Privacy policy

Privacy Policy

Last updated: 4 October 2026

This policy explains how we process your personal data when you visit soivane.com, create an account, place an order, subscribe to our newsletter or contact us, in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Czech Act No. 110/2019 Coll.

1. Controller

The controller of your personal data is Vasyl Ivanyš, sole trader, IČO 23221381, Nový Malín 39, 788 03 Nový Malín, Czech Republic, email soivane@email.cz (“we”, “us”). We have not appointed a data protection officer, as we are not required to; please direct any privacy questions to soivane@email.cz.

2. What data we process, why, and on what legal basis

  • Orders and delivery — name, shipping and billing address, email, phone (if provided), order details, payment status. Purpose: to conclude and perform the contract, deliver your order and handle returns and complaints. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Accounting and tax records — invoices and transaction data. Legal basis: legal obligation (Art. 6(1)(c) GDPR), retained for the periods required by Czech accounting and tax law (typically up to 10 years).
  • Customer account — if you create one: login email, order history, saved addresses. Legal basis: contract (Art. 6(1)(b)).
  • Customer service — messages you send us via email or our contact form. Legal basis: contract or our legitimate interest in answering your enquiry (Art. 6(1)(b)/(f)).
  • Newsletter — your email address, and whether you open or click our emails. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time via the unsubscribe link in every email. Where permitted by law, we may also send existing customers information about similar products based on our legitimate interest; you can object at any time.
  • Fraud prevention and security — IP address, device and transaction data. Legal basis: legitimate interest in protecting our store and customers (Art. 6(1)(f)).
  • Analytics and marketing cookies — only with your consent (Art. 6(1)(a)); see section 6.

Providing the data marked as required at checkout is necessary to conclude the contract; without it we cannot process your order.

3. Recipients and processors

We share personal data only as needed with:

  • Shopify (Shopify International Limited, Ireland, and its affiliates), which provides our online store platform and processes data on our behalf as a processor;
  • payment providers (the providers of the payment methods shown at checkout), which process payment data, partly as independent controllers;
  • our manufacturing and fulfilment partner Selfnamed (SIA NORD Beauty, reg. no. 40203354922, Baložu iela 20A, Rīga, LV-1048, Latvia), which produces, packs and ships your order and receives your name, shipping address, phone/email for delivery and order contents;
  • shipping carriers, which receive the data needed to deliver your parcel;
  • email service provider for newsletters (Shopify email notifications);
  • our accountant and public authorities where required by law.

4. Transfers outside the EU/EEA

Some processors (including Shopify, which is headquartered in Canada, and some of its sub-processors in the United States) may process data outside the EEA. Such transfers rely on an adequacy decision of the European Commission (e.g. for Canada or for US companies certified under the EU–U.S. Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.

5. How long we keep your data

Order data: for the duration of the contract and of the statutory limitation periods for claims (generally 3–4 years after the purchase) and as long as required by accounting and tax laws. Account data: until you delete your account. Newsletter data: until you unsubscribe. Customer service messages: up to 3 years after the enquiry is resolved. Cookie data: see section 6.

6. Cookies

We use cookies and similar technologies. Strictly necessary cookies (e.g. for the shopping cart, checkout, login and security) are used on the basis of our legitimate interest and do not require consent. Analytics, preference and marketing cookies are only set if you give your consent in our cookie banner. You can change or withdraw your consent at any time via the “Cookie settings” link in our website footer or by deleting cookies in your browser. A list of cookies used by Shopify is available at shopify.com/legal/cookies.

7. Your rights

You have the right to request access to your personal data, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests (including direct marketing). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. To exercise your rights, contact us at soivane@email.cz. We will respond within one month.

You also have the right to lodge a complaint with a supervisory authority — in the Czech Republic, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz — or with the authority in your EU country of residence.

8. Automated decision-making

We do not make decisions producing legal effects about you based solely on automated processing. Our payment providers may use automated fraud checks.

9. Children

Our store is not directed at children under 16 and we do not knowingly collect their data.

10. Changes

We may update this policy; the current version is always published on this page with its date.

Seller: Vasyl Ivanyš, a sole trader (fyzická osoba podnikající, “živnostník”) registered in the Czech Republic
Company ID (IČO): 23221381
VAT: The seller is not a VAT payer.
Registered address: Nový Malín 39, 788 03 Nový Malín, Czech Republic
Email: soivane@email.cz
Entered in the Trade Licensing Register (živnostenský rejstřík) kept by Městský úřad Šumperk (municipal trade licensing office).
Trading name: Soivane · Website: soivane.com