Privacy policy

1. What data we process and why

Order fulfilment (Art. 6(1)(b) GDPR): name, e-mail, phone, delivery address, order contents and payment data passed on by the payment gateway (never the card number). Without this data the contract cannot be concluded and performed.

Legal obligations (Art. 6(1)(c) GDPR): invoices and accounting records are kept for the period required by accounting and tax law, generally 10 years.

Enquiries and salon applications (Art. 6(1)(f) GDPR): data sent through contact forms is processed on the basis of our legitimate interest in answering the enquiry, for no longer than 2 years after the last communication.

Website operation (Art. 6(1)(f) GDPR): technical access logs (IP address, browser type) are kept briefly by the hosting provider for security. The cart contents are stored only in your browser (local storage) and are not sent to the server. The website stores no advertising cookies without your consent; for visit measurement and the Google and Meta tools see section 2.

2. Visit measurement

The Google Analytics tag loads as soon as the site opens, but in consent mode with storage denied: until you answer it stores no cookie or identifier on your device, and Google receives only an anonymous record of the page view that cannot be linked to you. Until then nothing is stored on your device except that answer itself and the cart contents, which are necessary for a purchase.

Consent turns measurement on fully (Art. 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll. on electronic communications); we measure through Google Analytics 4 (Google Ireland Limited) and the Meta measurement pixel (Meta Platforms Ireland Limited), which does not load at all without consent. The same Google tag also reports a completed purchase to Google Merchant Center, so we can see which products actually sell from Google’s listings; it sends the order number, the amount and the items, not your name or address. Declining silences the Google tag and no further event is sent.

With consent we count page views, products viewed, additions to the cart and started orders. On the server these become daily totals only; we store no name, e-mail, IP address or any identifier that could break those totals down to an individual visitor.

With consent we also remember in your browser, for 30 days, the campaign parameters from the address you arrived by (utm_source, utm_medium, utm_campaign, utm_content). If you order within that time, those parameters are attached to the order so we know which campaign led to the purchase; they then form part of the order record and are kept with it.

You can withdraw consent at any time using the “Measurement consent” link in the site footer. Withdrawing deletes the remembered campaign parameters from your device and stops further measurement; the lawfulness of processing before withdrawal is not affected.

3. Who we share data with

Processors acting on our behalf: Stripe Payments Europe, Ltd. (payments), Vercel Inc. (hosting), Resend (e-mail delivery), the carrier (delivery), an external accountant and Google Ireland Limited (visit and purchase measurement in Google Merchant Center). With your consent, visit data is also shared with Meta Platforms Ireland Limited as a joint controller under Art. 26 GDPR. Standard contractual clauses under Art. 46 GDPR are in place with processors outside the EU/EEA.

Data is disclosed to public authorities only where the law requires it.

4. Your rights

You have the right of access, rectification, erasure (where the conditions of Art. 17 GDPR are met), restriction of processing, data portability, and the right to object to processing based on legitimate interest. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.

Send requests to info@joliorigins.cz or by post to the controller’s address. We usually reply within one month; in complex cases the period may be extended, of which we will inform you. We may ask you to verify your identity to protect your data.

You have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz, posta@uoou.gov.cz.

5. Security

Data in transit is encrypted (HTTPS). Payment data is handled exclusively by a PCI DSS certified payment gateway. Only the controller and processors have access to data, to the extent necessary for the given purpose.