Privacy policy

Personal Data Processing Policy pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

I. Introductory Provisions

The controller of personal data pursuant to Art. 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: "GDPR") is LEROS, s.r.o., Company ID (IČO): 614 65 810, with registered office at U Národní galerie 470, Prague 5 – Zbraslav, Postal Code 156 00, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 29300 (hereinafter: "Controller"). The Controller operates an online store at: www.lerostery.cz (hereinafter the "Website"). Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. The Controller has not appointed a data protection officer.

II. Scope and Categories of Processed Data

The Controller processes only the personal data necessary to fulfil the stated purposes, in particular the following categories of data:

  • first name, surname, company name;
  • Company ID (IČ), VAT ID (DIČ), registered office or place of business address;
  • e-mail address, telephone number;
  • login credentials for the user account;
  • data on orders, invoices, and payments;
  • data on communication with the customer;
  • IP address, cookies, and other data on user behaviour on the website (see Art. IX).

III. Purposes of Personal Data Processing

We process personal data for the following purposes:

  • Conclusion and performance of the purchase contract – processing your order, invoicing, delivery of goods, handling of complaints.
  • User account management – registration, access to orders, communication with the customer.
  • Compliance with legal obligations – in particular obligations arising from the Accounting Act and tax regulations.
  • Legitimate interest of the Controller – protection of the rights and legitimate interests (e.g. debt recovery, website security, direct marketing to customers).
  • Marketing activities and sending commercial communications – sending newsletters and information about news, promotions, and products of the Lerostery brand (or of LEROS, s.r.o.), provided the customer has given consent or where the recipient is an existing customer pursuant to Section 7(3) of Act No. 480/2004 Coll.

IV. Legal Basis for Personal Data Processing

Personal data is processed on the basis of the following legal grounds pursuant to Art. 6 GDPR:

  • performance of a contract between you and the Controller (Art. 6(1)(b) GDPR);
  • compliance with a legal obligation (Art. 6(1)(c) GDPR);
  • the legitimate interest of the Controller in providing direct marketing, in particular for sending commercial communications and newsletters (Art. 6(1)(f) GDPR);
  • your consent to the processing of personal data (Art. 6(1)(a) GDPR) – in particular for sending newsletters and marketing information and for the use of cookies beyond necessary purposes.

V. Retention Period of Personal Data

The Controller retains personal data:

  • for the duration of the contractual relationship and subsequently for the period necessary to protect the Controller's rights (generally 4 years);
  • data stated on tax documents for 10 years in accordance with accounting regulations;
  • data processed on the basis of consent for the period of validity of the consent or until its withdrawal;
  • cookie data according to the user's cookie settings (see Art. IX). Upon expiry of the retention period, personal data is securely deleted or anonymised.

VI. Recipients and Processors of Personal Data

The Controller is entitled to transfer personal data to entities with which it has concluded a personal data processing agreement and which will process personal data for the Controller as its processors. Personal data may be made available to the following categories of recipients:

  • Contracted carriers ensuring delivery of goods (first name, surname, address, e-mail, telephone): PPL CZ s.r.o., Zásilkovna s.r.o., General Logistics Systems Czech Republic s.r.o.;
  • Employees of the Controller;
  • Persons in another contractual relationship with the Controller (e.g. providers of marketing and advertising services, law firms);
  • Financial institutions and insurance companies;
  • State authorities in the course of fulfilling legal obligations laid down by the relevant legislation.

Furthermore, the Controller is entitled to transfer personal data connected with the administration of information systems and with marketing and payment services to the following recipients:

Meta Platforms Ireland Limited; Google Ireland Limited; Heureka Group a.s.; Seznam.cz, a.s.; Ecomail.cz, s.r.o.; Shopify International Limited; Stripe Payments Europe, Ltd.; Comgate a.s. The Controller has concluded appropriate personal data processing agreements with these entities ensuring the protection and security of data in accordance with GDPR.

VII. Your Rights

Under the conditions set out in the GDPR, you have:

  • the right of access to your personal data under Art. 15 GDPR;
  • the right to rectification of personal data under Art. 16 GDPR, or restriction of processing under Art. 18 GDPR;
  • the right to erasure of personal data under Art. 17 GDPR;
  • the right to object to processing under Art. 21 GDPR;
  • the right to data portability under Art. 20 GDPR;
  • the right to withdraw consent to processing in writing or electronically at the address or e-mail of the Controller, info@lerostery.cz, or to contact us by telephone at +420 800 191 191. You also have the right to lodge a complaint with the Office for Personal Data Protection (www.uoou.cz) if you believe that your right to the protection of personal data has been violated.

VIII. Security of Personal Data

The Controller has adopted technical and organisational measures to ensure the protection of personal data against loss, misuse, unauthorised access, or disclosure. Personal data is stored in secure databases with restricted access, and all employees and processors are bound by a duty of confidentiality.

IX. Cookies and Online Marketing

The website www.lerostery.cz uses cookies, which serve to improve user comfort, measure traffic, and target advertising.

TYPES OF COOKIES

  • Necessary cookies – Necessary cookies help make a website usable. They provide basic functions such as page navigation and access to secure areas of the website. Without these cookies the website cannot function properly.
  • Analytical, performance, and statistical – These cookies serve to improve the functioning of the website.
  • Preference – Preference cookies enable the website to remember information that changes the way the website behaves or looks.
  • Advertising and marketing – Advertising cookies are used to track visitors across websites.
  • Other cookies – These are cookies that, by their type and purpose, cannot be assigned to one of the above categories. We store necessary cookies without consent (they are required for providing the service). We store analytical, preference, and marketing cookies only on the basis of your consent, which can be withdrawn at any time in the cookie bar or in the browser settings.

X. Final Provisions

The Controller reserves the right to change the rules for the protection and processing of personal data in any way and at any time, with the current version always being posted on the website www.lerostery.cz.

In Prague, on 14 July 2026. LEROS, s.r.o.