PRIVACY POLICY

Effective from 2 November 2026

1. Data controller

The controller of your personal data is Easy Company s.r.o., Podolská 1487/8a, 147 00 Prague 4, Czech Republic; Company ID: 24250651; registered in the Commercial Register maintained by the Municipal Court in Prague, file C 197223 (“we” or the “Controller”). Contact: info@thegobi.eu, telephone +420 703 501 496. We have not appointed a data protection officer.

2. Personal data we process

Depending on your use of the store, we may process your name, contact details (postal and delivery address, email and telephone), order and payment details, shipping details, returns and complaints, customer-account information, communications with us and technical information about website use. When a payment is processed directly by a payment-service provider, we generally do not receive your complete card details, but only payment-confirmation and reconciliation information. Certain information is necessary to conclude and perform a purchase contract; without it, we may not be able to process an order.

3. Purposes and legal bases

• Purchases, payments, delivery, returns and accounts: steps before entering into a contract and performance of a contract (GDPR Article 6(1)(b)).
• Tax, accounting and other legal duties: compliance with legal obligations (Article 6(1)(c)).
• Complaints, legal claims, fraud prevention and security: our legitimate interests in protecting the store and enforcing our rights, where applicable (Article 6(1)(f)).
• Enquiries and customer communication: contractual necessity, pre-contractual steps or legitimate interests, as appropriate to the enquiry.
• Newsletters and direct marketing: your consent where required (Article 6(1)(a)), or the applicable exemption for marketing similar products to existing customers where lawful. You may object or unsubscribe at any time.
• Optional analytics and advertising technologies: consent where required for accessing information on your device and the related processing.

4. Retention periods

We retain personal data only for as long as required for its purpose, for legitimate claims or by law. Order data may be retained during the contractual relationship and the applicable limitation periods; accounting and tax records for statutory periods, in some cases up to 10 years; account data while the account exists and, where justified, for a limited period afterwards; consent-based data until consent is withdrawn or it is no longer needed; and direct-marketing details until you unsubscribe, object or the purpose ends.

5. Recipients

Where necessary, personal data may be shared with providers of hosting, e-commerce, IT and cloud infrastructure; payment providers and banks; carriers, collection points and logistics partners; accounting, tax and legal advisers; customer-support, email and marketing services; analytics and advertising providers where their use is lawful; and public authorities where required or permitted by law. These recipients may act as processors or independent controllers, depending on the service.

6. Transfers outside the EEA

Some suppliers or their sub-processors may process personal data outside the European Economic Area. If this occurs, we rely on a valid GDPR transfer mechanism such as an adequacy decision or appropriate safeguards, including the European Commission’s standard contractual clauses, as applicable. Further details can be requested using the contact details above.

7. Cookies and similar technologies

The website uses cookies and related technologies. Strictly necessary technologies may be used to provide the store, shopping basket, security and services you request. Non-essential analytics, preference or advertising technologies are subject to prior consent wherever required by law. Where a cookie-preference control is provided, it can be used to adjust or withdraw consent. You may also contact us about your privacy preferences. Withdrawal of consent does not affect processing lawfully carried out before withdrawal. Information about current technologies, providers and storage periods should be available through the website’s cookie information or preference interface.

8. Marketing communications

We may send newsletters with your consent. Where applicable law allows, we may also send existing customers offers for similar products, subject to an easy opt-out. Every marketing email provides an unsubscribe option. Unsubscribing does not prevent essential service messages about orders, complaints or other requests.

9. Your rights

Subject to the conditions under the GDPR, you have the right to access your personal data, obtain a copy, request correction or erasure, restrict processing, receive or transfer certain data, object to processing based on legitimate interests (including direct marketing), withdraw consent at any time and lodge a complaint with a supervisory authority. Contact us at info@thegobi.eu. We may reasonably verify your identity before responding.

10. Supervisory authority

You may lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz. Under the GDPR, you may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, workplace or the alleged infringement.

11. Automated decision-making

Unless specifically disclosed for a particular service, we do not make decisions based solely on automated processing which produce legal or similarly significant effects on you within the meaning of GDPR Article 22.

12. Security and updates

We implement technical and organisational measures appropriate to the nature of the data and the associated risks. We may update this Policy when our services, technologies or legal requirements change; the current version will be published on this website.