identification and contact details, amount, currency and order and transaction details. I do not have access to the full card number. My legal basis is performance of contract under Art. 6(1)(b) GDPR and, for accounting and tax documents, compliance with legal obligations under point (c).

Payment providers act as independent controllers when fulfilling their own legal obligations, securing payments and preventing fraud. For activities carried out solely on my instructions, they may act as processors. Their role depends on the specific service and purpose of processing. Details are provided by Shopify and its payment partners and PayPal.

7. Analytics, Contentsquare and data retention

I use Google Analytics 4 with your consent to evaluate traffic and use of the e-shop.

I use Contentsquare, which includes the tools formerly provided under the Hotjar brand, with your consent to analyse interactions with the website, for example clicks, scrolling and the course of a visit. The recipient of the data is the provider of the Contentsquare analytics service and its contracted technical service providers. When carrying out analysis for my shop on my instructions, the provider acts as a processor. Any processing by the provider on its own account, in particular for service development and benchmarking, is described in its data processing policy. A session recording captures interactions with the website, not the screen of the whole device.

Tool and data	Legal basis	Retention
Google Analytics 4, user data	Consent under Art. 6(1)(a) GDPR	Set to 14 months. With each new recorded activity, the user identifier period is renewed for another 14 months, so total retention may exceed 14 months from first collection.
Google Analytics 4, event data	Consent under Art. 6(1)(a) GDPR	Other events 2 months. For key events, according to Google's rules, the user data retention setting applies, i.e. 14 months.
Contentsquare, session recordings	Consent under Art. 6(1)(a) GDPR	According to the provider's standard rules, 1 month.
Contentsquare, other personal analytics data, including heatmap data	Consent under Art. 6(1)(a) GDPR	According to the provider's standard rules, no longer than 13 months from collection, earlier upon deletion or irreversible anonymisation.

Deletion in Google Analytics takes place in the provider's monthly cycle. These retention settings do not limit standard aggregated reports. Cookie lifetime is assessed separately.

8. Meta and ad measurement

With your consent to marketing (where consent is required, see chapter 9), I use Meta tools to measure ad effectiveness, attribute visits and purchases to ad campaigns and target ads. The recipient is mainly Meta Platforms Ireland Limited.

Online identifiers, device data and website events may be processed, for example product views, adding to cart or purchase. Depending on the integration used, contact details may also be shared to match events. If e-mail or phone are shared in hashed form, they remain personal data; this is not anonymisation.

Events may be sent from the browser or via a server interface, depending on the settings of the Shopify and Meta integration. The choice you give or refuse in the cookie banner is passed on to this integration; how it works in detail is determined by Shopify and Meta. Refusing marketing consent does not prevent you from buying.

Cookie lifetime is not the period for which Meta retains data. I will stop further collection for these purposes after the relevant consent is withdrawn. Meta determines how long it retains data already collected according to its nature, purpose of processing, the needs of providing and securing its services and legal obligations; details are in its privacy policy. Withdrawing consent does not in itself mean automatic deletion of all previously shared data; you can exercise your right to erasure under the conditions of the GDPR.

9. Cookies and changing your consent

The website uses cookies and similar technologies:

• necessary: required for the website to work, for example cart, login and security, and for storing your choice in the banner. They do not require consent.
• personalisation: store details of your actions so that the website adapts on your next visit.
• analytics: help me understand how you use the website and improve it (Google Analytics, Contentsquare).
• marketing: measuring and displaying ads, for example via Meta, and optional processing by Shopify Network Intelligence.

In countries where the law requires it, in particular in the EU and EEA, the United Kingdom and Switzerland, I use the optional categories (personalisation, analytics, marketing) only after you give the relevant consent. In these countries, a cookie banner appears on your first visit where you can accept, reject or adjust the optional categories. Rejecting is as easy as accepting. Closing the banner, inactivity or mere browsing do not constitute consent, and consent is not a condition of purchase.

In other countries you can opt out of data sharing for targeted advertising using the methods in chapter 11.

The banner and the storage of your choice are provided by Shopify. You can change your choice or withdraw consent at any time via the "Cookie settings" link in the website footer, or by deleting cookies in your browser. Withdrawal does not affect the lawfulness of processing before it. You can also block cookies directly in your browser. Without necessary cookies, however, the cart and ordering will not work. For processing for which Shopify is responsible as a controller, you can also manage your choices and rights through the Shopify privacy portal.

If your browser sends a Global Privacy Control signal, I treat it as an opt-out of the sale and sharing of data and of marketing cookies.

10. Your rights

Under the GDPR you have the right

• of access to the data I hold about you,
• to rectification of inaccurate data,
• to erasure ("right to be forgotten"), unless I have an obligation or legitimate reason to keep the data,
• to restriction of processing,
• to data portability,
• to object to processing based on legitimate interest,
• to withdraw consent.

You can exercise them by e-mail at hanapolivkovaeshop@gmail.com. I will reply within one month.

You also have the right to lodge a complaint with a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz. You can also contact the authority in your country of residence.

11. Customers outside the EU

This policy is written under the GDPR, which is a higher standard for most countries. For customers outside the EU I also state:

• United Kingdom: the same rights under the UK GDPR; the supervisory authority is the Information Commissioner's Office (ico.org.uk).
• Switzerland: the same rights under the Swiss Federal Act on Data Protection.
• USA (e.g. California, Virginia, Colorado): you may have the right to know what data I process about you, to request its deletion or correction and to opt out of the "sale" and "sharing" of data for targeted advertising. I do not sell data for money. However, Meta ad measurement and Shopify Network Intelligence may be considered "sharing" for targeted advertising under some laws. You can prevent this by rejecting marketing cookies, with a Global Privacy Control signal, on the Do not sell or share my personal information page or in the Shopify privacy portal. I will not discriminate against you for exercising your rights.
• Other countries (e.g. Canada, Brazil, Australia): I respect the rights granted to you by local law. Write to me at the e-mail address above.

12. Children

The e-shop is not intended for children under 16 and I do not knowingly collect their data.

13. Security

Data is protected by encrypted connection (HTTPS) and access rights in the providers' systems. Only I and people I authorise have access to the data.

14. Changes and effective date

I may update this policy. The current version is always on this page. Effective from 10 November 2026.