This Privacy Policy describes how SpokojenyPes.cz s.r.o. (“we”, “us”, or “our”) collects, uses, and discloses your personal information when you visit or make a purchase from www.thickcottontug.com (the “Website”). We operate in strict accordance with the General Data Protection Regulation (GDPR) and applicable legal frameworks of the Czech Republic and the European Union.
1. DATA CONTROLLER
The legal entity responsible for the processing of your personal data is:
To fulfil your orders for our products (such as dog chew toys and pet beds), we must process certain pieces of personal data. This information includes:
Identity and Contact Data: Your full name, shipping address, billing address, email address, and telephone number.
Transaction Data: Details concerning the specific products purchased, order dates, and financial history with our Website.
Technical Data: Internet protocol (IP) address, browser type, and details regarding your interaction with our Website.
3. PAYMENT PROCESSING
All financial transactions conducted on our Website are handled through our payment processor, Stripe.
Your payment card credentials are collected directly by Stripe and do not pass through or reside within our internal server infrastructure. Stripe processes this information in accordance with their own privacy protocols and standard international financial compliance mandates, specifically the Payment Card Industry Data Security Standard (PCI-DSS).
4. LEGAL BASIS FOR PROCESSING
We process your personal information under the following lawful grounds permitted under the GDPR:
Performance of a Contract: To manage, execute, and deliver your orders.
Legal Obligation: To comply with mandatory statutory accounting, tax, and corporate record-keeping requirements within the Czech Republic.
Legitimate Interests: To correspond with you regarding your inquiries, maintain operational consistency, and manage consumer relations.
5. DATA RETENTION PERIODS
We retain personal data only for the duration necessary to satisfy the purposes outlined in this policy, adhering strictly to European and Czech statutory requirements:
Transactional and Accounting Data: Information tied to purchases, invoicing, and tax records is retained for a mandatory period of 10 years, in compliance with the Czech Accounting Act and tax regulations.
Customer Correspondence: General inquiries, emails, and communication records are retained for up to 24 months following the final resolution of the matter to ensure continuity of service.
6. DATA SECURITY MEASURES
We implement appropriate technical and organisational measures to maintain the confidentiality and integrity of your personal information, aiming to minimise risks associated with unauthorised access, alteration, or disclosure.
Please be aware that while standard administrative measures are utilised to protect personal data, transmissions via the internet or methods of electronic storage cannot be classified as completely infallible. Consequently, all data transfers are undertaken at your own risk.
7. YOUR RIGHTS UNDER THE GDPR
As a resident of the European Economic Area (EEA), you hold specific legal rights regarding the processing of your personal data:
Right of Access: The right to request copies of the personal data we hold about you.
Right to Rectification: The right to request the correction of inaccurate or incomplete data.
Right to Erasure: The right to request the deletion of your personal data under specific statutory conditions.
Right to Restriction: The right to limit how we process your personal data.
Right to Data Portability: The right to receive your data in a structured, machine-readable format.
Right to Object: The right to object to processing based on our legitimate interests.
To exercise any of these rights, please submit a formal request to thickened@thickcottontug.com. We will review and respond to your valid request within 48 hours.
8. DATA TRANSFERS OUTSIDE THE EEA
Your personal data is primary stored and processed within the European Union. In circumstances where external service elements (such as international courier or logistics services) require data handling outside the EEA, we ensure that adequate safeguards are maintained in strict alignment with GDPR requirements.
