PRIVACY POLICY
Alchymist, s.r.o., Company ID No. 25149148, with its registered office at Vlašská 24, 118 00 Prague 1, Czech Republic, as the operator of the online shop www.alchymist-shop.cz, processes personal data of customers and other users of the Online Shop in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”) and Czech Act No. 110/2019 Coll., on the Processing of Personal Data.
This Privacy Policy explains what personal data we process, for what purposes and on what legal basis, to whom the data may be disclosed and what rights individuals have in relation to the processing of their personal data.
1. DATA CONTROLLER
The controller of personal data within the meaning of Article 4(7) GDPR is:
Alchymist, s.r.o.
Company ID No.: 25149148
Registered office: Vlašská 24, 118 00 Prague 1, Czech Republic
Email: eshop@alchymistgroup.com
Telephone: +420 257 286 011
For the purposes of this Privacy Policy, Alchymist, s.r.o. is referred to as the “Controller”.
Personal data means any information relating to an identified or identifiable natural person.
2. PERSONAL DATA WE PROCESS
In connection with the operation of the Online Shop, we may process in particular:
– first and last name,
– billing and delivery address,
– email address,
– telephone number,
– information about an Order, purchased Product, service or gift voucher,
– gift voucher number or other identifier,
– information required for processing and recording payments,
– information relating to complaints or withdrawals from a Contract,
– information contained in communications with us,
– technical information relating to the use of the Website where processed through cookies or similar technologies.
The Controller does not process full payment card details to the extent that such information is processed directly by the relevant payment service provider.
3. SOURCES OF PERSONAL DATA
We obtain personal data primarily directly from customers:
– when an Order is created and submitted,
– when an Order is paid for or delivered,
– when a purchased service is booked or used,
– when a gift voucher is redeemed,
– when a complaint or withdrawal from a Contract is submitted,
– when communicating with customer support,
– where consent is given for the use of analytics or marketing technologies.
Certain technical information may be collected automatically when the Website is used, in particular through cookies where their use has been permitted.
4. PURPOSES AND LEGAL BASES OF PROCESSING
4.1 Processing Orders and Performing Contracts
We process personal data for the purposes of receiving and processing Orders, issuing and delivering gift vouchers, delivering physical goods, providing ordered services, making reservations, communicating with customers, processing payments, and handling withdrawals and complaints.
The legal basis for this processing is Article 6(1)(b) GDPR – performance of a Contract or steps taken prior to entering into a Contract.
Providing the personal data necessary to process an Order is a contractual requirement. Without such data, it will generally not be possible to process the Order or perform the Contract.
4.2 Compliance with Legal Obligations
We process certain personal data in order to comply with obligations arising in particular from accounting, tax and consumer protection legislation.
The legal basis is Article 6(1)(c) GDPR – compliance with a legal obligation to which the Controller is subject.
4.3 Protection of Rights and Legitimate Interests
Where necessary, we may process personal data for the establishment, exercise or defence of legal claims, dispute resolution, prevention of misuse of our services and protection of our legitimate interests.
The legal basis is Article 6(1)(f) GDPR – the legitimate interests of the Controller.
4.4 Direct Marketing
Subject to applicable law, we may use electronic contact details of our existing customers to send commercial communications concerning our own similar Products or services.
The legal basis for processing personal data for this purpose is the legitimate interests of the Controller under Article 6(1)(f) GDPR.
Customers have the right to object to the processing of their personal data for direct marketing purposes at any time and free of charge, in particular by using the unsubscribe link included in each commercial communication.
Where prior consent is required by applicable law, commercial communications will only be sent on the basis of such consent.
4.5 Analytics and Marketing Cookies
Where analytics or marketing cookies or similar technologies that are not necessary for operation of the Website are used, they are used only on the basis of the user’s consent where such consent is required by applicable law.
Consent may be changed or withdrawn at any time through the Website’s cookie settings.
5. RETENTION OF PERSONAL DATA
We retain personal data only for as long as necessary for the purposes for which it is processed.
Data relating to an Order and contractual relationship is retained for the duration of the contractual relationship and subsequently for the period necessary to protect and exercise legal claims.
Accounting, tax and other documents containing personal data are retained for the periods required by applicable law.
Personal data processed for direct marketing purposes is processed until the customer objects to such processing or unsubscribes from commercial communications.
Personal data processed on the basis of consent is processed until the consent is withdrawn or for any other period specified when the consent was obtained.
Once the relevant retention period has expired, personal data is deleted or anonymised unless further retention is required by law.
6. RECIPIENTS AND PROCESSORS OF PERSONAL DATA
Personal data may be disclosed, to the extent necessary to entities providing technical, payment, delivery, analytics or other services related to the operation of the Online Shop.
These entities include in particular:
– VIRTUAL ZOOM s.r.o., Company ID No. 26744333 – technical solution, operation and administration of the Online Shop and gift voucher system;
– Global Payments s.r.o., Company ID No. 04235452, V Olšinách 626/80, 100 00 Prague 10 – Strašnice, Czech Republic – provision of the payment gateway and processing of cashless payments;
– Česká pošta, s.p. – delivery of physical shipments where this service is used;
– Google Ireland Limited – Google Analytics – Website traffic analytics where the user has provided the relevant consent to analytics cookies;
– providers of accounting, IT, hosting or other support services where the provision of such services involves the processing of personal data.
Where a service provider acts as a processor of personal data, it processes personal data only to the extent necessary to provide the relevant service and in accordance with the GDPR.
When payment is made by card, payment card details are processed through the secure payment environment of the payment service provider. The Controller does not process full payment card details to the extent that such data is processed directly by the payment service provider.
7. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA
Personal data is not routinely transferred outside the European Economic Area unless such transfer is necessary in connection with the use of a particular service provider.
Where the use of a service involves the transfer of personal data outside the European Economic Area, such transfer takes place only in accordance with the GDPR and using appropriate mechanisms ensuring an adequate level of protection for personal data.
8. DATA SUBJECT RIGHTS
Subject to the conditions laid down in the GDPR, you have in particular the right to:
– obtain confirmation as to whether we process your personal data and access such data,
– request correction of inaccurate or incomplete personal data,
– request deletion of personal data where the statutory conditions are met,
– request restriction of processing,
– data portability in the cases specified by the GDPR,
– object to processing based on legitimate interests,
– object at any time to processing of personal data for direct marketing purposes.
Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
You may exercise your rights by contacting:
eshop@alchymistgroup.com
You also have the right to lodge a complaint with:
Office for Personal Data Protection of the Czech Republic
Pplk. Sochora 27
170 00 Prague 7
Czech Republic
www.uoou.gov.cz
9. SECURITY OF PERSONAL DATA
The Controller has implemented appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, loss, destruction, damage, unauthorized access or disclosure.
Access to personal data is restricted to people who require such access for the performance of their employment or contractual duties and who are subject to confidentiality obligations.
10. COOKIES
The Website uses technical cookies necessary for its proper operation.
Analytics, marketing and other non-essential cookies are used only in accordance with applicable law and on the basis of the user’s consent where such consent is required.
Further information about the cookies used and the option to change or withdraw consent are available through the Website’s cookie settings.
11. FINAL PROVISIONS
A Buyer is not required to give consent to the processing of personal data that is necessary for processing an Order, performing a Contract or complying with the Controller’s legal obligations.
Before submitting an Order, the Buyer is given the opportunity to review this Privacy Policy.
The Controller may update this Privacy Policy from time to time. The current version is always available at www.alchymist-shop.cz.
This Privacy Policy is effective from 7 October 2026.