Personal data protection terms

Updated: 13 September 2026 · version 20260913.1

1. Controller and contact

The data controller is Livestis s r. o., registered at Náměstí Míru 341/15, 120 00 Praha 2, company ID 11879629 (“we”). Privacy questions and requests may be sent to store@terezietrusinova.com or to the postal address above.

2. Data we process

Depending on how you use the store, we may process identification, contact, order and payment data; delivery, communication, complaint and return information; and customer account data and marketing preferences. Website visits may also involve processing online identifiers and technical data, particularly IP address, device and browser type, URL, visit time, website interactions, cookie identifiers, advertising identifiers and campaign parameters such as fbp and fbc. These may constitute personal data even if they do not contain a name.

3. Purposes and legal bases

Orders and customer accounts: entering into and performing a contract, customer support, payment, delivery, returns and complaints (Article 6(1)(b) GDPR).
Accounting, tax and other statutory obligations: compliance with a legal obligation (Article 6(1)(c) GDPR).
Protection of rights, security and prevention of misuse: our legitimate interest in protecting the store and establishing and defending legal claims (Article 6(1)(f) GDPR).
Newsletter: consent or, where permitted by law, legitimate interest in offering our own similar products to existing customers. You may unsubscribe at any time.
Analytics and personalisation: only with consent given through the cookie banner (Article 6(1)(a) GDPR).
Advertising, remarketing and conversion measurement: only with consent to marketing cookies (Article 6(1)(a) GDPR).

Consent to analytics and marketing is voluntary. Refusal does not affect your ability to shop. You may change or withdraw consent at any time through “Cookie settings” in the footer; withdrawal does not affect the lawfulness of earlier processing.

4. Recipients and services used

We share data only as necessary with providers of hosting, the e-commerce platform, payments, delivery, accounting, IT support and marketing tools. For web analytics and advertising, we primarily use:

Shoptet a.s. – operation of the e-commerce platform, storage of consent settings and technical order processing;
Google Ireland Limited – Google Analytics, Google Ads, Google Tag Manager and conversion measurement;
Meta Platforms Ireland Limited – Meta Pixel, Conversions API, measurement, remarketing and advanced matching where available and consented to;
TikTok Technology Limited and TikTok Information Technologies UK Limited – TikTok Pixel, Events API, advertising conversion measurement, remarketing and advanced matching; TikTok privacy policy.
Pinterest Europe Limited and Pinterest, Inc. – Pinterest Tag, Conversions API, advertising conversion measurement, remarketing and enhanced matching; Pinterest privacy policy.
OpenAI (ChatGPT Ads) – Measurement Pixel and Conversions API, advertising effectiveness measurement and conversion matching with marketing consent; OpenAI privacy policy.
Ecomail.cz, s.r.o. – newsletter forms and email marketing;
Adform A/S – advertising measurement and remarketing;
Seznam.cz, a.s. – Sklik, conversion measurement and retargeting.

Some providers may act as independent controllers for part of the processing. Their own privacy policies govern further processing within their services.

How Google uses personal data · How Meta uses personal data

4a. Enhanced conversions and data matching

With your marketing consent, we use Google Ads Enhanced Conversions. When you place an order, your email, phone number, first and last name and address (street, city, region, postcode and country) may be used for matching if available to the relevant tool. Google enhanced conversions normalise and hash email, phone number and first and last name using SHA-256 before transmission. Other address data, particularly city, region, postcode and country, may be transmitted without hashing. Google uses the data to attribute purchases to advertising and measure its effectiveness. A hash is pseudonymised, not anonymous: Google can compare it with its users' data. Entering contact details or placing an order does not constitute marketing consent. Google information on customer data.

With marketing consent, we also use advanced matching with Meta, TikTok and Pinterest. The scope varies by service and available data and may include email, phone number, name and order address. Advertising partners may receive hashed contact details, browser and advertising identifiers, IP address, technical data and events such as product views, additions to basket and purchases, including products, value, currency and event or order identifiers. Data may be sent from the browser via a pixel or tag and through a server via Conversions API or Events API. IP addresses and some location or technical data may be sent without hashing. With marketing consent, partners including Google may also use IP addresses for advertising measurement and personalisation. Server transmission and hashing do not replace consent. Partners may link the data to accounts in their services for measurement, audience creation and ad personalisation under their own terms.

You may refuse or withdraw consent in Cookie settings in the footer; shopping remains available. To withdraw existing consent, open the settings and select Reject optional, or switch off the marketing category and save your selection. Settings apply to the current browser and device. Withdrawal applies going forward; you may request deletion of previously shared data from us and the relevant partner.

For OpenAI (ChatGPT Ads), with marketing consent we transmit available email and phone details after normalisation and SHA-256 hashing. Advertising measurement may include page and product views, additions to basket, checkout starts and order creation, products, currency and value, event identifiers, page addresses, IP addresses, browser data and oppref / obref identifiers. Server and browser transmission respect the same marketing choice. We use supporting hashed contacts stored in the browser for no more than 30 minutes and remove them when consent is withdrawn. Details of the technologies and renewed choices when recipients change are in the cookie statement.

5. Transfers outside the EEA

Some providers or their subcontractors may process data outside the European Economic Area, particularly in the USA. Transfers rely on an applicable European Commission adequacy decision, particularly the EU–US Data Privacy Framework, or on standard contractual clauses and any supplementary measures. The relevant provider supplies information on the specific mechanism.

6. Retention periods

data needed to perform the contract and handle legal claims: for the duration of the contractual relationship and generally 3 years afterwards;
tax and accounting records: for the legally required period, generally 10 years;
customer account data: until the account is closed, but no longer than necessary for the related purposes;
newsletter data: until consent is withdrawn or you unsubscribe, no longer than 5 years after the last active interaction unless another legal basis applies;
analytics and marketing data: for the period specified in individual cookie settings and provider rules, no longer than necessary for the purpose; renewed consent is requested no later than after 180 days.

7. Your rights

You have rights of access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests. You may withdraw consent at any time. You may also complain to the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. We handle requests without undue delay, generally within one month. To protect your data, we may reasonably verify your identity.

You may object at any time to processing for direct marketing, including related profiling; we will then stop processing your data for that purpose. Send your request to store@terezietrusinova.com. Erasure is not absolute: we may retain data needed to comply with the law or for legal claims to the necessary extent. For complex or numerous requests, the deadline may be extended by up to two further months; we will inform you of the extension and reasons within the first month. You may use the same contact to request information on recipients and copies of safeguards for transfers outside the EEA.

8. Required data and automation

We need the information marked as mandatory in an order to conclude and perform the contract; the order cannot be completed without it. Analytics and marketing data are optional. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Advertising systems may create segments and profiles to select more relevant ads.

9. Security and updates

We use appropriate technical and organisational measures to protect data. We may update this notice, particularly when services or legal requirements change; the current version is always published on this page.