Meet us at MEAT DESIGN in Ostrava · 6–8 November 2026 · Černá louka Exhibition GroundsVíc o Travel setu

Privacy policy

Privacy Policy

I. Controller of personal data

The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (hereinafter the “GDPR”) is Lada Vyvialova Creative Platform s.r.o., Company ID No. 01984691, with its registered office at Boženy Němcové 1238, 742 58 Příbor, registered in the Commercial Register kept by the Regional Court in Ostrava, Section C, Insert 75102 (hereinafter the “Controller”).

Contact for personal data matters: atelier@ladavyvialova.cz, or by post to the address of the registered office. The Controller has not appointed a data protection officer.

This policy applies to the online shop at ladavyvialova.cz (hereinafter the “e-shop”), to the customer account, to the Meet Lada form and to communication with the Controller.

II. What data we process and where we obtain it

  1. Order and purchase contract: first name and surname, delivery and billing address, email, telephone, contents of the order, price, payment and delivery method, history of orders, complaints and returns. You provide this data to us at the checkout. Payment card data is processed by the payment gateway provider (Shopify Payments); the Controller neither sees nor stores card numbers.
  2. Customer account: email, name, addresses, order history; you log in with a one-time code sent to your email.
  3. Meet Lada form: name, email, telephone (optional), the chosen location and date, and the text of your message.
  4. Communication: the contents of emails and messages you send us (enquiries, complaints, returns).
  5. Newsletter subscription: email and a record of your consent, the date on which and the manner in which it was given.
  6. Data on the use of the e-shop: IP address, device and browser identifiers, pages visited and events in the shop – we obtain this data through the Shopify platform and cookies (see Article VI).

We do not obtain data from third parties, with the exception of the payment gateway (information on the outcome of the payment) and the carrier (information on delivery).

III. Purposes and legal bases of processing

Purpose Data Legal basis
Processing the order, delivering the goods, issuing the invoice, handling returns and complaints order, communication performance of a contract (Article 6(1)(b) GDPR)
Keeping accounts and tax records order documents compliance with a legal obligation (Article 6(1)(c) GDPR) – the Accounting Act (zákon o účetnictví), the VAT Act (zákon o DPH)
Customer account account performance of a contract (Article 6(1)(b))
Arranging a personal meeting with the designer Meet Lada form performance of a contract / steps taken at your request prior to entering into a contract (Article 6(1)(b))
Sending news and offers by email email consent (Article 6(1)(a)) or a legitimate interest in direct marketing to existing customers (Article 6(1)(f)), with the option to unsubscribe at any time
Security of the e-shop, fraud prevention, defence of legal claims usage data, orders legitimate interest of the Controller (Article 6(1)(f))
Traffic measurement and marketing (analytical and marketing cookies) usage data consent given in the Cookie settings dialogue (Article 6(1)(a))

The provision of data for the processing of an order is a contractual requirement; without it, the order cannot be processed. The Controller does not carry out automated individual decision-making within the meaning of Article 22 GDPR.

IV. Retention period

  • Data on orders, complaints and returns: for 5 years from delivery of the goods (exercise and defence of claims arising from defective performance and from the purchase contract).
  • Accounting and tax documents: 10 years from the end of the tax period in which the document was issued (the VAT Act).
  • Customer account: for as long as the account exists; the Controller may cancel an account that has not been used for more than 24 months.
  • Meet Lada form: 12 months from submission, unless an order is placed.
  • Newsletter subscription: until consent is withdrawn or you unsubscribe; thereafter only a record that consent was withdrawn.
  • Usage data and cookies: according to the lifetime of the individual cookies stated on the Cookies page.

Once the retention period has expired, we erase or anonymise the data.

V. Recipients of personal data

The data is processed on behalf of the Controller by the following processors and recipients, always only to the extent necessary for the given purpose:

  • Shopify International Limited (Ireland) – operator of the e-shop platform, the checkout, customer accounts and system emails. For certain functions (e.g. fraud prevention and enhanced platform features) Shopify acts as an independent controller; details are set out at https://www.shopify.com/legal/privacy/customers.
  • Shopify Payments – payment gateway; processes payment data as an independent controller.
  • Carriers: Zásilkovna s.r.o. (Packeta), Českomoravská 2408/1a, 190 00 Prague 9; once the Polish offer is launched, Packeta (Zásilkovna s.r.o. / Packeta Poland).
  • ECOMAIL.CZ, s.r.o. (Na Zderaze 1275/15, 120 00 Prague 2, email newsletter tool) – newsletter subscribers only.
  • Google Ireland Limited – Google Analytics 4, only once consent to analytical cookies has been given.
  • The Controller's accountant – order documents.
  • Public authorities, where required by law.

Data may be transferred to countries outside the European Economic Area only within the services of the Shopify and Google platforms, on the basis of a European Commission adequacy decision or standard contractual clauses; a copy of the safeguards will be provided on request.

VI. Cookies

The e-shop uses necessary cookies (cart, login, checkout, language and currency, security), which do not require consent, as well as preference, analytical and marketing cookies, which are stored only with consent given in the Cookie settings dialogue. Consent can be changed or withdrawn at any time via the “Cookie settings” link in the footer of every page. A detailed overview is available on the Cookies page.

VII. Your rights

Under the conditions laid down by the GDPR, you have the right of access to your personal data (Article 15), the right to rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and the right to object to processing based on a legitimate interest, including direct marketing (Article 21). You may withdraw your consent to processing at any time; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

You can exercise your rights by email at atelier@ladavyvialova.cz or by post to the address of the registered office. We will respond without undue delay and no later than within one month. We may verify your identity before dealing with your request.

You also have the right to lodge a complaint with the supervisory authority: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz. Customers from Poland may also contact the Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.

VIII. Security

The Controller has adopted appropriate technical and organisational measures to secure personal data, in particular encrypted data transmission (HTTPS), access control for the e-shop platform and email accounts, and rules for handling paper documents. Only authorised persons have access to the data.

IX. Changes to this policy

We may update this policy, for example when the services we use or the legal regulations change. The current version, with its effective date, is always available on the e-shop website. This policy takes effect on 28 September 2026 and replaces the version effective from 25 May 2018.