Privacy Policy

This is an English translation provided for information. The Czech version is legally binding.

This privacy statement describes how we handle the personal data we obtain from you when you shop in the e-shop at https://idcshop.cz. We act in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 110/2019 Coll., on the Processing of Personal Data.

Personal data controller

ACES Services spol. s r.o.

Company ID (IČO): 27242471
VAT ID (DIČ): CZ27242471
Registered office: Za Nadýmačem 1130/13, Uhříněves, 104 00 Praha 10
Registered in the Commercial Register kept by the Municipal Court in Prague, file number C 107062
E-mail: info@idcshop.cz
Phone: +420 728 007 516

(hereinafter the "controller")

The controller has not appointed a data protection officer; such an appointment is not mandatory under Article 37 GDPR, as our company carries out neither large-scale systematic monitoring nor large-scale processing of special categories of data.

What personal data we process

When you make a purchase, we process the following categories of personal data:

Identification data:

first name and surname
for businesses: business name, company ID (IČO), VAT ID (DIČ)

Contact data:

e-mail address
telephone number
billing address
delivery address (if different from the billing address)

Order and payment data:

list of goods ordered, including prices and quantities
details of the payment made (date, amount, variable symbol; for card payments we do not process card numbers — you enter them directly into the Comgate payment gateway)
history of communication with us

Customer account data:

cart contents, favourite and compared products (so that they are the same on all your devices), product alerts, date of registration and last login

Technical data:

IP address, browser data — only to the extent necessary to operate the e-shop
3. Purpose and legal basis of processing
Purpose of processing Legal basis Retention period
Order handling (conclusion and performance of the purchase contract, delivery of goods, communication about the order) Performance of a contract (Art. 6(1)(b) GDPR) For the duration of performance + 4 years
Accounting and tax obligations (invoices, purchase documents) Legal obligation (Art. 6(1)(c) GDPR) 10 years under the VAT Act and the Accounting Act
Complaints and exercise of rights arising from defective performance Performance of a contract and legal obligation For the duration of the warranty period + 4 years
Marketing communication (newsletter) Consent (Art. 6(1)(a) GDPR) Until consent is withdrawn, max. 5 years without interaction
Saving the cart, favourites and comparisons to the account Performance of the customer account contract (Art. 6(1)(b) GDPR) For as long as the account exists
Personalisation (only with consent) Consent (Art. 6(1)(a) GDPR) 12 months; after consent is withdrawn, we delete the data within 30 days
Protection of legal claims Legitimate interest (Art. 6(1)(f) GDPR) For the duration of the limitation periods

We send the newsletter only on the basis of your express consent. You can unsubscribe at any time by clicking the link in the footer of the e-mail or by writing to info@idcshop.cz.

Who we share your data with

We share your personal data with the following categories of recipients who help us operate the e-shop:

Payment gateway — Comgate a.s., Company ID 27924505 (payment institution licensed by the Czech National Bank). To process the payment, we pass on the amount, e-mail and name; you enter your payment card details directly with Comgate and they never reach us. For the purposes of executing the payment, Comgate acts as an independent controller.
Database and file hosting — Supabase, Inc. (server in the European Union — Frankfurt, Germany)
Website hosting — Vercel, Inc. (server in the European Union)
Transactional e-mail delivery — Resend, Inc. (server in the European Union — Ireland)
Shipping and dispatch services — the courier company according to the chosen delivery method; for goods dispatched directly from our supplier's warehouse, we pass on to the supplier and the carrier only the name, delivery address and telephone number necessary for delivery
Accounting — external accountant (we pass on only the data necessary to issue and book invoices)

All processors are bound by confidentiality and by contractual obligations in accordance with the GDPR.

Transfers outside the EU

Personal data are not transferred outside the European Union. All of our processors' servers are located within the EU.

Your rights

Under the GDPR, you have the following rights:

Right of access to data (Art. 15 GDPR) — to know what data we process about you and how.
Right to rectification (Art. 16) — you may request the correction of inaccurate data.
Right to erasure / "right to be forgotten" (Art. 17) — you may request the erasure of data if they are no longer needed for the purpose for which they were processed or if the processing was unlawful. Please note: we are required by law to retain certain data (see Article 3).
Right to restriction of processing (Art. 18).
Right to data portability (Art. 20).
Right to object to processing based on legitimate interest (Art. 21).
Right to withdraw consent to processing (Art. 7) — at any time and without affecting the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint with the supervisory authority — Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, uoou.cz.

To exercise your rights, contact us at info@idcshop.cz or by phone at +420 728 007 516. We will reply within 30 days at the latest (this may be extended by 60 days in more complex cases).

Cookies and similar technologies

Our website uses cookies and similar technologies (e.g. localStorage in the browser). We divide them into four categories:

Necessary cookies (always active)

The website does not work without them — they keep you logged in and keep the cart contents, the selected language and your preferences (e.g. light/dark mode). These cookies do not require consent under § 89 of Act No. 127/2005 Coll., on Electronic Communications, and do not process personal data for marketing.

Specifically, we use:

sb-...-auth-token (Supabase) — keeps the logged-in session.
idc-admin-locale — language of the administration interface (staff only).
idc-consent — your choice regarding cookies (this banner).
idc-theme, idc-configurator-v1, cart in browser storage — appearance, build in progress and cart contents.
Statistics

We measure shop traffic with our own tool, without cookies and without storing anything on your device. To us, a visitor is only an anonymous daily fingerprint (random key + IP address + browser type), which changes every midnight and from which the IP address cannot be recovered; we do not store the IP address. We track pages viewed, traffic source, country, device type, search terms and progress through the purchase. We keep detailed data for 90 days and daily summaries permanently. This measurement does not require consent (it does not involve storing information on your device within the meaning of § 89 of the Electronic Communications Act).

If you allow the Statistics category, we additionally use Google Analytics 4 (Google Ireland Ltd.) with the cookies _ga and ga*; without your consent, the Google script is not loaded at all. In addition, Vercel Web Analytics runs in cookieless mode without identifying visitors.

Personalisation (off by default)

If you are logged in and allow the Personalisation category, we link your visits to your customer account: when you were on the website, which pages and products you viewed, what you searched for, where you came from and on which page you left, and your approximate city based on your IP address (we do not determine your precise location and we do not store the IP address). Purpose: to advise you better, remind you of an unfinished purchase and improve our offering. Legal basis: your consent (Art. 6(1)(a) GDPR). The data are visible only to our staff and we do not pass them on to advertising networks. We keep them for 12 months. You can withdraw your consent at any time in Cookie settings in the footer; we will then delete the linked visits within 30 days at the latest.

Marketing

Cookies for ad personalisation and retargeting (e.g. Facebook Pixel, Sklik, Google Ads). We currently do not use any marketing scripts. If you allow this category in advance and we add them in the future, they will be governed by your consent.

How to change your choice

After your first consent, we remember your choice for 12 months. You can change it at any time via the "Cookie settings" link in the footer of every page, or by deleting the idc-consent cookie in your browser.

Security

We protect your data by:

an encrypted connection (HTTPS / TLS) for communication between the browser and the server,
encryption of the database at rest,
restricting access to authorised staff only,
regular software updates and monitoring of security incidents.

We never store passwords in readable form. Payment card data are processed exclusively by the Comgate payment gateway (PCI DSS certified).

Contact

For any questions regarding the processing of personal data, please contact us:

E-mail: info@idcshop.cz
Phone: +420 728 007 516
Post: ACES Services spol. s r.o., Za Nadýmačem 1130/13, Uhříněves, 104 00 Praha 10

Changes to this statement

We may update this privacy statement from time to time. We will inform you of material changes by e-mail or by a notice on the website. The date of the last update is shown below the heading of this page.