Privacy Policy

This policy explains what personal data we collect when you use the Aro89 online shop, why we use it and what rights you have. Data is processed in accordance with Law No. 133/2011 on personal data protection.

1. Controller

The data controller is [to be completed], IDNO [to be completed], [to be completed]. For any question about personal data, write to [to be completed] or call [to be completed].

2. What data we collect

• When you order: name, phone number, delivery address, email address (optional), notes for the courier and the products ordered.
• When you create an account: email address, password (stored only in encrypted form), first name, last name, phone, city and address if you provide them.
• Technical data: strictly necessary cookies (see the Cookie Policy) and server logs used for security.

We do not collect card details: payment is made on delivery, directly to the courier.

3. Purposes and legal grounds

• Fulfilling orders and delivering products – performance of the contract.
• Communicating about your order (confirmation, delivery, returns) – performance of the contract.
• Managing your customer account – performance of the contract.
• Meeting accounting and tax obligations – legal obligation.
• Website security and preventing fraud and fake orders – the controller’s legitimate interest.

We do not send advertising messages without your prior consent.

4. Who we share data with

Data is shared only as far as necessary: with the courier service (for delivery), the website hosting provider and, where applicable, the accountant and public authorities upon lawful request. We do not sell your data.

5. How long we keep data

Order data is kept for the period required by accounting and tax law. Account data is kept until the account is deleted. Technical logs are kept for a limited period needed for security.

6. Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing, and to withdraw consent. Send requests to [to be completed]; we respond within the time limit set by law. You may also lodge a complaint with the National Center for Personal Data Protection.

7. Data security

We apply technical and organisational measures to protect data: encrypted connection (HTTPS), encrypted password storage and restricted access to the administration panel.

8. Minors

The shop is intended for persons aged 18 or over. We do not knowingly collect data from minors.

9. Changes

We may update this policy. The current version is always published on this page.