Privacy Policy
Privacy Policy
Your data should be treated with the same care as your order.
This policy explains what personal data we use, why we need it, who may receive it and how you stay in control. We have written the important points first and the complete details below.
The essentials
The short and clear version.
These points are only a friendly overview. The complete Privacy Policy below contains the full information required by law.
We use what we need to fulfil your order
This includes contact, delivery, order and payment information, plus communication about returns, complaints or customer support.
Your full card number is not normally shared with us
Card and wallet payments are processed by the selected payment provider. We usually receive only the payment status and information needed to match it to your order.
You can say no at any time
Newsletter subscribers may withdraw consent, and existing customers may object to offers for similar Ekokoza products. Every marketing email includes an unsubscribe option.
Optional cookies wait for your choice
Necessary cookies keep the shop working. Analytics, personalisation and advertising cookies are activated only after the required consent.
We share data only where there is a reason
For example with carriers, payment providers, our e-shop and email platforms, accountants, IT providers and authorities where the law requires it.
You remain in control
You may ask what data we hold, correct it, request deletion or restriction, receive portable data, object to certain uses or complain to a supervisory authority.
Complete policy
Privacy Policy of Ekokoza.com
Data controller
Naturele s.r.o.
Fryčovice 297, 739 45 Fryčovice, Czech Republic
Company details
Company ID: 17824516
VAT ID: CZ17824516
Commercial Register: Regional Court in Ostrava, Section C, File 95872
Website
www.ekokoza.com
This policy applies to the website, customer accounts, orders and related customer communication.
1. What data we may process
Depending on how you use Ekokoza.com, we may process:
- identification and contact data, such as your name, billing and delivery address, email address, telephone number, company name, company ID and VAT number;
- order and transaction data, including products, quantities, prices, discounts, delivery method, payment method, payment status, invoices and order history;
- account data, including login details, saved addresses, preferences and account activity;
- communication data, such as emails, customer-service requests, complaints, returns, photographs and declarations relating to delivery or non-receipt;
- payment and refund data, such as the payment status, transaction reference and bank account information where needed for a transfer or refund;
- marketing preferences, newsletter subscriptions, consent records, objections, unsubscribes and engagement with our communications;
- technical and usage data, such as IP address, device and browser information, security logs, website activity and cookie identifiers; and
- other information you choose to provide, for example in a review, survey, individual enquiry or special-order request.
We do not normally need your date of birth, national identification number or gender for an ordinary purchase and do not ask for such data unless there is a specific lawful reason.
2. Why we use personal data
Orders, delivery and payment
To accept and process your order, receive payment, arrange delivery, send transactional messages and provide the products you requested.
Legal basis: performance of a contract or steps taken at your request before entering into a contract.
Customer account
To create and maintain your account, save your chosen settings and make your order history available to you.
Legal basis: performance of the account service requested by you.
Questions, returns, complaints and carrier claims
To communicate with you, assess what happened, organise a return or replacement and establish, exercise or defend legal claims.
Legal basis: performance of the contract, compliance with legal obligations and our legitimate interest in resolving cases fairly and keeping evidence.
Accounting, tax and regulatory records
To issue and retain invoices and records required by accounting, tax, consumer-protection and other applicable laws.
Legal basis: compliance with a legal obligation.
Website security, fraud prevention and service improvement
To protect the website and accounts, investigate suspicious activity, prevent abuse, diagnose technical problems and improve the reliability of our services.
Legal basis: our legitimate interests in security, fraud prevention, service quality and the protection of legal rights.
Newsletters and marketing
To send newsletters where you have subscribed, or offers for our own similar products to existing customers where permitted by law. You can unsubscribe or object at any time.
Legal basis: consent for subscribers who are not existing customers; legitimate interest and the applicable existing-customer marketing exception where legally available.
Analytics, personalisation and advertising
To understand how the website is used, personalise content and measure or improve advertising, where these activities rely on non-essential cookies or similar technologies.
Legal basis: your consent where required. Necessary security and technical measurements may be based on our legitimate interests or the need to provide the service.
3. Where the data comes from
Most data comes directly from you when you browse the website, create an account, place an order or contact us.
We may also receive limited information from:
- payment providers, such as confirmation that a payment was successful, failed or refunded;
- carriers and pickup-point operators, such as tracking and delivery status;
- cookie, analytics and advertising providers, where you have made the relevant choice;
- public registers where needed to verify business-customer details; and
- another person placing an order for you or naming you as the recipient.
If someone gives us another person’s details, they should ensure that the person is aware of this Privacy Policy.
4. Who may receive the data
We share only the information reasonably needed for the relevant task. Recipients may include:
- carriers, postal operators, pickup-point networks and customs-service providers;
- payment providers and banks selected for the transaction;
- our e-shop, hosting, cloud, email, customer-support, security and IT providers;
- Ecomail and other services used for newsletters and marketing automation;
- Google services used for business communication, hosting, analytics or data processing where applicable;
- accountants, tax advisers, auditors, insurers and professional advisers;
- review or feedback services where you choose to submit feedback;
- public authorities, courts, regulators or law-enforcement bodies where disclosure is required or legally justified; and
- a purchaser, successor or adviser involved in a genuine corporate transaction, subject to appropriate confidentiality and legal safeguards.
Some partners act as our processors and may use the data only on our documented instructions. Others, particularly payment providers, carriers and public authorities, may act as independent controllers for parts of their services.
5. Transfers outside the European Economic Area
Some technology or service providers may process data outside the European Economic Area.
Where this happens, we use a lawful transfer mechanism, such as:
- an adequacy decision adopted by the European Commission;
- participation in an officially recognised framework where applicable;
- the European Commission’s Standard Contractual Clauses together with any necessary supplementary safeguards; or
- another transfer mechanism permitted by data-protection law.
You may contact us for more information about the safeguards relevant to your data.
6. How long we keep the data
We do not keep personal data forever. The exact period depends on why we need it:
- orders, invoices and tax records: for the statutory accounting and tax-retention periods, generally up to 10 years after the end of the relevant calendar or accounting period where required;
- customer account: while the account remains active or until you ask us to close it, after which we retain only data still needed for orders, legal duties, security or claims;
- customer service, returns and complaints: for the time needed to resolve the case and normally for the applicable limitation period afterwards, generally up to 3 years unless a dispute, legal duty or local rule requires longer;
- newsletter and marketing records: until you unsubscribe, object or withdraw consent; we may retain a minimal suppression record so that we can respect your choice;
- cookie and online identifiers: for the lifetime stated in the cookie settings or until you withdraw consent or delete the relevant cookie; and
- security and technical logs: only for as long as reasonably necessary for security, troubleshooting and evidence, typically no longer than 12 months unless an incident requires longer retention.
We may retain information longer where required by law, an authority or an ongoing legal claim. Once data is no longer needed, we delete it or anonymise it.
7. Cookies and similar technologies
Necessary cookies and similar technologies support functions such as the shopping cart, checkout, account login, language settings, security and remembering your privacy choices. They may be used without consent where they are strictly necessary.
Analytics, personalisation, advertising and other non-essential technologies are activated only after the consent required by law. Closing or ignoring the cookie panel is not consent.
You can accept, reject or adjust optional categories in the cookie panel. The options to accept and reject optional cookies should be equally easy to find. You can change your choice later through the Cookie Settings link in the website footer.
The cookie settings provide more detailed information about the categories, providers, purposes and storage periods currently used on the website.
8. Newsletters and direct marketing
If you subscribe to the newsletter without being an existing customer, we send it on the basis of your consent. You may withdraw that consent at any time.
If you buy from us, we may send you offers for our own similar products where this is permitted by applicable law and you have not opted out. This processing is based on our legitimate interest in maintaining a customer relationship together with the relevant electronic-marketing rules.
Every marketing email contains a simple unsubscribe option. You may also object by emailing [email protected]. Once you object to direct marketing, we stop using your data for that purpose.
Transactional messages about an order, account, service interruption, safety notice or change to legal documents are not marketing and may still be sent where necessary.
9. Your data-protection rights
Subject to the conditions in the GDPR, you may ask us to:
- confirm whether we process your personal data and provide access to it;
- correct inaccurate or complete missing data;
- erase data that is no longer needed or has been processed unlawfully;
- restrict processing in specific situations;
- provide data you gave us in a structured, commonly used, machine-readable format where the right to portability applies;
- object to processing based on legitimate interests for reasons relating to your situation;
- object at any time to direct marketing, including related profiling;
- withdraw consent at any time, without affecting processing carried out before withdrawal; and
- request human review where a decision producing legal or similarly significant effects is based solely on automated processing.
These rights are not absolute. For example, we may need to retain invoice data because the law requires it, or retain evidence needed for a legal claim.
Send your request to [email protected]. We may ask for information needed to verify your identity. We respond without undue delay and normally within one month. Requests are usually free of charge.
10. Automated decisions and personalisation
We do not normally make decisions about customers based solely on automated processing where the decision would have legal or similarly significant effects.
Where you have made the relevant privacy choice, we may use purchase history, browsing behaviour or marketing engagement to personalise recommendations and communications. You may withdraw consent or object to direct marketing at any time.
11. How we protect the data
We use technical and organisational measures appropriate to the risk, including access controls, secure connections, backups, system monitoring, staff access rules and contractual safeguards with service providers.
No online service can promise absolute security. If a personal-data breach is likely to create a high risk to you, we will inform you as required by law and explain the practical steps you can take.
12. Complaints and supervisory authorities
Please contact us first at [email protected]. We prefer to understand the issue and resolve it directly.
Our lead supervisory authority is:
Office for Personal Data Protection
Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
uoou.gov.cz/en
You may also lodge a complaint with the data-protection authority in the EU or EEA country where you live, work or believe the infringement occurred.
13. Changes to this policy
We may update this policy when our services, providers or legal obligations change. The current version is always published on Ekokoza.com.
If a change materially affects how we use your data, we will provide an appropriate notice before the change takes effect where required.
This Privacy Policy takes effect on 4 August 2026.