Privacy Policy

Data Controller (the Seller):
Jaroslav Sokol, Company ID: 17098831, Registered address: Jicinska 49, 130 00 Prague 3, Czech Republic. Operator of the Moldara Jewelry e-shop (www.moldarajewelry.com)

Contact details: Email: info@moldarajewelry.com . Phone: +420 725 420 400

As the data controller, we process your personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and related legislation.
This Privacy Policy explains what data we collect about visitors and customers of our online store, how we use and protect this data, and what rights you have in this regard.

1. What personal data we process

We only process personal data that you provide to us or that we collect from your use of our services, and only to the necessary extent. This includes in particular:

• Identification and contact data for order processing: name, surname, delivery address, email, phone number. We collect this data as part of the order process on our e-shop.
  
  
• Data for creating a user account: (If the e-shop allows registration) login name, password (stored in encrypted form), and possibly other optional data in the user profile. (Note: our e-shop currently does not support user account registration; purchases are made without registration).
  
  
• Data for sending the newsletter: email address. We process it if you subscribe to the newsletter.
  
  
• Data from the contact form: name, surname, email, and possibly other information you provide in the message. We process this data if you contact us via the web form with a question or inquiry.
  
  
• Technical data about website visits: IP address, cookies, and possibly data about your device and browser. We collect this data to ensure the basic functionality of the website, analyze traffic, and maintain the security of our systems. Cookies are only used with your consent, if required by law (see our Cookie Policy – if available).
  
  

We do not process any sensitive personal data of special categories (such as data on health status, biometric data, etc.). Our services are not intended for children under the age of 16; we do not knowingly collect such data.

2. Purpose and legal basis for processing personal data

We use all collected personal data solely for legitimate purposes and only to the necessary extent. Specifically, we process data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): Data required to process your order – in particular, identification and delivery details. This data is necessary for us to conclude and fulfil the purchase contract (to deliver the goods you ordered). This also includes communication regarding the order (order confirmation, shipping updates, handling of complaints, etc.). Providing identification and delivery details is a contractual requirement necessary to conclude and perform the purchase contract. If you do not provide this data, we cannot process your order.

• Compliance with legal obligations (Art. 6(1)(c) GDPR): Some data must be processed to comply with legal requirements. For example, we retain data on tax documents (invoices) for the period required by accounting and tax laws. We also process and retain your data when handling complaints, as required by the Civil Code and the Consumer Protection Act (e.g. maintaining a complaint protocol).
  
  
• Consent (Art. 6(1)(a) GDPR): We process your email address for the purpose of sending newsletters only based on your voluntary consent. The newsletter will only be sent if you have granted us consent (e.g. by filling in a subscription form and confirming it). You can withdraw your consent at any time – see section 5 below (Data Subject Rights). Withdrawal of consent does not affect the lawfulness of processing prior to the withdrawal.
  
  
• Legitimate interest (Art. 6(1)(f) GDPR): Data provided via the contact form or by email is processed for the purpose of responding to your inquiry or request. We consider this our legitimate interest – to respond to your messages and maintain customer satisfaction. If your inquiry relates to a potential contract (e.g. a custom product inquiry), such processing may also be considered processing for taking steps prior to entering into a contract at your request.
  
  
• Legitimate interest – website security and functionality: Technical data (IP address, cookies necessary for website functionality) is processed to ensure the security of our website, prevent fraud, and maintain basic website functions. This processing is based on our legitimate interest in operating a secure and user-friendly website. For cookies used for marketing and analytics, we always request your consent (see our separate Cookie Policy for details).
  
  

We do not use your data for any other purposes such as automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.

3. Who may have access to your data

We do not share your personal data with any third parties for their own marketing purposes. However, in order to properly operate our e-shop and fulfil contracts, we use the services of partners who may have access to your data to the necessary extent. These include in particular:

• Shipping companies (carriers): Carriers of your choice who deliver the ordered goods. We provide them with your contact and delivery information (name, address, phone number, and possibly email) for the purpose of delivery and shipment tracking.
  
  
• Payment gateways / payment intermediaries: If you pay online (by card, Google Pay, Apple Pay, etc.), the payment is processed through an external payment gateway (e.g. Comgate Payments, PayU, etc. – to be specified based on the service actually used). These providers process your payment data (card number, etc.) and notify us of the payment result. We do not store your card details ourselves.
  
  
• Web hosting provider: The operator of the servers and technical infrastructure that runs our e-shop (may be an external hosting provider). This provider may access personal data stored in the e-shop database, but only for system maintenance and administration – not for their own use.
  
  
• Accounting or tax advisor: If necessary, your billing data may be accessed by entities that provide us with accounting, tax consultancy, or auditing services – but only to the extent necessary to fulfil our legal obligations.
  
  
• Public authorities: Your data may be disclosed if required by law or legal process (e.g. audit by tax authorities, request from the police, etc.).
  
  

We have signed data processing agreements with all processors who process personal data on our behalf, which ensure the protection of your data. All such processors are bound by confidentiality and must not use your data for any other purpose.

4. How long we store your data

We store personal data only for the strictly necessary period with regard to the purposes of processing:

• Order, invoice and payment data: 10 years from the end of the tax period in which the tax document was issued, in accordance with the requirements of accounting and tax laws.
  
  
• Data obtained for handling complaints: 5 years from the resolution of the complaint, for the purpose of documenting the process and result of the complaint procedure (as required by consumer protection law).
  
  
• Data from contact (e-mails, messages) not leading to contract conclusion: up to 1 year after your query or request has been resolved, in case of any follow-up communication. If the communication leads to the conclusion of a contract (e.g. a request and subsequent custom jewelry order), it becomes part of the contractual documentation and is stored under the same rules as orders above.
  
  
• E-mail addresses for newsletters: until you withdraw your consent (unsubscribe) or until we stop sending newsletters. Your email address will be deleted from the mailing list database immediately afterward.
  
  
• Technical logs and access records: typically 30 days for standard website operation logs, unless longer retention is required for security reasons. Cookies have different durations – see the cookie settings on our website for details.
  
  

Once the above retention periods expire, the data is securely deleted or anonymized, unless we have another legal reason to retain it (e.g. in case of ongoing legal proceedings, we may need to retain data longer to prove facts).

5. How is your data secured

We take care to ensure that your personal data is safe with us. We have implemented technical and organizational measures to protect data against loss, misuse, or unauthorized access. These measures include, for example: encrypted connection (HTTPS) on our website, firewall and antivirus protection on servers, regular updates of the e-shop system, limited access to the database only for authorized personnel, secure backup storage, etc.

If, despite all measures, a personal data breach occurs that poses a risk to your rights, we undertake to act in accordance with the GDPR – in particular to notify the Data Protection Authority and, where required, also inform you as the data subject.

6. Your Rights in Connection with Personal Data

In accordance with applicable legal regulations, you have the right to contact us at any time and exercise your rights concerning the processing of your personal data. Specifically, you have the following rights:

• Right of access to personal data – you can ask us to confirm whether we process your personal data, and if so, you have the right to obtain a copy of such data and information on how we process it.
  
  
• Right to rectification – if you find that we hold inaccurate or incomplete data about you, you have the right to request that it be corrected or completed.
  
  
• Right to erasure (“right to be forgotten”) – you have the right to request the deletion of your personal data if it is no longer needed for the specified purposes or if the processing was unlawful. Please note that the right to erasure is not absolute – e.g., we cannot delete data we are legally required to retain (invoices, etc.), or data necessary for the establishment, exercise or defense of legal claims.
  
  
• Right to restrict processing – in certain cases, you may request that we restrict the processing of your data (e.g., if you dispute the accuracy of the data, for the period during which we verify it; or if you object to the processing and we are assessing whether our legitimate grounds override yours). During the restriction period, we may only store the data and use it in limited cases (e.g., for legal claims).
  
  
• Right to data portability – if your data is processed automatically based on your consent or a contract, you have the right to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller. Alternatively, you may request that we transmit it directly to another controller, where technically feasible.
  
  
• Right to object – if we process your data based on our legitimate interest, you have the right to object to such processing at any time. If the objection concerns processing for direct marketing purposes (e.g., promotional emails based on legitimate interest), we will stop processing your data for this purpose. In other cases, we will stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights or freedoms, or for the establishment, exercise or defense of legal claims.
  
  
• Right to withdraw consent at any time – if the processing is based on your consent (e.g., newsletter subscription), you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. Unsubscribing from the newsletter is considered withdrawal of consent to receive marketing communications.
  
  
  

Right to lodge a complaint:

 If you believe that your personal data has been processed in violation of legal regulations, you have the right to lodge a complaint with a supervisory authority. In the Czech Republic, this is the Office for Personal Data Protection (ÚOOÚ) – Address: Pplk. Sochora 27, 170 00 Prague 7, Website: www.uoou.cz. However, we would appreciate the opportunity to address your concerns first, so please contact us before taking any formal steps.

Exercising your rights:

You may exercise your rights by sending a request to our email: info@moldarajewelry.com or by post to our mailing address. We will respond to your request without undue delay, but no later than 1 month from its receipt. In exceptional cases, this period may be extended by 2 additional months (we will inform you of such an extension). To ensure the protection of your data, we may request reasonable verification of your identity (e.g., confirmation from your registered email address or other supporting information) to prevent unauthorized access to the personal data of others.

7. Use of Cookies and Tracking Technologies

Our website uses cookies and similar technologies to distinguish between users and tailor content to you. Cookies are small text files stored in your browser. Our website uses the following types of cookies:

• Technical and functional cookies: These are essential for the proper functioning of the website and the order process (e.g., keeping items in your cart, user login). These cookies are processed based on our legitimate interest and their use is necessary – they cannot be turned off if you wish to use our website.
  
  
• Analytics cookies: These help us improve the website by anonymously tracking traffic and user behavior (e.g., Google Analytics). We use them only with your consent (you will have the option to accept or reject them on your first visit).
  
  
• Preference and marketing cookies: These are used, for example, to personalize content or for marketing purposes (retargeting). These cookies are set and used only based on your consent.
  
  

You can find detailed information about the individual cookies and their validity in our Cookie bar or in a dedicated Cookie Policy (if published on our website). You may withdraw your consent to optional cookies at any time by changing your cookie settings (usually via a link in the website footer) or by adjusting your browser settings.

8. Final Provisions

These Privacy Policy terms may be updated from time to time to reflect any changes in our processing of personal data or legal updates. A new version will always be published on this page, and the effective date will be stated below. We recommend checking this page regularly to stay informed about the current version of the policy.

If we plan to make significant changes to how we process your data, we will notify you appropriately (e.g., via email to registered newsletter subscribers or through a notice on our website during your next visit).

If you have any questions about this Privacy Policy or the processing of your personal data in general, do not hesitate to contact us at info@moldarajewelry.com.

Effective date of this Policy: July 1, 2025.

Additional Supplementary Information

Method of Notifying Changes

If we make any significant changes to this Policy, we will inform you by e-mail (if you are subscribed to our newsletter) or through a prominent notice on our website.

Data Transfer Outside the EU/EEA:

Some service providers (e.g., Google Analytics) may transfer your data outside the EU, particularly to the USA. Such transfers are safeguarded by the European Commission’s Standard Contractual Clauses. Where we transfer personal data outside the EU/EEA, we rely on the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You can obtain a copy of the relevant safeguards by contacting us at info@moldarajewelry.com.