1. Who is the controller of your personal data
The controller of your personal data is:
Ing. Daniel Volařík, a self-employed natural person operating under a trade licence
registered place of business: Přečkovice 86, 687 71 Bojkovice, Czech Republic
Company ID (IČ): 15254666, VAT ID: CZ511121169
correspondence address: Pecháčkova 318, 688 01 Uherský Brod, Czech Republic
e-mail: info@houpacikun.cz, phone: +420 572 630 111
(hereinafter “we” or “the controller”). We have not appointed a Data Protection Officer, as we are not legally required to do so. Please send any questions regarding your personal data to the e-mail address above.
This policy applies to the processing of personal data when you use the website https://woodenrockinghorse.eu and its online shop, when you shop in our factory store, and when you communicate with us. The processing of personal data is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, “GDPR”) and by Czech Act No. 110/2019 Coll., on the Processing of Personal Data.
2. Why we process your data and on what legal basis
Below we list the individual purposes of processing, the data we use for each purpose, the legal basis and how long we keep the data.
2.1 Processing orders and delivering goods
Purpose: concluding and performing the purchase contract – processing your order and payment, delivering the goods and communicating with you about your order.
Data processed: first name and surname, billing and delivery address, e-mail, phone number, details of the ordered goods, payment and delivery method, and optionally company name, company ID, VAT ID and a note on the order.
Legal basis: performance of a contract (Article 6(1)(b) GDPR).
Retention period: for the time needed to process the order and then for the period during which claims for defective goods can be made and the statutory limitation periods run, i.e. 4 years from delivery of the goods. Data on tax documents are kept as described in section 2.3.
2.2 Customer account
Purpose: managing your customer account, where you can track your orders, save your details for future purchases and withdraw from a contract.
Data processed: username, e-mail, password (in encrypted form), name, addresses, phone number and order history.
Legal basis: performance of a contract (Article 6(1)(b) GDPR).
Retention period: for as long as the account exists. You can delete your account at any time. If you do not use your account for more than 2 years, we may delete it.
2.3 Compliance with legal obligations (tax documents and records)
Purpose: issuing and archiving tax documents and keeping tax records.
Data processed: data stated on the documents: name, address, company ID and VAT ID where applicable, details of the goods purchased and the price.
Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR), in particular under the Czech Value Added Tax Act and Income Tax Act.
Retention period: 10 years from the end of the tax period in which the transaction took place.
2.4 Complaints and withdrawal from the contract
Purpose: handling a complaint about defective goods, a withdrawal from the contract or any other complaint.
Data processed: identification and contact details, order details, description of the defect, and where applicable your bank account number for a refund.
Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR) and our legitimate interest in defending our legal claims (Article 6(1)(f) GDPR).
Retention period: for the time needed to handle the matter and then 4 years after it has been resolved; tax documents as described in section 2.3.
2.5 Answering your enquiries (contact form, e-mail, phone)
Purpose: replying to your enquiry and any follow-up communication.
Data processed: name (your first name or a nickname is enough), e-mail, optionally phone number, and the content of your message.
Legal basis: our legitimate interest in responding to your enquiry (Article 6(1)(f) GDPR); if your enquiry concerns entering into a contract, steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
Retention period: 1 year after your enquiry has been resolved. If the communication leads to an order, we keep it as described in section 2.1.
2.6 Product reviews
Purpose: publishing your review and possibly responding to it.
Data processed: review text and rating (required); name and e-mail are optional. Your name is displayed with the review; your e-mail is never published and is used only to respond to your review.
Legal basis: your consent, given by submitting the review (Article 6(1)(a) GDPR).
Retention period: for as long as the review is published, until you withdraw your consent or ask us to remove it.
2.7 News and special offers by e-mail
Purpose: sending commercial communications by e-mail.
Data processed: e-mail address and optionally your name.
Legal basis: for our customers, our legitimate interest in direct marketing (Article 6(1)(f) GDPR in conjunction with Section 7(3) of Czech Act No. 480/2004 Coll., on Certain Information Society Services) – the communications relate only to our own similar products; for other persons, your consent (Article 6(1)(a) GDPR). You can unsubscribe at any time via the link in every e-mail or by writing to info@houpacikun.cz.
Retention period: until you unsubscribe, but no longer than 3 years from your last purchase.
2.8 Website traffic statistics
Purpose: understanding how the website is used so that we can improve it. We use Independent Analytics and Matomo, both running on our own server. The data are not shared with any third party and are not used for advertising or profiling.
Data processed: pseudonymised data about individual visits (pages viewed, traffic source, device and browser type, approximate location at country level, truncated IP address). From these we create aggregated statistics that contain no information allowing an individual visitor to be identified.
Legal basis: Independent Analytics does not use cookies and processes data anonymously – based on our legitimate interest (Article 6(1)(f) GDPR). Matomo sets statistics cookies only with your consent given in the cookie banner (Article 6(1)(a) GDPR).
Retention period: data about individual visits are kept for no longer than 24 months and are then deleted automatically. Aggregated anonymous statistics (for example the number of visits per month) are not personal data, and we keep them for longer so that we can compare website traffic across years. Matomo statistics cookies are valid for no longer than 13 months.
2.9 Website security and spam protection
Purpose: protecting the website against attacks, misuse and spam submitted through forms.
Data processed: IP address, browser and device information, time and course of requests to the server, and information on how a form is filled in (anti-spam check).
Legal basis: our legitimate interest in operating the website securely (Article 6(1)(f) GDPR).
Retention period: 30 days, unless the data need to be kept longer to deal with a security incident.
2.10 Content embedded from other websites
Purpose: playing YouTube videos and displaying Google Maps directly on our pages.
Data processed: IP address, device and browser information and information about your interaction with the content; if you are logged in to your Google account, Google may link this information to your account.
Legal basis: your consent to marketing cookies given in the cookie banner (Article 6(1)(a) GDPR). Without your consent, videos and maps are not loaded.
Retention period: in accordance with Google’s policies; we do not store this data on our website.
3. Which data are required and which are optional
To process your order, we need your name, delivery and billing address, e-mail and phone number. This allows us to deliver your goods, issue a tax document and keep you informed about the status of your order. We are also required by law to keep the data stated on the tax document.
To reply to an enquiry sent through the contact form, we need at least your e-mail address.
All other data are optional, and it is entirely up to you whether you provide them – for example your company name and company ID when ordering, a note on your order, or your name and e-mail with a review.
4. Who we share your data with
We never sell your personal data. We share them only to the extent necessary with the following recipients:
- Carriers – depending on the delivery method you choose, Česká pošta, s.p., Zásilkovna s.r.o. (Packeta), and for deliveries abroad the PoštaBezHranic.cz service, which may pass the data on to a partner carrier in the destination country. We share your name, delivery address, phone number and e-mail.
- Payment providers – for card payments Stripe Payments Europe, Ltd. (Ireland), for PayPal payments PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). You enter your card details directly with the payment provider; we have no access to them. For bank transfers, your payment details are visible to our bank, Komerční banka, a.s.
- Web hosting provider and E-mail service provider – ZONER a.s., Nové sady 18, 602 00 Brno (www.czechia.com), whose servers host the website, the online shop and the statistics tools.
- Website security – Wordfence (Defiant, Inc., USA) for protection against attacks and CleanTalk (CleanTalk Inc., 711 S Carson street, suite 4, Carson city, NV, 89701, USA) for protecting forms against spam. Your IP address and technical information about the request may be shared with these services.
- Accountant and tax adviser – Lenka Páralová, Bezručova čtvrť 807, Bojkovice 68771, Czech Republic.
- Google Ireland Limited – only if you allow marketing cookies and play a YouTube video or view a Google Map.
- Public authorities – where required by law (for example the tax authority or the Czech Trade Inspection Authority).
5. Transfers of data outside the European Union
We process data primarily within the European Union. Some providers (Google, PayPal, Stripe, Wordfence and possibly CleanTalk) may transfer data to the USA or other countries outside the EU. In such cases, your data are protected by a European Commission adequacy decision (the EU–US Data Privacy Framework), where the recipient participates in it, or by standard contractual clauses approved by the European Commission.
6. Cookies
Our website uses cookies. Strictly necessary cookies (for example for the shopping cart, logging in, language selection, payments and security) are set without your consent. Statistics and marketing cookies are set only with your consent, which you give and can change at any time in the cookie banner via the “Manage consent” link at the bottom of the page.
A detailed overview of all cookies, their purpose and duration is available in our separate Cookie Policy.
7. Your rights
You have the following rights regarding the processing of your personal data:
- Right of access – you can ask us what data we process about you and obtain a copy.
- Right to rectification – you can ask us to correct inaccurate data or complete incomplete data.
- Right to erasure – you can ask us to delete your data if we no longer have a reason to process them. We cannot delete data we are required by law to keep (for example on tax documents).
- Right to restriction of processing – you can ask us to only store your data temporarily, for example while their accuracy is being verified.
- Right to data portability – we can provide the data processed on the basis of a contract or consent in a structured, machine-readable format, or transfer them to another controller.
- Right to object – you can object to processing based on legitimate interest. You can object to receiving commercial communications at any time, and we will stop sending them.
- Right to withdraw consent – you can withdraw your consent at any time by e-mail to info@houpacikun.cz, and for cookies via “Manage consent”. Withdrawal does not affect the lawfulness of processing before the withdrawal.
- Right to lodge a complaint – with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz, or with the data protection authority in the EU country where you live or work.
You can exercise your rights by e-mail to info@houpacikun.cz or in writing to our correspondence address. We will reply without undue delay and within one month at the latest. Exercising your rights is free of charge. To make sure we do not disclose data to the wrong person, we may ask you to verify your identity.
8. Automated decision-making and profiling
We do not use automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.
9. Data security
We protect your data with appropriate technical and organisational measures: the website uses encrypted communication (HTTPS), customer account passwords are stored in encrypted form, access to the data is limited to the controller and to persons who strictly need it, and the website is protected by a security firewall.
10. Changes to this policy
We may update this policy, for example when the services we use or the applicable legislation change. The current version is always published on this page.
This policy is effective from 5. 10. 2026.