Privacy Policy

1. What data we process, and why

1.1 Purchase data (payment via Stripe). When completing an Order, you enter payment and delivery details directly on a secure payment page operated by Stripe, Inc. (name, delivery address, email address, optionally a phone number, and payment details). Stripe processes this data primarily as an independent controller, under its own privacy policy (stripe.com/privacy). We receive from Stripe the information necessary to fulfil your Order — in particular payment confirmation, the Goods ordered, your delivery address, and your email — and process it to perform the Contract (GDPR Art. 6(1)(b)) and to meet our legal obligations, in particular tax and accounting ones (GDPR Art. 6(1)(c)). We retain this data for 10 years from delivery of the Goods, in line with statutory accounting record-keeping periods.

1.2 Email correspondence and enquiries ("Inquire"). If you contact us by email — including via the "Inquire" link on an item marked "on request", which opens your own email client with a pre-filled message addressed to us — we process the information you provide (typically your name, email address, and message) in order to reply and, where relevant, agree terms of sale. This mailbox is hosted by Google Ireland Limited (Gmail) — see section 2. The legal basis is GDPR Art. 6(1)(b) — pre-contractual steps taken at your request. We keep this data for no longer than 2 years from our last communication, unless a Contract is concluded, in which case the period in section 1.1 applies.

1.3 Cookies — see section 4.

2. Who receives your data

We share your data, only to the extent necessary, with the following processors and recipients:

— Stripe, Inc. — payment processing and related delivery/contact data (see section 1.1).

— Our website infrastructure provider — Cloudflare, Inc. (hosting, content delivery).

— Google Ireland Limited — the mailbox (Gmail) we use to communicate with you (see section 1.2).

— Google Ireland Limited — Google Analytics 4, only if you consent to analytics cookies (see section 4).

— An external accountant — for bookkeeping and tax compliance.

— Legal counsel — where necessary to resolve a dispute.

We process personal data within the European Union, or, for processors established outside the EU, only where an adequate level of protection is ensured through standard contractual clauses (this applies in particular to Stripe and Google).

3. Your rights

Under the GDPR you have the right to ask us for access to your personal data, its correction, erasure, or restriction of processing, the right to data portability, and the right to object to processing based on our legitimate interest. You can exercise these rights by emailing alexandra.sashfashion@gmail.com or calling +420 773 560 512.

We have not appointed a data protection officer. We do not carry out automated decision-making or profiling.

If you believe we are not handling your data correctly, you have the right to lodge a complaint with the Czech Office for Personal Data Protection (uoou.cz), or to bring a claim before a court.

4. Cookies

Cookies are small text files stored on your device when you visit the site. On your first visit we ask whether you allow analytics cookies — no cookies beyond those strictly necessary for the site to function are set without your consent.