Privacy policy

1. What data we process and why

Order fulfilment (Art. 6(1)(b) GDPR): name, e-mail, phone, delivery address, order contents and payment data passed on by the payment gateway (never the card number). Without this data the contract cannot be concluded and performed.

Legal obligations (Art. 6(1)(c) GDPR): invoices and accounting records are kept for the period required by accounting and tax law, generally 10 years.

Enquiries and salon applications (Art. 6(1)(f) GDPR): data sent through contact forms is processed on the basis of our legitimate interest in answering the enquiry, for no longer than 2 years after the last communication.

Website operation (Art. 6(1)(f) GDPR): technical access logs (IP address, browser type) are kept briefly by the hosting provider for security. The cart contents are stored only in your browser (local storage) and are not sent to the server. The website uses no advertising cookies and no third-party tools; for visit measurement see section 2.

2. Visit measurement

Measurement stays off until you consent to it (Art. 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll. on electronic communications). Until you answer, nothing is stored on your device except that answer itself and the cart contents, which are necessary for a purchase.

With consent we count page views, products viewed, additions to the cart and started orders. On the server these become daily totals only; we store no name, e-mail, IP address or any identifier that could break those totals down to an individual visitor.

With consent we also remember in your browser, for 30 days, the campaign parameters from the address you arrived by (utm_source, utm_medium, utm_campaign, utm_content). If you order within that time, those parameters are attached to the order so we know which campaign led to the purchase; they then form part of the order record and are kept with it.

You can withdraw consent at any time using the “Measurement consent” link in the site footer. Withdrawing deletes the remembered campaign parameters from your device and stops further measurement; the lawfulness of processing before withdrawal is not affected.

3. Who we share data with

Processors acting on our behalf: Stripe Payments Europe, Ltd. (payments), Vercel Inc. (hosting), Resend (e-mail delivery), the carrier (delivery) and an external accountant. Standard contractual clauses under Art. 46 GDPR are in place with processors outside the EU/EEA.

Data is disclosed to public authorities only where the law requires it.

4. Your rights

You have the right of access, rectification, erasure (where the conditions of Art. 17 GDPR are met), restriction of processing, data portability, and the right to object to processing based on legitimate interest. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.

Send requests to info@joliorigins.cz or by post to the controller’s address. We usually reply within one month; in complex cases the period may be extended, of which we will inform you. We may ask you to verify your identity to protect your data.

You have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz, posta@uoou.gov.cz.

5. Security

Data in transit is encrypted (HTTPS). Payment data is handled exclusively by a PCI DSS certified payment gateway. Only the controller and processors have access to data, to the extent necessary for the given purpose.