Personal data protection policy

PERSONAL DATA PROTECTION POLICY

1. Data Controller

The controller of personal data is:

Papelote s.r.o.
Company ID (IČ): 289 44 895
Registered office: Kozí 1002/8, 110 00 Praha 1
File number: C 154878, maintained by the Municipal Court in Prague

Contact details:
Email: eshop@papelote.cz
Phone: +420 773 069 426

(hereinafter the “controller”)

2. What Personal Data We Process

We process personal data that you provide to us when:

Purchasing goods

first name and surname
email
phone
delivery and billing address
order and payment data

Registering an account

login credentials
order history

Communicating with us

content of messages
contact details

Marketing

email address for sending commercial communications
data on interaction with emails

Visiting the website

IP address
cookies
device and browser data

3. Purposes and Legal Bases of Processing

Performance of a contract (Article 6(1)(b) GDPR)

order processing
delivery of goods
handling of complaints

Compliance with legal obligations (Article 6(1)(c))

accounting
tax obligations

Legitimate interest (Article 6(1)(f))

protection of legal claims
basic traffic analysis
sending commercial communications to existing customers (soft opt-in)

Consent (Article 6(1)(a))

newsletter for persons who are not customers
analytical and marketing cookies
personalised advertising

Consent can be withdrawn at any time.

4. Profiling and Personalisation

For marketing purposes, we use tools that enable basic profiling, in particular:

Google Analytics
Google Ads
Meta Pixel

Profiling consists mainly of analysing behaviour on the website and personalising advertisements.

This profiling does not produce legal or similarly significant effects.

5. Recipients of Personal Data

Personal data may be disclosed to:

E-shop operation

Shoptet and related IT services

Carriers and payment services

(to the extent necessary for delivery and payment)

Marketing and analytics tools

Google LLC
Meta Platforms, Inc.
LeadHub

6. Transfers of Data Outside the EU

When using the services of Google and Meta, personal data may be transferred to the USA.

Such transfers take place on the basis of:

Standard Contractual Clauses
or
EU-US Data Privacy Framework

7. Data Retention Period

We retain personal data:

order data: 10 years
customer account: until it is deleted
marketing data: until consent is withdrawn or an objection is raised
data processed for legitimate interest: a maximum of 5 years

8. Your Rights

You have the right to:

access your personal data
rectification
erasure
restriction of processing
data portability
object to processing
withdraw consent
lodge a complaint with the Office for Personal Data Protection (Czech Republic)

9. Data Security

We use appropriate technical and organisational measures to protect personal data.

10. Cookies

Details on the use of cookies are provided in a separate document.

COOKIE POLICY

papelote.cz

Last updated: 19 February 2026

1. What Cookies Are

Cookies are small text files stored on your device when you visit a website.

2. What Cookies We Use

Necessary cookies

They ensure the basic functionality of the e-shop and cannot be switched off.

Analytical cookies

We use the Google Analytics service to analyse traffic and user behaviour.

They are used only on the basis of consent.

Marketing cookies

We use the following marketing tools:

Google Ads
Meta Pixel

These cookies enable ad personalisation and remarketing.