Last updated: 19 October 2026
This Privacy & Cookie Policy explains how Carbickova Crowns s.r.o. ("Carbickova Crowns", "we", "us" or "our") handles personal data when you visit www.carbickovacrowns.com, purchase products, contact us, subscribe to marketing communications or otherwise interact with our online store. It also explains how cookies and similar technologies are used and the choices available to you. Different privacy rights may apply depending on your location and our processing activities.
1. Who We Are and How to Contact Us
Data controller / seller: Carbickova Crowns s.r.o.
Registered office: MoskevskĆ” 640, 460 01 Liberec, Czech Republic
Company ID (IÄO): 10834184
VAT ID: CZ10834184
Email for privacy requests: hello@carbickovacrowns.com
Phone: +420 725 044 852
Website: https://www.carbickovacrowns.com
We generally determine why and how customer data is processed in connection with operating our store and are the controller for those activities. Service providers, including Shopify, may act as processors for certain activities and as independent controllers for others, as explained in their own privacy notices.
2. Personal Data We Collect
Depending on how you interact with our store, we may process:
- Contact and identity information: name, email, phone number, billing and delivery addresses, and company details if supplied.
- Order information: products and options selected, personalisation instructions, purchase history, order value, delivery status, returns, complaints and correspondence.
- Payment information: transaction status, selected payment method, payment identifiers and information needed for refunds or fraud prevention. Full payment-card details are normally handled by our payment service providers rather than stored by us.
- Account information: account identifiers and authentication-related details managed through Shopify or the account service being used. The precise sign-in method depends on the customer account configuration.
- Messages and voluntary content: enquiries, correspondence, product reviews and photos or other materials you voluntarily provide.
- Device and website usage data: IP address, approximate location derived from IP, device/browser information, pages viewed, referring pages, events such as views, add-to-cart and purchases, cookie IDs or similar identifiers, and consent preferences, where collected.
- Marketing preferences: whether you subscribed, opted out, clicked on an email or interacted with marketing, where lawful and technically enabled.
- Conversion-matching information: where permitted, customer-provided contact details such as an email address or telephone number may be processed in a hashed form for enhanced advertising conversion measurement. Hashing does not automatically make personal information anonymous.
Please do not send us unnecessary sensitive personal data, including health or biometric information. We do not intentionally solicit such information for ordinary orders.
3. How We Receive Data
We receive information directly from you when you place an order, complete checkout, use a customer account, sign up for our newsletter or contact us. We also receive transaction, payment and delivery updates from Shopify, payment providers and carriers. Website usage and advertising-related information may be collected through Shopify's systems and integrated analytics, marketing or advertising services, subject to applicable consent and privacy requirements. We may also receive information when you interact with our presence on a third-party platform; that platform's own privacy terms apply to its processing.
4. Why We Process Data and Our GDPR Legal Bases
For processing subject to the EU/EEA GDPR, we rely on the following legal bases as appropriate to the specific activity:
| Purpose | GDPR legal basis |
|---|---|
| Accept and fulfil orders, prepare personalised products, take payment, deliver parcels, answer order-related enquiries and administer lawful returns or complaints | Performance of a contract - Article 6(1)(b) |
| Keep required accounting, tax and transaction records; respond to lawful government requests | Legal obligation - Article 6(1)(c) |
| Protect our website and business, detect fraud, defend or establish legal claims and maintain essential service integrity | Legitimate interests - Article 6(1)(f), or legal obligation where applicable |
| Respond to general pre-sale enquiries and provide customer service not strictly required by an existing contract | Legitimate interests - Article 6(1)(f), or steps requested before entering into a contract - Article 6(1)(b) |
| Send newsletters and promotional messages | Consent - Article 6(1)(a), or another basis only where specifically allowed by applicable electronic-marketing law |
| Store or access non-essential analytics, advertising or personalisation identifiers on your device and process related data where consent is required | Consent - Article 6(1)(a), together with the applicable cookie/ePrivacy rules |
| Operate strictly necessary cookies and the technical functions required for checkout, cart, security and consent records | Contractual necessity or legitimate interests under Article 6(1)(b)/(f), as appropriate; the separate ePrivacy cookie exemption applies only where legally available |
Our legitimate interests include preventing fraud, maintaining a secure and reliable shop, communicating with customers, resolving disputes and improving ordinary business operations. We balance those interests against the rights and interests of affected individuals. We do not treat a general "legitimate interest" as a substitute for cookie consent when consent is required by law.
5. Operating the Store, Payments and Delivery
Our online store and checkout are provided by Shopify. In connection with browsing and purchasing, Shopify processes information needed to display products, maintain carts, run checkout, support orders and operate its infrastructure. Payment processing is handled by the payment providers offered at checkout, including Shopify Payments where available; applicable providers may collect and process the payment information required to complete transactions and prevent fraud.
To send orders, we may share the recipient's name, address, telephone number, shipment details and any necessary customs information with carriers such as DHL Express, ÄeskĆ” poÅ”ta and DPD, depending on the selected destination and delivery method. Customs authorities and their appointed agents may also receive required shipping declarations. We share only information needed for these purposes.
6. Email, Newsletters and Customer Communication
We use Klaviyo to support email marketing, mailing-list management and related communications. Where consent is required, subscribing to promotional emails is a voluntary, affirmative choice; our checkout marketing sign-up is not pre-selected. If you subscribe, we may use your email address, subscription record and relevant engagement or purchase data to send marketing you agreed to receive, subject to applicable legal rules. You can unsubscribe through the link in marketing emails or by contacting us. We may still send essential order, payment or delivery messages that are not marketing and are necessary to fulfil your order or comply with law.
If we use customer chat or messaging tools provided through Shopify or another integrated service, the content of your request and contact details may be processed to answer you. We do not treat an order or service email as automatic permission to receive unrelated marketing.
7. Analytics, Advertising and Website Integrations
We use Shopify Analytics to understand store activity and performance. Our advertising and measurement integrations include Google Analytics 4 (GA4), Google Ads, Meta (Facebook and Instagram) and Pinterest. Depending on applicable consent and opt-out choices, these services may process online identifiers, product views, cart actions, purchases and advertising interactions for performance measurement, conversion attribution, audience selection and relevant advertising.
Google Ads enhanced conversions are enabled. Where permitted, information that customers provide, such as an email address or telephone number, may be normalised and hashed to help match a conversion with a Google account. Hashing is a protective measure, not anonymisation. The actual data shared depends on the relevant integration and permitted choices.
Our Meta integration includes browser-based and server-side event measurement. A server-side event may involve personal information and remains subject to applicable consent and opt-out rules; the absence of a browser cookie alone does not authorise unrestricted transmission. Pinterest advertising measurement is also configured through Shopify and may receive website events or online identifiers for attribution and advertising purposes where permitted.
We also use store integrations supporting product feeds, reviews, content and advertisements, including FeedHub, Socioh, Reviewsion, Bloggle, Qikify Product Options and Instafeed. The amount and type of data available to each provider depend on the features and permissions actually used. Installing an app does not necessarily mean that it places tracking cookies on your device.
Where analytics, advertising or personalisation technologies require consent, they must not be activated for those purposes before the relevant valid consent is obtained. Depending on location and applicable law, you may also have a right to object or to opt out of targeted advertising.
8. Cookies and Similar Technologies
Cookies, local storage, pixels and similar technologies may store information on your device or recognise browser interactions. We use or may use the following categories, depending on the services and settings active at the time:
| Category | Purpose | Examples of providers |
|---|---|---|
| Strictly necessary | Maintain basket and checkout, authentication/session security, fraud prevention and recorded privacy choices | Shopify and essential store infrastructure |
| Functional / preferences | Remember optional preferences and improve selected website features | Shopify and integrated store apps where enabled |
| Analytics | Understand browsing and store performance and measure interactions | Shopify Analytics; Google Analytics 4 |
| Advertising / marketing | Measure advertising results, support remarketing and relevant campaigns, subject to lawful permissions | Google Ads; Meta; Pinterest; Klaviyo where its optional tracking features are used |
The specific cookies, providers, durations and related technologies vary according to active website functions, the visitor's region and privacy selections. You may request information about cookies used on our store at hello@carbickovacrowns.com.
Your cookie choices
Where consent is required, non-essential cookies and equivalent technologies are used only after you opt in to the relevant category. You should be able to accept, reject or customise non-essential purposes. Declining optional cookies does not prevent ordinary browsing and purchasing, although some optional features may be less personalised.
You can review, change or withdraw your cookie choices at any time using Cookie preferences in the footer of our website. The control reopens the Shopify cookie-preferences dialog. You can also contact hello@carbickovacrowns.com for assistance. Withdrawal does not affect lawful processing that took place before withdrawal. You can delete or block cookies in your browser, but browser settings alone may not cover all tracking technologies or privacy rights.
For visitors where EU/EEA/UK rules apply, silence, closing the banner or continuing to browse is not treated as affirmative consent to non-essential cookies.
9. Who We Share Data With
We share relevant personal data with service providers and other recipients where needed for purposes described in this policy, including:
- Shopify - ecommerce platform, hosting, orders, checkout, Network Intelligence and Enhanced Services, subject to applicable choices.
- Payment service providers - payments, payment security, refunds and fraud prevention.
- Carriers, customs authorities and logistics partners - delivery and international shipping compliance.
- Klaviyo - newsletter subscriptions and email marketing where authorised.
- Google, Meta and Pinterest - permitted website analytics, advertising measurement (including enabled Google enhanced conversions and configured Meta server-side event measurement), targeting and campaign operations, depending on the integrations and applicable consent/opt-out choices.
- Other installed store apps - limited functions such as product customisation, reviews, feeds, content or store support, depending on their roles and access permissions.
- Accountants, legal advisers, IT providers and authorities - where necessary for service provision, legal obligations or protecting rights.
We do not rent or trade identifiable customer mailing lists to unrelated companies for a cash payment. However, under some US privacy laws, certain transfers of online identifiers to advertising partners can legally be considered a "sale", "sharing" or "targeted advertising" even when no money changes hands. Applicable rights and opt-out controls are described below.
10. Shopify Processing and Network Intelligence
Our online store is hosted by Shopify. Shopify Network Intelligence is enabled for our store. Shopify processes information about interactions with our store and, as part of its Enhanced Services, may use information about interactions with other merchants and Shopify to support services such as personalisation, advertising and measurement. These activities are subject to applicable consent requirements, opt-out rights and other privacy protections. This does not mean that other merchants are given direct access to our customer records.
Shopify may process data internationally, including through providers in other countries, subject to applicable data-transfer protections. Please read the Shopify Consumer Privacy Policy for details of Shopify's role and the Shopify Privacy Portal for privacy rights and controls relating to Shopify's own processing. You can also contact us at hello@carbickovacrowns.com for requests relating to our store.
11. International Transfers
Our customers are international, and some providers process personal data outside the Czech Republic, the EU or the EEA, including in Canada, the United States and other countries in which they or their subprocessors operate. Depending on the recipient and transfer, safeguards may include an applicable EU adequacy decision (including an eligible adequacy framework), European Commission Standard Contractual Clauses and additional measures where legally necessary. The specific safeguards depend on the relevant recipient, destination and contractual arrangements. You may request information about relevant safeguards by contacting us.
12. How Long We Keep Data
We keep information for as long as reasonably needed for the specific purpose, subject to legal requirements and our legitimate need to resolve disputes and enforce rights. Retention depends on the type of information:
- Tax, VAT and accounting documents: for the period required by the applicable Czech legal rules; certain VAT documents generally require retention for 10 years.
- Order, delivery, return and complaint records: for fulfilment, complaint handling and relevant statutory limitation or warranty periods, and longer where legal claims or legal requirements justify it.
- Customer accounts: while the account remains in use and for a reasonable period thereafter, unless an earlier deletion is required or a legal retention obligation applies.
- Marketing subscriptions: until you unsubscribe or withdraw the relevant consent, while retaining a limited suppression/consent record where necessary to respect your choice and demonstrate compliance.
- Customer correspondence: for the time needed to answer and follow up on the matter, and where necessary for legal claims.
- Cookies and online identifiers: according to each technology's purpose and configured lifetime; individual lifetimes depend on the technologies and service settings used.
Where appropriate, information is deleted, anonymised or otherwise restricted after the relevant period. If you request deletion, some records may still need to be retained for legal reasons.
13. Data Security
We use reasonable technical and organisational safeguards designed to protect personal data, including access controls, secure connections and reliance on Shopify and other providers' security features. No online system can be guaranteed completely secure. Please contact us promptly if you believe your information relating to our store has been misused.
14. Your Rights under EU/EEA GDPR
Where the GDPR applies, and subject to the applicable conditions and exceptions, you may have the right to:
- request access to your personal data;
- request correction of inaccurate information;
- request erasure or restriction of processing;
- object to processing based on legitimate interests, including profiling, and object at any time to processing for direct marketing;
- receive certain information in a portable form or have it transferred to another controller where applicable;
- withdraw consent at any time when processing relies on consent, without affecting earlier lawful processing; and
- lodge a complaint with a supervisory authority, including the Czech Office for Personal Data Protection (ĆÅad pro ochranu osobnĆch ĆŗdajÅÆ, ĆOOĆ) at https://uoou.gov.cz/.
To exercise your rights, email hello@carbickovacrowns.com. We may take reasonable steps to verify your identity before releasing or changing data. We normally respond to GDPR requests within one month, subject to legally permitted extensions. You may also have direct rights against Shopify for activities for which Shopify acts as an independent controller; see its Consumer Privacy Policy and Privacy Portal linked above.
15. Privacy Rights of Residents of the United States
Depending on the state where you live, the relevant state privacy law, whether that law applies to our business and the processing involved, you may have rights to know or access categories or specific items of personal information, request correction or deletion, obtain a portable copy, opt out of certain targeted advertising or sale/sharing, or appeal a refusal where legally required. Rights and exceptions vary by state. The California Consumer Privacy Act, as amended by the CPRA, applies only to businesses meeting its statutory criteria; selling to California customers alone does not automatically mean that every CCPA duty applies to us.
We do not sell personal information in exchange for cash. Nevertheless, advertising disclosures or certain Shopify services may fall within legal definitions of "sharing" or "targeted advertising" under applicable state law. If you have a legal right to opt out of certain sharing or targeted advertising, you can use our Data sharing opt-out page. The Your privacy choices link is also made available through the footer for applicable regions. You may additionally email hello@carbickovacrowns.com. Shopify's native opt-out tools support recognised browser privacy signals such as Global Privacy Control (GPC); we apply applicable legal requirements to such signals and requests.
To submit a privacy request, contact hello@carbickovacrowns.com. We will respond and provide any applicable verification, appeal or other steps within the time limits required by the law that applies to your request. We will not unlawfully discriminate against anyone for exercising an applicable privacy right.
16. Children, Automated Decisions and External Links
Our decorative products and this website are not directed to children. We do not knowingly use this website to solicit children's personal data. Please contact us if you believe a child has submitted personal data to us inappropriately.
We may use ordinary analytics, advertising audience selection and product recommendations where permitted, but we do not intend to make decisions solely by automated means that produce legal or similarly significant effects on customers in the meaning of GDPR Article 22. Payment providers may conduct their own fraud or risk checks under their terms and privacy notices.
Our site may contain links to Etsy, social-media platforms, payment services and other third-party sites. Their separate privacy terms govern their own services.
17. Changes to this Policy
We may update this policy to reflect our services, suppliers, legal requirements and privacy controls. The updated version will appear on this page with its actual last-updated date. Where required by law, we will provide additional notice or seek fresh consent for materially different processing.