Privacy Policy of Fotobatohy.cz

Updated on 13 November 2026

1. General information

1.1. This policy explains how FIINYX VISION s.r.o., company registration number 23120541, with its registered office at Plk. Fr. Štičky 54, 252 26 Roblín, Czech Republic, entered in the Commercial Register maintained by the Municipal Court in Prague under file number C 421726, processes personal data when operating the Fotobatohy.cz online shop (referred to below as “we”, “us” or “Fotobatohy”).

1.2. This policy applies to visitors to www.fotobatohy.cz, registered users, customers, recipients of marketing communications and anyone who contacts us. It also covers related data processing when payments are made through the providers listed in Section 5.

1.3. We act as the controller of personal data for the processing described in this policy. We determine the purposes and means of that processing. Some of the service providers listed in Section 5 may act as independent controllers for their own purposes or as joint controllers for specified processing activities.

1.4. Our contact person for personal data protection matters is Veronika Samková, email veronika@fotobatohy.cz, phone +420 720 762 432. You can also send questions and requests concerning personal data to info@fotobatohy.cz.

1.5. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (GDPR), and related legislation.

2. What personal data we process and where we obtain it

2.1. Identification and contact details. In particular, we process your first name and surname, email address, telephone number, billing and delivery addresses and, where applicable, business identification details. We obtain this data primarily from you when you place an order, register or communicate with us. If a customer specifies a different parcel recipient or a company's contact person, we obtain that person's details from the customer and use them to fulfil the relevant order.

2.2. Order and payment data. We process information about the goods ordered, price, currency, payment and delivery methods, order number and status, delivery, returns, claims for faulty goods and related communication. Depending on the payment method, we also process information about the transaction and, where applicable, a bank account number, for example to issue a refund. We also obtain payment and delivery information from payment and delivery service providers.

Card payments are handled by payment service providers. We do not store the full payment card number or the CVC/CVV security code in our online shop. We may receive payment confirmation and limited information from the provider as needed to identify and settle the transaction.

2.3. Customer account data. When you register and use an account, we process login and identification details, contact details, saved addresses, account settings and information about orders associated with the account. Providing data that is not necessary to maintain the account or fulfil an order is optional.

2.4. Signing in through Facebook, Google or Seznam. If you choose this sign-in method, we obtain data from the relevant provider to create or link your account and sign you in to the online shop. This may include, in particular, an account identifier, first name, surname or nickname, email address and profile picture.

Depending on the service settings, your public profile and the permissions granted, other profile data may also be made available to us, such as your date of birth, age group, gender or location. The scope varies according to the provider and your settings. Access to your public profile does not mean that we need all the information it contains to maintain your account or that we automatically use it for other purposes. We limit processing to the data needed for the particular purpose described in this policy. Signing in through an external account does not, in itself, constitute consent to receive marketing communications or to advertising tracking.

2.5. Communication data. When you contact us by email, telephone, a form, chat or social media, we process the contact details you provide, the contents of messages and attachments and the information needed to deal with your request. For chat, this may include your email address or telephone number, the conversation and related technical information about sending the message.

2.6. Technical data and website activity. Depending on the feature you use and your choices, we process, in particular, your IP address, device and browser information, online identifiers, the source of your visit, pages visited, products viewed, items added to the basket, purchases made and consent information. Section 4 explains the conditions for using cookies and similar technologies.

2.7. Marketing and purchase review data. We process contact details for the chosen communication channel, information about subscribing or unsubscribing, consent given or an objection to receiving communications, and purchase data needed for the relevant purpose. Contact details in hashed form may also be used for enhanced conversion measurement and advertising event matching, as described in Section 3.6.

2.8. Special categories of personal data. We do not require information about health, religious beliefs, political opinions or other special categories of personal data for ordinary shopping, registration or customer support. Please do not include such information in order notes or routine messages.

3. Why we process personal data and our legal bases

3.1. Processing orders and performing the contract

We use identification, contact, order and payment data to receive and fulfil your order, communicate about its progress, arrange payment and delivery and meet our other contractual obligations.

The legal basis is performance of a contract or taking steps at your request before entering into a contract under Article 6(1)(b) GDPR. We cannot fulfil your order without the necessary data. We process data under Article 6(1)(c) GDPR to maintain accounting records, issue and retain documents and meet other legal obligations.

For business customers' contact persons and parcel recipients who are not themselves parties to the contract, the basis for the necessary processing is our legitimate interest in properly fulfilling and delivering the order under Article 6(1)(f) GDPR.

3.2. Newsletters and marketing text messages

We send marketing communications by email through Ecomail and marketing text messages through WEXBO.

We send communications to subscribers on the basis of their consent under Article 6(1)(a) GDPR and Section 7(2) of Czech Act No. 480/2004 Coll. Consent is voluntary and is not a condition of purchasing or registering.

Subject to the conditions in Section 7(3) of Czech Act No. 480/2004 Coll., we may also send our own customers offers for our similar products or services on the basis of a legitimate interest under Article 6(1)(f) GDPR. We use this option only for contact details obtained in connection with a sale, where the customer was given a simple opportunity to refuse this use when the details were collected and did not do so. We assess these conditions separately for email addresses and telephone numbers.

You can opt out at any time. For email, use the unsubscribe link; for text messages, follow the instructions in the message. You can also contact info@fotobatohy.cz. Every marketing communication explains how to stop receiving further messages easily. Once you withdraw consent or opt out, we do not continue processing for that purpose by relying on a different legal basis.

We also record message delivery and unsubscribes. We undertake any individual tracking of message opens or link clicks using tracking technologies only with the appropriate consent. We do not automatically treat consent to subscribe as consent to all advertising tracking.

Opting out of marketing does not prevent us from sending messages necessary to fulfil an order or deal with your request, such as an order confirmation or delivery information.

3.3. Maintaining a customer account

We use account data for registration, sign-in, displaying orders, managing saved details and making future purchases easier. The legal basis is performance of the contract to maintain your account under Article 6(1)(b) GDPR.

This purpose also includes linking your account to Facebook, Google or Seznam if you choose that sign-in method. We use only the data needed to maintain your account. You can update the account through the available settings and request its closure at info@fotobatohy.cz. Closing the account does not affect the lawful grounds for retaining documents and data relating to orders already placed.

3.4. Back-in-stock notifications

If you request a back-in-stock notification, we use the contact details you provide and information about the product you are following to send you that notification. The legal basis is your consent under Article 6(1)(a) GDPR, expressed by activating the relevant service.

You can cancel the notification through the available feature in the online shop or at info@fotobatohy.cz. Requesting a notification does not, in itself, subscribe you to newsletters or marketing text messages.

3.5. Faulty goods claims, withdrawal from the contract and refunds

We use identification, contact and order data, a description of your request, related documents and, where applicable, your bank account number to handle a claim for faulty goods, withdrawal from the contract, a return or a refund.

The legal bases are performance of the contract under Article 6(1)(b) GDPR and compliance with the relevant legal obligations under Article 6(1)(c) GDPR. Where it is necessary to retain supporting documents for the establishment, exercise or defence of legal claims, we process them for that purpose on the basis of a legitimate interest under Article 6(1)(f) GDPR.

3.6. Analytics, advertising, enhanced conversions and Conversions API

We use Google Analytics to evaluate traffic to and use of our online shop. We use Google Ads, Meta advertising tools for Facebook and Instagram, and Seznam advertising tools, in particular Sklik and Zboží.cz, to measure advertising effectiveness, create advertising audiences and display relevant offers. We also use Google Tag Manager to deploy and manage tracking tags.

We carry out analytics and marketing processing based on optional tracking technologies with your consent under Article 6(1)(a) GDPR and in accordance with Section 4. This may involve information about website visits, product views, items added to the basket, purchases, order values and currencies and the relevant online identifiers.

We also use Google Ads enhanced conversions and Meta Conversions API. These tools help attribute a purchase or another event to an advertisement and assess its effectiveness. Depending on the event and the data available, an email address, telephone number or other identification details needed for matching may also be transmitted. Contact details used for this matching are transmitted in hashed form where the relevant feature requires it. Hashing is a protective measure; it does not, in itself, make the data anonymous.

Conversions API also enables events to be transmitted through a server. This method of transmission does not change the conditions for processing or replace your consent. Your marketing choice also applies to the corresponding transmission of advertising events in this way.

Activity may be used to assess interests automatically and assign users to advertising audiences, which constitutes profiling for marketing purposes. The advertising profiling described here is used to select and evaluate advertisements; it does not, in itself, determine your contractual rights or whether an order is accepted. Any separate assessment of payments by payment service providers is governed by their own policies.

3.7. Customer support and communication

We use contact details and the contents of communications to answer enquiries and deal with requests. Where an enquiry relates to an order or steps taken before entering into a contract, the basis is Article 6(1)(b) GDPR. For other routine enquiries, we rely on our legitimate interest in dealing with them under Article 6(1)(f) GDPR; the relevant legal obligation applies to requests required by law.

We use EmailJS and connected email services to send messages from the website. Sending an enquiry does not, in itself, constitute consent to newsletters or any other marketing use of your contact details.

3.8. Heureka and the Ověřeno zákazníky programme

We ask about your shopping experience through the Ověřeno zákazníky (Verified by Customers) programme, provided by Heureka Group a.s., company registration number 07822774. We share your email address and information about the goods purchased with Heureka to create and send the questionnaire and evaluate feedback. Heureka acts as our processor when carrying out these activities for our online shop.

The legal basis is our legitimate interest in assessing satisfaction and improving our services under Article 6(1)(f) GDPR. We send questionnaires subject to the conditions in Section 7(3) of Czech Act No. 480/2004 Coll.

You can opt out before submitting your order and at any time afterwards using the link in the questionnaire or by contacting info@fotobatohy.cz. We will not use the details covered by your opt-out to send further questionnaires; we may keep a record of the opt-out itself to the extent needed to respect your choice.

For the subsequent publication and verification of reviews and the protection of their trustworthiness, Heureka may act as an independent controller under its privacy policy.

3.9. Zboží.cz and purchase reviews

We also ask about customer satisfaction through purchase reviews on Zboží.cz, operated by Seznam.cz, a.s., company registration number 26168685. We share your email address and details of the relevant purchase with Seznam.cz so that it can send a questionnaire about the purchase and the goods bought. Seznam.cz acts as our processor when sending these questionnaires.

The legal basis is our legitimate interest in obtaining feedback and improving our services under Article 6(1)(f) GDPR; we send questionnaires subject to the conditions in Section 7(3) of Czech Act No. 480/2004 Coll.

You can opt out before submitting your order and at any time afterwards using the link in the questionnaire or by contacting info@fotobatohy.cz. We will not use the details covered by your opt-out to send further questionnaires; we may retain the information necessary to record your refusal.

This purpose is separate from personalised advertising and advertising measurement. The rules for Seznam's own service and any further processing by Seznam are set out in its privacy policy.

3.10. Security and protecting our rights

We process technical and operational records to the extent necessary to protect the online shop and accounts, address security incidents and prevent misuse. We may also retain the documents needed for the establishment, exercise or defence of legal claims. The basis is a legitimate interest under Article 6(1)(f) GDPR or a specific legal obligation under Article 6(1)(c) GDPR.

4. Cookies, consent and withdrawal of consent

4.1. We use cookies and similar technologies to operate the online shop, remember settings and, depending on your choices, for statistics and advertising. Simply allowing cookies in your browser or continuing to browse does not constitute consent to optional cookies.

4.2. Necessary technologies. Without consent, we use only technologies that are necessary to transmit a communication or provide a service you have expressly requested, for example for the basket, sign-in, security or saving your consent choice. The exemption from the requirement to obtain consent for storing or accessing information in this way is based on Czech Act No. 127/2005 Coll. Depending on the purpose, we process the related personal data primarily for performance of a contract or on the basis of a legitimate interest in the secure operation of the website.

4.3. Optional technologies. We use statistical and marketing cookies and other optional tracking technologies only after obtaining the relevant consent. The same applies to preference technologies unless they are necessary for a function you have requested. The purposes and relevant providers are described in Sections 3.6 and 5.2; further information is available in our cookie policy.

4.4. You can give, refuse or change your consent through the cookie banner and the Cookie settings link in the website footer. You can withdraw optional consents at any time. Rejecting analytics or marketing cookies does not prevent ordinary shopping.

4.5. You can also delete or block cookies in your browser. However, blocking all cookies, including necessary cookies, may restrict the basket or sign-in functions. Browser settings do not replace the option to change your consent directly on our website.

4.6. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal. Once consent is withdrawn, we stop the processing that relied on it. We may continue to retain certain data only for a separate purpose for which we have an appropriate legal basis, for example to comply with a legal obligation or demonstrate previously given consent. Withdrawing advertising consent does not mean that accounting records or data needed to complete an order will be erased.

4.7. We manage consent to marketing communications and opt-outs from satisfaction questionnaires separately from cookies. To change these choices, use the procedures in Sections 3.2, 3.8 and 3.9 or contact us.

5. Who we share personal data with

5.1. Authorised persons working for Fotobatohy can access data to the extent needed for their tasks. We also use the providers listed below. We share with them only the data required for the particular service and purpose. The recipients involved for each customer depend, for example, on the chosen delivery and payment methods, sign-in method and consents given.

Processors work for us under contractual terms governing the processing of personal data. Independent controllers are responsible for their own purposes and obligations. For joint controllership, responsibilities are allocated under the relevant arrangement. Providers may engage further processors subject to the GDPR.

5.2. Operating the online shop, communication, analytics and marketing

Joint controllership with Meta. For processing where we jointly determine the purposes and means, in particular when collecting and transmitting data through advertising tools, a joint controllership arrangement applies. Our responsibilities include, in particular, informing visitors, obtaining the necessary consents and appropriately implementing the tools on our side. Under this arrangement, Meta is responsible for enabling the exercise of rights under Articles 15 to 20 GDPR in relation to personal data it holds following the joint processing, and for the security of its tools. You can exercise your rights with either us or Meta. Details and the allocation of responsibilities are set out in the joint controllership arrangement and the Meta Business Tools Terms.

5.3. Delivery and arranging transport

To arrange delivery, we share with the selected provider, in particular, the recipient's name, delivery address or collection point, telephone number, email address, parcel identification and, where applicable, cash-on-delivery information and necessary delivery instructions.

The relevant carriers may involve their contracted delivery partners and collection point operators to the extent required for the chosen delivery service.

5.4. Payments, accounting and legal obligations

Necessary data may also be received by banks and card scheme operators involved in the chosen payment, email, hosting and IT service providers to the extent required for their tasks, legal advisers dealing with a specific claim, and public authorities where legislation requires or permits this.

5.5. Transfers outside the European Economic Area

Using certain services may involve transferring and processing data outside the European Economic Area (EEA), particularly in the United States of America. This may also include access by a provider or its subcontractor from a third country.

For Google and Meta services, the entities involved may include, in particular, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA. Depending on the service, transfers rely on the adequacy decision under the EU–US Data Privacy Framework, where the recipient holds valid certification covering the relevant data, or on other appropriate safeguards, in particular the European Commission's standard contractual clauses.

EmailJS is a Singapore-based provider and, according to its terms, uses processing in the USA; it specifies standard contractual clauses for the relevant transfers. Depending on the service, other providers, such as Ecomail or SumUp, may also use foreign subcontractors. Their involvement and the rules for transfers are set out in the relevant terms and lists of subprocessors.

We base transfers on a mechanism permitted under the GDPR and consider the necessary supplementary measures. You can request information about the safeguards used and how to obtain a copy at info@fotobatohy.cz. Further information is also available in Google's information on international data transfers, Meta's data transfer terms and the links provided for individual providers.

6. How long we retain personal data

6.1. The retention period depends on the specific purpose. If the same data serves several purposes, the end of one purpose does not automatically mean the erasure of data still needed on another valid basis. Once all grounds for retention cease to apply, we delete the data or irreversibly anonymise it.

6.2. We also retain, to the extent necessary, evidence of consent given and withdrawn and records of opt-outs from marketing or questionnaires. These records demonstrate the lawfulness of processing and help ensure that unsubscribed contacts are not added back to mailing lists. We do not use them to continue marketing that has been refused. Their retention period depends on the need to respect opt-outs and demonstrate compliance with obligations and, where applicable, on the duration of related legal claims.

6.3. Recipients acting as independent controllers determine retention periods for their own processing in accordance with their legal obligations and policies. Their separate obligations are not the same as the retention periods for data in our online shop.

7. Your rights

7.1. Subject to the conditions set out in the GDPR, you have the following rights in particular:

• Right of access: to obtain confirmation of whether we process personal data about you, access to that data, a copy of it and information about the processing.
• Right to rectification: to request correction of inaccurate data and completion of incomplete data.
• Right to erasure: to request deletion of data where the legal conditions are met. This right does not apply, for example, to the extent that processing is necessary to comply with legal obligations or for the establishment, exercise or defence of legal claims.
• Right to restriction of processing: to request that the use of data be restricted, for example where its accuracy is disputed or an objection is being assessed, subject to the conditions in the GDPR.
• Right to data portability: to receive data that you have provided to us and that we process by automated means on the basis of consent or a contract, in a structured, commonly used and machine-readable format. Where technically feasible, you can request direct transmission to another controller.
• Right to object: to object, on grounds relating to your particular situation, to processing based on a legitimate interest. In such a case, we will stop processing unless we demonstrate overriding compelling legitimate grounds or grounds relating to legal claims. We will comply with an objection to direct marketing, including related profiling, without this balancing of interests.
• Right to withdraw consent: to withdraw consent for the relevant purpose at any time, without affecting the lawfulness of earlier processing.
• Rights relating to automated decision-making: subject to Article 22 GDPR, not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to benefit from the relevant safeguards where a statutory exception applies.

7.2. You can exercise your rights at info@fotobatohy.cz, through the contact person listed in Section 1.4 or in writing to our registered office. If we have reasonable doubts about the identity of the person making the request, we may ask for proportionate additional information to avoid disclosing data to an unauthorised person.

7.3. We will deal with your request without undue delay and no later than one month after receiving it. Taking account of the complexity and number of requests, this period may be extended by up to a further two months; we will inform you of the extension and its reasons within the first month. Requests are generally handled free of charge. For manifestly unfounded or excessive requests, we may apply the exceptions provided for in the GDPR.

7.4. If you believe that processing infringes the law, you have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz, or another competent supervisory authority under the GDPR. This does not affect your right to seek a judicial remedy.

8. Personal data security

8.1. We take appropriate technical and organisational measures that reflect the nature of the processing and the associated risks. We restrict access to data according to work responsibilities and protect it against unauthorised access, alteration, loss and disclosure.

8.2. Persons authorised to work with data are bound by appropriate confidentiality obligations. We also address security when selecting providers and in the terms of our cooperation with processors. We assess the adequacy and effectiveness of our measures on an ongoing basis and adjust them as necessary.

9. Contact and updates to this policy

9.1. For personal data protection matters, please contact:

FIINYX VISION s.r.o.

Plk. Fr. Štičky 54, 252 26 Roblín, Czech Republic

Email: info@fotobatohy.cz

Phone: +420 720 762 432

Contact person: Veronika Samková, veronika@fotobatohy.cz

9.2. We update this policy when our services, the tools we use or legal requirements change. We publish the current version on our website. We communicate material changes appropriately; a change to the policy does not, in itself, replace consent where consent is required for new processing.

This version of the policy is effective from 13 November 2026.