Privacy policy (GDPR)
1. Data Controller
The controller of your personal data is Zoibag - Lucie Jarušková, with its registered office at Nové sady 988/2, Brno 602 00, Czech Republic, IČO 23715545, registered in the Trade Register maintained by the Brno City Hall. Contact: info@zoibag.com.
2. What data do we process, and why?
We process your data solely for the following purposes and based on the legal grounds listed below:
Order processing and contract fulfillment: We process your first name, last name, shipping and billing addresses, email address, and phone number. The legal basis is the performance of a contract. Without this information, we cannot complete your handbag purchase.
Newsletter Subscriptions (Legitimate Interest): If you are a customer, we process your email address to send you news and offers based on our legitimate interest (you can unsubscribe at any time by clicking the link in the email).
Sending newsletters (consent): If you are not a customer but sign up for the newsletter on our website, we process your email address based on your voluntary consent, which you may withdraw at any time.
3. Who receives your data? (Recipients)
We do not sell personal data. However, to operate our online store, we use the services of trusted data processors:
E-commerce platform: Shopify International Limited (operation and management of the online store).
Shipping Carriers: Zásilkovna s.r.o. (Packeta), or other carriers used for the delivery of goods.
Payment Gateways: Payment service providers (for the secure processing of your order payments).
Accounting Services: Our external accountants (for the processing and archiving of tax documents).
4. How long do we retain your data?
Accounting and tax documents: In accordance with the VAT and Accounting laws, we retain invoices and the associated personal data for a period of 10 years from the end of the tax period.
Marketing purposes (newsletters): We retain your data for a period of 3 years from your last purchase, or until you revoke your consent or unsubscribe.
5. Your Rights
Under the GDPR, you have the following rights with respect to us:
1.The right to access your personal data and to information about how we process it.
2.The right to have inaccurate or incomplete data corrected.
3.The right to erasure (the right to be forgotten) if the data is no longer necessary for the fulfillment of legal obligations (e.g., tax obligations).
4.The right to restrict processing.
5.The right to object to processing (particularly in the case of marketing based on legitimate interest).
6.The right to data portability.
If you believe that we are processing your data in violation of the law, you have the right to file a complaint with the Office for Personal Data Protection (ÚOOÚ).
Effective as of: September 15, 2026