1. Basic Provisions

1.1. The controller of personal data, according to Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation, hereinafter referred to as "GDPR", is:

[Name and surname / company name]
ID: [fill in ID]
Registered office: [fill in address]
Email: plodzienkamilart@gmail.com
Phone: [fill in phone]

hereinafter referred to as "the controller".

1.2. These principles explain what personal data the controller processes, for what purpose, for how long, and what rights you have in connection with the protection of personal data.

1.3. Personal data means information about an identified or identifiable natural person.

2. What personal data do we process?

2.1. The controller processes personal data that you provide to them, especially when ordering a painting, requesting custom work, or communicating via email or contact form.

2.2. This may include, in particular, the following data:

• name and surname,
• company name, ID number or VAT number if you are ordering as an entrepreneur,
• email address,
• phone number,
• delivery address,
• billing address,
• order details,
• data necessary for invoicing,
• content of messages and communication related to the order or custom work.

2.3. The website may also process technical data necessary for the proper functioning of the website, such as IP address, device information, or basic cookies.

3. Purpose and Legal Basis for Processing

3.1. We process personal data only to the necessary extent and for the reasons stated below.

Performance of a contract

We need your data to process your order, communicate about custom work, deliver the painting, issue an invoice, and resolve any complaints.

Fulfilling a legal obligation

We must retain certain data for accounting, tax obligations, and archiving accounting documents in accordance with applicable legal regulations.

Legitimate interest

We may also process data to protect our legal claims, for example, in resolving disputes, complaints, or unpaid receivables.

Consent

If the website uses a newsletter, marketing cookies, or similar tools, personal data for these purposes will be processed only based on your consent, if required by law.

4. Personal Data Retention Period

4.1. We retain personal data only for the period strictly necessary.

4.2. We retain data related to an order for the duration of the contractual relationship and then for the period necessary to resolve any complaints, disputes, or legal claims.

4.3. Data contained in accounting and tax documents are retained for the period stipulated by legal regulations.

4.4. Data from contact communication are retained for the period necessary to process the query or request, or longer if an order or other contractual relationship arises from the communication.

5. Who has access to personal data?

5.1. Personal data are not sold to third parties.

5.2. Personal data can only be accessed by persons and services that are necessary for the operation of the website, order processing, payment, shipping, or fulfillment of legal obligations.

5.3. This may include, in particular:

• Shopify e-commerce platform provider,
• web hosting and technical support providers,
• shipping companies providing delivery of the shipment,
• payment service providers or banks,
• accounting services or accounting software,
• and possibly other suppliers involved in the operation of the website and order processing.

5.4. If an order is delivered outside the Czech Republic or outside the European Union, necessary personal data may be transferred to the carrier for the purpose of delivering the shipment.

6. Cookies

6.1. The website may use cookies and similar technologies.

6.2. Some cookies are necessary for the proper functioning of the website and e-shop, for example, for security, adding goods to the cart, or completing an order.

6.3. If the website uses analytical or marketing cookies, they will only be used in accordance with applicable legal regulations and according to the visitor's consent settings.

7. Your Rights

7.1. In connection with the processing of personal data, you primarily have the right to:

• request access to your personal data,
• request rectification of inaccurate or incomplete data,
• request erasure of personal data if the legal conditions are met,
• request restriction of processing,
• object to processing based on legitimate interest,
• request data portability, if possible under GDPR,
• withdraw consent if processing is based on consent.

7.2. You can exercise your rights by email at:

plodzienkamilart@gmail.com

7.3. If you believe that your personal data is not being handled in accordance with legal regulations, you have the right to contact the Office for Personal Data Protection.

Office for Personal Data Protection
Pplk. Sochora 27
170 00 Prague 7
web: www.uoou.cz

8. Security of Personal Data

8.1. The controller declares that it has taken appropriate technical and organizational measures to protect personal data.

8.2. The website uses a secure HTTPS connection. Access to personal data is only granted to authorized persons and suppliers who need it to fulfill the order, operate the website, or fulfill legal obligations.

9. Final Provisions

9.1. The controller reserves the right to modify these personal data protection principles, especially in the event of changes in legal regulations, the method of personal data processing, or the services used.

9.2. The current version of the personal data protection principles is always published on this website.

9.3. These personal data protection principles come into effect on [fill in date].