Privacy Policy

The data controller is ECOZZ s.r.o., Company ID 28371003, VAT ID CZ28371003, registered office at Moskevská 1842, 272 04 Kladno, Czech Republic, email: lh@ecozz.com (the "Controller").

We only process personal data necessary for fulfilling our obligations and legal requirements:

• identification data (name, company name, VAT/tax ID)

• contact data (email, phone, shipping address)

• payment data (processed directly by Stripe — we do not have access to card numbers)

• request and order data (bag specifications, quantity, price, uploaded artwork, proofs, messages and attachments)

• technical data (IP address, browser type, cookies)

• Contract performance (Art. 6(1)(b) GDPR): order processing, production, delivery, invoicing

• Legal obligations (Art. 6(1)(c) GDPR): accounting and tax — retention for 10 years

• Legitimate interest (Art. 6(1)(f) GDPR): customer communication, service quality, fraud prevention

• Consent (Art. 6(1)(a) GDPR): marketing communication, newsletter — only with explicit consent

Order-related data is retained for the duration of the contractual relationship and subsequently for 10 years for accounting archive purposes.

Inquiries without order realization are kept for 3 years.

Cookies according to their validity (max. 12 months).

Your personal data is only shared with carefully selected processors:

• Stripe, Inc. — online payment processing and applicable tax calculation

• Shipping companies — delivery (name, address, phone)

• Accounting firm — bookkeeping

• Cloudflare, Inc. — Workers hosting, D1 database, R2 storage, website protection and transactional email sending or routing

All processors are bound by a data processing agreement and comply with GDPR.

Depending on Cloudflare and Stripe service configuration, data may also be processed outside the European Economic Area. Transfers rely on an applicable adequacy decision, Standard Contractual Clauses or another lawful GDPR mechanism.

As a data subject, you have the right to:

• access your personal data (Art. 15 GDPR)

• rectification of inaccurate data (Art. 16 GDPR)

• erasure ("right to be forgotten") (Art. 17 GDPR)

• restriction of processing (Art. 18 GDPR)

• data portability (Art. 20 GDPR)

• object to processing (Art. 21 GDPR)

• withdraw consent (where processing is based on consent)

• lodge a complaint with the supervisory authority (www.uoou.cz)

To exercise any of these rights, contact us at lh@ecozz.com.

The current version of custom.ecozz.com uses only strictly necessary cookies to secure an anonymous draft, customer session and public forms. They are required for the requested functionality and cannot be disabled through a cookie banner.

We do not activate analytics or marketing cookies without prior consent. If introduced later, we will provide the required choice and update this Policy.

Personal data is protected by technical and organizational measures: encrypted communication (HTTPS/TLS), restricted access, regular backups and system updates.

For questions about personal data processing, contact:

ECOZZ s.r.o., Moskevská 1842, 272 04 Kladno, email: lh@ecozz.com