How Šťáva processes personal data.
This notice explains each storefront data flow, its legal basis, retention, recipients, and the choices and rights available to you.
This notice is written for this application and must be reviewed whenever an integration, purpose, recipient, or retention period changes.
Controller and contact
The personal-data controller is the shop operator: ČeKa Káva, s.r.o., Nušlova 2258/2, 158 00 Praha 5, Česká republika; IČO: 02462231; DIČ: CZ12345678; zapsána pod značkou C 219675/MSPH Městským soudem v Praze.
Send privacy requests and questions to podpora@stava.cz; +420 212 345 678. No data protection officer has been appointed; if that changes, their contact will be published here.
Account and authentication
When you create or use an account, we process your name, email address, password hash (never the plain password), sign-in provider, company name if supplied, role, saved delivery and invoice addresses, and account timestamps. This is needed to provide the requested account and prepare or perform a purchase contract under Article 6(1)(b) GDPR.
Google or GitHub receives and returns sign-in data only if that option is configured and you choose it. Security rate limits process a shortened-lived combination of IP address and email under our legitimate interest in preventing account abuse, Article 6(1)(f). Account data is required if you choose to create an account; optional company, saved-address, and marketing fields are marked optional.
Orders, delivery, payment, invoices, and support
For checkout and fulfilment we process ordered items, prices, coupon, billing and delivery identity and contact data, address, company and tax identifiers where relevant, order notes, status, carrier and tracking data, returns, complaints, and payment or refund references. The basis is taking steps at your request and performing the contract, Article 6(1)(b). Required identity, delivery, and billing fields cannot be omitted if they are necessary to fulfil the order.
We do not intend to store complete payment-card details. A configured payment provider processes those in its own environment. Invoice and accounting data is also processed to meet Czech tax and accounting duties under Article 6(1)(c). Customer correspondence and evidence needed to establish, exercise, or defend claims is processed under Article 6(1)(b), (c), or our legitimate interest under Article 6(1)(f), depending on the request.
Marketing and cookie choices
Optional roastery news is based on your separate, unticked consent under Article 6(1)(a) GDPR and Czech electronic-marketing rules. We record whether consent was granted or withdrawn, when, where, and against which wording version so we can honour and demonstrate the choice. You can withdraw it in the account as easily as granting it; withdrawal does not affect earlier lawful processing.
Optional analytics and marketing browser storage is also consent-based and remains off until you select it. Essential session, security, cart, language, and preference storage is used only to provide a service you request. The separate cookie notice lists each current technology and lets you reject or withdraw optional categories at any time.
Security diagnostics and legitimate interests
We process limited technical request and error information to keep the service secure, diagnose failures, prevent fraud, enforce access control, and protect customers and the operator. These are legitimate interests under Article 6(1)(f). We minimise error reports by removing cookies, authorization and IP headers, form bodies, query strings, and user identity before external reporting.
You may object to processing based on legitimate interests. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed for legal claims. Direct marketing stops when you object.
Sources and data we do not use
Most data comes directly from you. Sign-in providers supply the name, email, and provider identifier you authorize; payment, invoice, delivery, and support providers may return transaction or fulfilment status. Security metadata is generated when you use the service.
The shop does not ask for special-category data, use customer data for solely automated decisions with legal or similarly significant effects, or sell personal data. Avoid putting health or other sensitive information in free-text order, return, or privacy-request notes.
Recipients, processors, and transfers outside the EEA
We disclose data only to personnel who need it to operate the shop and to providers of hosting, databases, backups, email, sign-in, accounting, delivery, payment, or security diagnostics. The operator must have Article 28 GDPR terms with providers acting as processors.
If a provider outside the European Economic Area is used, the transfer must rely on an adequacy decision or Standard Contractual Clauses with any necessary supplementary measures. Ask the controller for a copy or description of the safeguards.
- Optional external services enabled in this deployment:
- Fakturoid
- Resend email delivery
Retention schedule
Account profile and saved-address data is kept while the account is active and is erased or anonymised after account closure unless it is still needed for a retained order, legal duty, unresolved request, or claim. You can delete saved addresses individually. Cart data stays in your browser until checkout, manual clearing, or browser-storage clearing. Authentication sessions last no more than 30 days.
Order and invoice data is kept for the Czech statutory accounting or tax period: generally five years for accounting documents and ten years for VAT documents, counted as the applicable law requires, and longer only while a dispute, claim, audit, or unpaid obligation remains open. Closed privacy-request records are scheduled for automatic deletion after three years. Marketing-consent evidence remains with the active account and, after closure, only as long as needed for accountability and limitation purposes, ordinarily no more than three years. Cookie-choice retention is listed in the cookie notice. Backups follow the same deletion decision at the next scheduled rotation.
Your rights and how to exercise them
Depending on the legal conditions, you may request access and a copy, rectification, erasure, restriction, portability of data you provided, or object to legitimate-interest and direct-marketing processing. You may withdraw consent at any time. Erasure does not override data we must retain for tax, accounting, contract, or legal-claim reasons.
Signed-in users can download an account and order JSON bundle and submit rectification, erasure, restriction, or objection requests in the account. You may also use the controller contact; an account is not required. We answer without undue delay and normally within one month. A complex request may be extended by two further months, but we will explain the extension within the first month. We may request proportionate identity verification.
- Access and machine-readable account export
- Correction, erasure, and restriction requests
- Data portability where Article 20 applies
- Objection to legitimate interests or direct marketing
- Withdrawal of marketing and cookie consent
Complaints, security, and changes
You may complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, or another competent supervisory authority. Using this right does not prevent you from seeking a judicial remedy.
We use role-based access, password hashing, encrypted transport in production, scoped database credentials, authenticated internal services, validated uploads, backups, and minimised monitoring. No system is risk-free; the operator must assess incidents and notify the authority and affected people where Articles 33 and 34 GDPR require it. Material changes to this notice are dated and, where appropriate, communicated in the account or before the affected processing begins.