Privacy Policy

2. Data categories and sources

We process only data relevant to a particular service and apply data minimisation. The usual categories are:

Sources of data

• information you provide when ordering, registering, subscribing to the newsletter, requesting a back-in-stock alert or contacting us;
• information generated when a contract is performed, payment is made, goods are dispatched, returned or complained about;
• technical information generated when you use the website;
• confirmation and status data from carriers, payment providers and other partners involved in your order.

3. Purposes and legal bases

The table sets out the main purposes, typical data and legal bases under Article 6 GDPR. More than one legal basis may apply in a particular case.

When relying on legitimate interests, we assess necessity, proportionality and the impact on your rights. Further information about the relevant balancing assessment is available on request. A separate, unconditional right to object applies to direct marketing.

4. Mandatory and optional data

Fields marked as mandatory during checkout are needed to enter into and perform the contract, deliver goods, accept payment or comply with law. Without them, we may be unable to accept or fulfil the order.

Creating an account, subscribing to the newsletter, optional cookies, marketing choices and most profile information are voluntary. Refusing or withdrawing consent does not prevent an ordinary purchase.

5. Recipients and service providers

We disclose data only to the extent necessary and according to each recipient’s role. The exact partner depends on the selected delivery, payment, country and active functions.

We put appropriate processing agreements in place with processors. Some recipients, in particular banks, carriers or payment institutions, may act as independent controllers for parts of their own activities. Current, more detailed information is available on request.

6. Transfers outside the EU/EEA

We prefer processing within the EU/EEA. Some cloud, security, analytics or advertising services may nevertheless involve access from or a transfer to a third country. In that event, we verify the transfer mechanism and appropriate supplementary measures.

A transfer may rely on an adequacy decision, the EU–US Data Privacy Framework for a certified recipient, Standard Contractual Clauses or another safeguard permitted by the GDPR. You may request a copy of the relevant safeguard, or information about where it is available, by email.

7. Retention periods

We do not apply one universal deletion date. Data is kept for as long as needed for the relevant purpose, statutory duties and the defence of legal claims. As a guide:

Orders and accounting documents

for the period required by accounting and tax laws, typically up to 10 years;

Orders, complaints and legal claims

during performance and then normally for the applicable limitation and warranty periods;

Customer account

while the account exists and afterwards only to the limited extent required by law or for claims;

Newsletter and marketing

until unsubscribe, objection or withdrawal of consent; evidence of consent and suppression records may be retained where necessary;

Technical and security logs

normally from several days to 24 months depending on purpose, risk and system configuration;

Cookies and online identifiers

for the periods stated in the separate Cookie Policy.

In setting a period, we consider purpose, statutory archiving, limitation periods, dispute risk, security and data minimisation. Backups are deleted through the normal rotation cycle.

8. Cookies, newsletter and direct marketing

Cookies and similar technologies are used according to their purpose and your choices. Optional analytics and marketing technologies are activated only after the required consent. Details, the current list and the option to change your choice are available in the Cookie Policy.

We send newsletters after subscription and email verification, or to existing customers only where national law permits. Every marketing message provides an unsubscribe option. Withdrawing consent or objecting does not affect processing needed for an order.

9. Automated decisions and profiling

We do not carry out solely automated individual decision-making under Article 22 GDPR that produces legal or similarly significant effects. Basic product recommendations, campaign measurement or segmentation do not by themselves amount to such decision-making, and optional online profiling depends on your consent settings.

10. Your rights

Subject to the GDPR conditions, you have the right to:

• obtain confirmation of processing and request access and a copy;
• have inaccurate data corrected and incomplete data completed;
• request erasure or restriction where the statutory conditions are met;
• receive data in a portable format where the right to portability applies;
• withdraw consent at any time without affecting earlier lawful processing;
• object to processing based on legitimate interests;
• not be subject to prohibited solely automated decision-making;
• lodge a complaint with a competent supervisory authority.

11. Exercising rights and complaints

Send requests to info@tipidi.cz. Describe the right you wish to exercise and provide enough information for us to identify you reasonably. If we have reasonable doubts about identity, we may ask for proportionate additional verification and will not request more information than necessary.

We respond without undue delay, normally within one month. For complex requests, the GDPR allows an extension of up to two further months; we will inform you of the extension and reasons in time. Requests are generally free of charge, subject to the exceptions in the GDPR.

You may also complain to a supervisory authority in another Member State, particularly where you live, work or where the alleged infringement occurred. Cross-border matters are handled by the authorities through the GDPR cooperation mechanisms.

12. Security, changes and contact

We use technical and organisational measures proportionate to risk, including encrypted connections, access controls, role separation, updates, backups, monitoring and incident-response procedures. No system can be described as absolutely secure.

We may update this notice when services, partners, technology or legal requirements change. The current version and update date will always be available here, and material changes will be communicated appropriately.

Effective from: 12. 7. 2026.