Privacy policy

1. Controller and contact

The controller of your personal data is Luxi Luxi s.r.o., with its registered office at Školská 660/3, Nové Město, 110 00 Praha 1, Czech Republic, Company ID (IČO) 23774321, Tax ID (DIČ) CZ23774321, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, File 432736.

For anything concerning your personal data, write to info@luxiluxi.com.

2. What data we process and why

• Processing orders and delivering goods

  Data

  name, email, phone (if provided), delivery and billing address, company, company ID and tax ID (if provided), order contents, prices, your order note (if provided), chosen shipping and payment status

  Legal basis

  performance of a contract (Art. 6(1)(b) GDPR)

  Retention

  the order for 5 years from the end of the accounting period in which it was concluded (this also covers claims under the contract and for defective goods), and longer where the tax assessment period requires it, up to 10 yearsan unfinished shopping cart (email, addresses, payment details) for 90 days from its last change, after which we delete it

• Payment

  Data

  we pass your email, name, phone (if provided), country, amount, currency and order number to the Comgate payment gateway and receive only a payment identifier and status. We neither see nor store your card number.

  Legal basis

  performance of a contract

  Retention

  together with the order; details of an unfinished payment are deleted with the unfinished cart after 90 days

• Accounting and taxes

  Data

  details on the invoice: name or company, address, company ID, tax ID, subject and price of the supply

  Legal basis

  compliance with a legal obligation (Art. 6(1)(c) GDPR), in particular under the Czech Accounting Act and Tax Procedure Code

  Retention

  for the periods set by these laws: accounting documents for 5 years from the end of the accounting period, and longer where the tax assessment period requires it, up to 10 yearsthe data of an invoice request in the shop for 3 years; the copy of the invoice PDF for download in your account for 1 year, after which it is fetched from our accounting system when you download it

• Handling the order in our internal task system

  Data

  for every paid order: recipient name, email, phone, delivery address or pickup point, billing details (company, company ID, tax ID, if provided), items with variants and prices, shipping, payment, your order note and the order number; we pass these to our internal task system, in which we prepare and ship the order

  Legal basis

  performance of a contract (Art. 6(1)(b) GDPR); after the order is handled, our legitimate interest in keeping a record of orders and proving performance (Art. 6(1)(f) GDPR) and compliance with accounting and record-keeping obligations (Art. 6(1)(c) GDPR)

  Retention

  10 years from the order; erasure on request does not apply while a legal obligation to keep the data lasts (Art. 17(3)(b) GDPR)

• Customer account and sign-in

  Data

  email, name, phone, company, company ID, tax ID, addresses, order overview. You sign in with a one-time code we send to your email; a password is an optional second step that works only together with the code, and we store it only as a secure hash. One-time sign-in codes are stored only as a hash.

  Legal basis

  performance of a contract (keeping the account at your request)

  Retention

  until the account is closed; orders and invoices then as described above. A sign-in code is valid for 10 minutes; the content of the message with the code is erased within minutes after expiry, and records of attempts (hashes of email and IP address only) within 24 hours. A password is deleted as soon as you remove it in your account (or our support removes it at your request), at the latest when the account is closed.

• Transactional emails

  Data

  email, language and message content: sign-in code, order confirmation, invoice, information about booked shipping and dispatch

  Legal basis

  performance of a contract

  Retention

  the content of the message and the recipient address for 3 years from creation, an attached invoice PDF in the message record for 30 days after sendinga copy of every sent message (except sign-in codes) is kept in the shop's archive mailbox so that we can find an invoice and order correspondence; it has no fixed deletion period there and we delete it at your request unless the law requires us to keep itmessages with a sign-in code as described above

• Inquiries

  Data

  inquiry area, name, email, phone and company (if provided), message text, language, confirmation that you have read this policy and its version; for an order on request from the checkout also delivery and billing address, company ID and tax ID (if provided) and the cart contents with prices

  Legal basis

  steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR)

  Retention

  while the inquiry and follow-up negotiations are handled, no longer than 2 years from the last change; if a contract is concluded, the data moves to the order or contract

• News by email

  Data

  name and email, if you tick in the inquiry form that you want to receive news

  Legal basis

  consent (Art. 6(1)(a) GDPR and Czech Act No. 480/2004 Coll.)

  Retention

  until you withdraw your consent. We are not sending news yet; we record your consent and will update this policy before the first mailing.

• BOB guide

  Data

  the text of your question, which we process only to create an answer. We do not store or log questions. BOB currently answers from built-in public information, without any connected artificial intelligence model. Please do not enter personal data, passwords, codes or payment details in the chat.

  Legal basis

  legitimate interest in providing help with the store (Art. 6(1)(f) GDPR)

  Retention

  not stored

• Page view counting

  Data

  without cookies or an identifier: how many times each page of the store was viewed and how many times someone arrived on it from another website or directly. We store only daily and monthly totals per page (address without parameters) and language. We use the IP address and technical request data (browser type, where you came from) only at the moment the page is viewed, to leave out bots and to protect the counter against flooding, and we do not store them. We store nothing on your device.

  Legal basis

  legitimate interest in measuring visits to our own website (Art. 6(1)(f) GDPR); the stored totals are not personal data and cannot be linked to you

  Retention

  IP address only in server memory as a hash, for a few minutes at mostdaily totals for 400 days, monthly totals without limit

• Visitor statistics with consent

  Data

  only with your consent: event type (page view, product view, add to cart, time and scroll depth on a page), page type, language and, where relevant, product. No statistics cookies, no visitor identifier, no IP address and no form contents.

  Legal basis

  consent

  Retention

  individual events for 30 days, after which they are deleted automaticallybefore that we turn them into anonymous daily and monthly counts (by event type, page, language and product, without a visitor identifier or IP address), which we keep without limit; they cannot be linked to you

• Security and abuse prevention

  Data

  IP address only briefly and as a hash, to limit the number of attempts (code sign-in, statistics, BOB); technical server records

  Legal basis

  legitimate interest in operating the store securely

  Retention

  hashes for code sign-in for no more than 24 hours, for statistics and BOB only in server memorytechnical server records (logs) for no more than 14 days; encrypted database backups for 30 days

• Establishing and defending legal claims

  Data

  order, payment and communication data relevant to the dispute

  Legal basis

  legitimate interest

  Retention

  for the limitation periods and the duration of any proceedings

We need the data marked as required to conclude and perform the contract; without it we cannot process your order or inquiry. Other data is optional.

We do not carry out automated decision-making or profiling that would have legal effects on you.

3. Who we share data with

We share data only to the extent necessary for the given purpose:

• Comgate a.s. (Company ID 27924505) — payment gateway; it processes the payment and your card details as a payment service provider,
• Zaslat.cz and the carrier you choose — to calculate the shipping price we pass only the delivery country, city, postcode and street, without your name or contacts; to book the shipment we pass the name, delivery address, phone and email the carrier needs for delivery,
• email service provider (FORPSI, INTERNET CZ, a.s.) — delivery of transactional emails,
• the provider of the server infrastructure the store runs on, and the provider of the cloud storage where we archive issued invoices,
• GitHub, Inc. — storage of our internal task system; to handle the order we pass the order details to it (see “Handling the order in our internal task system”)
• public authorities where required by law.

We do not sell personal data. We choose processors that protect data at least as well as we do. If any of them processes data outside the European Union or the European Economic Area, this happens only under the conditions of Chapter V GDPR (for example, on the basis of a European Commission adequacy decision or standard contractual clauses).

4. Cookies

We use only our own cookies that are necessary to run the store and to remember your choices. Details in Cookies.

5. Security

The store communicates over an encrypted connection. Passwords and sign-in codes are stored only as hashes, the sign-in token is kept in a cookie that scripts on the page cannot read, and card details are entered only on the Comgate gateway. Only authorised people who need the data for their work and are bound by confidentiality have access to it.

6. Your rights

You have the right:

• to access your personal data and obtain a copy,
• to have inaccurate data corrected and incomplete data completed,
• to erasure if we no longer need the data or process it unlawfully; data we must keep by law (such as invoices and accounting records) cannot be erased,
• to restriction of processing,
• to portability of data we process on the basis of a contract or consent,
• to object to processing based on legitimate interest,
• to withdraw consent at any time; withdrawal does not affect processing before it,
• to lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic (uoou.gov.cz).

Send requests to info@luxiluxi.com. We will handle them without undue delay and no later than within one month; in complex cases we may extend this period and will let you know. To avoid disclosing data to someone else, we may verify your identity, typically by a reply from the email address used for your account or order.

7. Changes to this policy

We update this policy when the way we process data changes (for example, when we connect a new service). The current version and its date are always on this page.