Privacy Policy
HEIPE s.r.o., with its registered office at Kurzova 2246/4, Stodůlky, 155 00 Prague, Company ID No.: 24269875, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File No. 199406 (hereinafter referred to as the “Controller”), hereby, in accordance with the provisions of Article 12 et seq. Regulation (EU) 2016/679 of the European Parliament and of the Council, effective as of May 25, 2018, hereby informs its customers about the processing of their personal data when they use its services.
Personal Data
The Controller will process the following personal data:
- First and last name,
- address,
- phone number,
- email address,
- for business entities, Company ID and Tax ID (hereinafter referred to as “personal data”)
Purpose of Processing
The purpose of processing personal data is to fulfill the controller’s legal obligations arising from the terms of the contract concluded between you as the buyer and the controller as the seller, and to fulfill the controller’s legal obligations arising from generally applicable legal regulations.
Recipients of Personal Data
Personal data processed to fulfill the controller’s obligations under specific legal regulations may, in justified cases, be disclosed to law enforcement authorities. The controller may also disclose the personal data you provide to the following entities:
- the carrier you choose for order delivery (PPL, Česká pošta, Zásilkovna, GLS, DHL);
- the operator of the ThePay payment gateway and the bank where the controller maintains its account (Fio banka, a.s.), in the case of cashless payments;
- the e-shop platform and hosting provider (WPJ), which ensures the technical operation of the website;
- the accounting and tax firm that handles the controller’s accounting and tax matters.
The legal basis here is the fulfillment of obligations arising from a contract concluded with the data subject, as well as the legitimate interests of the controller or a third party. No personal data belonging to the category of special categories of personal data is transferred.
Obligation to Provide Personal Data
It is necessary to provide personal data to the controller for the purpose of fulfilling the rights and obligations arising from the terms of the concluded contract.
Processing Period
Personal data may be processed by the controller for the period necessary to fulfill the rights and obligations arising from the concluded contract, or for the period strictly necessary to resolve disputes arising from the concluded contract.
Information for Data Subjects
HEIPE s.r.o. informs its customers that they have the right to:
- to obtain confirmation from the Controller as to whether or not personal data concerning them is being processed, and if so, they have the right to access such personal data and the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; the planned period for which the personal data will be stored, or, if this cannot be determined, the criteria used to determine that period, the existence of the right to request from the controller the rectification or erasure of personal data concerning the data subject or the restriction of their processing, and the right to object to such processing, as well as the right to lodge a complaint with a supervisory authority.
- that the Controller rectify, without undue delay, any inaccurate personal data concerning them. Taking into account the purposes of the processing, they have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
- to have the Controller erase personal data concerning them without undue delay, and the Controller is obligated to erase personal data without undue delay if one of the following grounds applies: the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; the customer withdraws consent and there is no other legal basis for their processing; the personal data has been processed unlawfully; the personal data must be erased to comply with a legal obligation under Union or Member State law to which the Controller is subject.
- that the Controller restrict the processing of their personal data if they contest its accuracy, for the duration of the Controller’s verification of this fact; if the processing is unlawful, and they request restricted processing instead of erasure; the data are no longer necessary for the purpose of processing, but they are needed to establish, exercise, or defend legal claims;
- that the Controller, upon their request, transfer their personal data to another Controller designated by them.
- to object to the processing of their personal data by the Controller.
- In case of doubt as to whether the Controller is processing their personal data within the meaning of the above-mentioned legal regulations, to contact both the Controller and the Office for Personal Data Protection
This policy is effective as of October 1, 2026.