Legal & Compliance

Privacy Policy & GDPR Notice

Effective Date: October 20, 2026

1. Overview & Roles Under GDPR

ABSTRACTSHOP s.r.o. (abstractshop.cz) develops and operates custom websites, web applications, cloud software solutions, and business communication integrations for clients in the Czech Republic and the European Union. This Privacy Policy governs the processing of personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and Czech Act No. 110/2019 Coll., on Personal Data Processing.

• As Data Controller: ABSTRACTSHOP s.r.o. acts as the Data Controller for contact details, business inquiries, and contractual records of our direct clients and website visitors.
• As Data Processor: When providing managed web hosting, booking software, or communication APIs to business clients, ABSTRACTSHOP s.r.o. processes end-user data strictly on behalf of the client under a Data Processing Agreement (GDPR Art. 28).

2. Categories of Personal Data Processed

• Identification & Contact Data: Name, company name, phone number, and email address provided when communicating with us or using our software services.
• Contractual & Billing Data: Company ID (IČO), VAT ID (DIČ), registered address, bank account details, and invoices required for contract fulfillment and statutory accounting.
• Transactional & Service Data: Reservation records, order details, or notification delivery metadata processed through client software systems.
• Technical & Security Logs: IP address, browser type, and server access timestamps required to ensure cybersecurity, prevent abuse, and maintain uptime.

3. Legal Basis & Purpose of Processing (GDPR Art. 6)

• Performance of a Contract — Art. 6(1)(b): Delivering software development, web hosting, and transactional notifications requested by the user or client.
• Legal Obligation — Art. 6(1)(c): Compliance with Czech tax, accounting, and statutory archiving laws (Act No. 563/1991 Coll., on Accounting).
• Legitimate Interest — Art. 6(1)(f): Ensuring network and information security, preventing fraud, and responding to direct business inquiries.
• Consent — Art. 6(1)(a): Optional communications where explicit opt-in consent has been granted (revocable at any time).

4. Data Sharing, Subprocessors & EU Residency

• EU Data Residency: All primary databases and application records are hosted within the European Union with encryption in transit (TLS 1.3) and at rest.
• No Sale of Personal Data: We never sell, rent, or trade personal data or client databases to third parties or advertisers.
• Trusted Infrastructure Providers: Data is processed only by verified infrastructure providers (such as Cloudflare, EU cloud database providers, and authorized telecom/messaging gateways) bound by GDPR Data Processing Agreements.

5. Cookies & Website Analytics

Our website (abstractshop.cz) uses only strictly necessary technical features required for site security and language preference routing. We do not use invasive third-party advertising trackers or cross-site behavioral profiling cookies.

6. Data Retention Period

• Business Inquiries: Retained for up to 12 months if no contractual relationship is established.
• Contractual & Accounting Records: Retained for the duration of the contract and for the statutory period of 10 years required by Czech tax and accounting regulations.
• Client Application Data: Retained strictly according to the instructions of the respective business client and deleted or anonymized within 30 days of contract termination.

7. Your Rights & User Data Deletion Instructions (GDPR Articles 15–22)

Under the GDPR, you have the right to access your personal data, rectify inaccurate data, restrict processing, request data portability, object to processing, and request the erasure (deletion) of your personal data.

How to Request Data Deletion: To request the complete deletion or anonymization of your personal data from any system operated by ABSTRACTSHOP s.r.o., send an email to info@abstractshop.cz with the subject line Data Deletion Request and include the phone number or email address associated with your records. We will verify and complete your deletion request within 14 days (and no later than the statutory 30-day GDPR limit).

Supervisory Authority: You have the right to lodge a complaint with the national supervisory authority — the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic (uoou.gov.cz).