Privacy Policy

This Privacy Policy explains how I collect and process personal data when operating the online store https://www.nalezny.cz, on what legal grounds, who may receive such data where necessary, and what rights you have under Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll.

1. Data Controller and Contact Details

• Data Controller: Jaroslav Nálezný, self-employed entrepreneur under the Czech Trade Licensing Act
• Registered Address: Jana Růžičky 1151/27, Kunratice, 148 00 Praha 4, Czech Republic
• Company ID (IČO): 04384873
• Tax / VAT ID (DIČ): CZ8201142312 (identified person for VAT, non-VAT payer)
• E-mail: jaroslav@nalezny.cz
• Telephone: +420 608 96 10 54

No Data Protection Officer (DPO) is appointed as this is not required under Article 37 GDPR.

2. Categories of Personal Data Processed

• Identification and contact details: name, surname, e-mail address, phone number, company name, Company ID and VAT ID where entered.
• Billing and payment records: billing address, order reference, selected payment method and payment confirmation details (card numbers are never stored by the controller and are handled exclusively by the payment provider).
• Orders and licenses: downloaded or purchased modules, software versions, download history and support/service records.
• Temporary technical credentials: Back Office admin or server credentials (SFTP/SSH, database, staging) if voluntarily supplied for module installation or custom PrestaShop development.
• Communications and reviews: e-mails, contact form inquiries, and product reviews posted from your customer account.
• Technical and usage data: IP address, browser/device type, operating system, access timestamps and cookies (see the Cookie Policy).

3. Purposes, Legal Bases and Retention Periods

• Order fulfillment, module delivery and IT services (Art. 6(1)(b) GDPR – performance of a contract): required to process orders, provide download links, perform services and resolve support or defect claims. Retained for the contract/account duration plus statutory limitation periods for defect claims (typically 3–4 years).
• Tax and accounting compliance (Art. 6(1)(c) GDPR – legal obligation): invoices and order records are archived as required by Czech accounting and tax statutes (generally 10 years from the end of the tax period).
• Security, legal defense and direct communications with existing customers (Art. 6(1)(f) GDPR – legitimate interest): fraud prevention, site security, legal claim defense, and sending updates about closely related own modules/services to existing customers (with effortless opt-out in every message). Technical server logs are kept for an appropriate operational period.
• Analytics and optional cookies (Art. 6(1)(a) GDPR – consent): traffic measurement via Consentmanager runs only after your active opt-in consent, which may be withdrawn at any time.

Temporary admin or server credentials provided for installation or maintenance are used strictly during engagement execution; customers are advised to rotate or revoke temporary credentials upon completion.

4. Recipients and International Transfers

I do not sell personal data. Depending on your order and cookie choices, limited data may be processed by:

• Payment processor – PayPal (Europe) S.à r.l. et Cie, S.C.A. (via PrestaShop Checkout) for card, PayPal, Apple Pay and Google Pay payments.
• Bank – Partners Banka, a.s., Türkova 2319/5b, 149 00 Praha 4, Czech Republic, for bank wire payments.
• Analytics – Google Ireland Limited / Google LLC (Google Analytics 4, Measurement ID G-XCKR32LC50 with IP anonymization enabled) — strictly subject to your prior cookie consent.
• Consent management – consentmanager AB (Consentmanager CMP) to store and enforce your cookie preferences.
• Hosting, e-mail infrastructure and accounting service providers: strictly on a need-to-know basis under GDPR processing agreements.

Where Google or PayPal transfer data outside the EU/EEA (e.g., to the United States), transfers rely on adequacy decisions (EU–US Data Privacy Framework) or Standard Contractual Clauses (Art. 46 GDPR).

5. Security and Automated Decision-Making

I do not carry out automated individual decision-making or profiling producing legal effects under Article 22 GDPR. All connections are protected via HTTPS encryption and appropriate technical/organizational safeguards.

6. Your Rights Under GDPR

You have the right to request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object to legitimate-interest processing including direct marketing (Art. 21), to withdraw consent at any time, and to lodge a complaint with the supervisory authority: Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, https://uoou.gov.cz.

Registered customers can also use the integrated GDPR self-service tools (data export and deletion requests) inside their customer account, or contact jaroslav@nalezny.cz.

Effective date: 11 November 2026.