PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA
We are Pity not to buy s.r.o., Company ID No. 14209357, with its registered office at Viktora Huga 468/11, Smichov, 150 00 Prague 5, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague under file no. C 362097 ("we", "us"). We are the controller of your personal data.
We operate an online store at www.pitynottobuy.com (the "e-shop").
We have prepared this Privacy Policy (the "Policy") to inform you about what personal data we process and how we handle it. Here you will find out why and how we process your personal data when you visit our e-shop, place an order, use a customer account, log in via Google or Facebook, use the electronic withdrawal from contract function, make a complaint, subscribe to the newsletter, give consent to reviews, or use our website.
Part of this Policy is also dedicated to cookies and similar technologies.
If you have any questions regarding the processing of your personal data, you can contact us using the following contact details:
- address: Viktora Huga 468/11, Smichov, 150 00 Prague 5, Czech Republic,
- e-mail: toje@skodanekoupit.cz,
- telephone: +420 607 189 999.
We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation ("GDPR"), and Act No. 110/2019 Coll., on the Processing of Personal Data.
How do we obtain your personal data?
You provide some personal data to us yourself, for example when you order goods through the e-shop, create a user account, enter custom text for a product, communicate with us by e-mail, make a complaint, withdraw from a contract, or subscribe to commercial communications.
We obtain some data when you use the e-shop, such as data about your order, payment, delivery, customer account, cookies, and technical data related to the operation of the website.
If you log in or register via Google or Facebook, we may receive basic data provided by these services, in particular your first name, surname and e-mail address.
We may also obtain some data from public registers, lists and records, for example when issuing invoices or checking the accuracy of data.
What personal data do we process?
We mainly process the following categories of personal data:
- basic identification data - for example first name, surname, and, where applicable, Company ID, VAT ID, billing details and address;
- contact details - in particular e-mail address, telephone number, billing address and delivery address;
- order and contract data - ordered goods, selected product variant, payment method, delivery method, price, order status, invoicing, payment, delivery, complaint or withdrawal from the contract;
- data entered for products - for example custom text, name, selected configuration, product variant, colour, size, surface finish or other data you enter when ordering goods;
- user account data - data needed for registration, login, account management, order history and account security;
- data obtained when logging in via Google or Facebook - in particular first name, surname and e-mail address;
- information from mutual communication - the content of e-mails, enquiries, complaints, requests, claims or other communication;
- billing and payment data - data shown on invoices, information about payment, payment method, payment matching and, where applicable, data needed for refunds;
- delivery-related data - data needed for the carrier to deliver the shipment;
- data related to reviews and ratings - for example the e-mail address used to send a satisfaction questionnaire, the link between the review and the order, the rating, the text of the review, the date the review was submitted, and information about verification or moderation of the review;
- data related to electronic withdrawal from the contract - in particular the order number, e-mail address, date of submission, content of the request and data needed for manual assessment of the withdrawal;
- technical data, cookies and similar technologies - data needed for website operation, security, bot protection, consent management, analytics, marketing and personalisation, where we have an appropriate legal basis for doing so.
Why do we process personal data?
We process your personal data mainly for the following purposes:
- creating and processing an order,
- concluding and performing the purchase contract,
- delivering goods,
- processing payment,
- issuing and retaining accounting and tax documents,
- managing the customer account,
- logging in via Google or Facebook,
- merging customer accounts that use the same e-mail address,
- manufacturing or modifying goods according to the customer's instructions,
- handling complaints,
- processing withdrawal from the contract,
- customer communication,
- protecting legal claims,
- ensuring the security of the e-shop and protection against bots, spam and fraudulent conduct,
- sending commercial communications,
- customer reviews and ratings,
- measuring traffic and evaluating marketing campaigns,
- personalising advertisements, where we have your consent,
- fulfilling legal obligations.
What legal bases do we use?
We process personal data, depending on the specific situation, on the basis of the following legal grounds:
- performance of a contract - in particular orders, payments, delivery, customer account, communication concerning the order, complaints and withdrawal from the contract;
- compliance with a legal obligation - in particular accounting, taxes and statutory complaint-handling obligations;
- legitimate interest - in particular protection of legal claims, e-shop security, prevention of misuse, management of customer accounts, technical operation of the website, and direct marketing of our own similar products, provided the statutory conditions are met;
- consent - in particular selected marketing cookies, advertising personalisation, Heureka Verified by Customers, Google Customer Reviews and certain commercial communications where they are based on consent.
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
Order and performance of the contract
When an order is created, we process the data needed so that we can accept and process the order, deliver the goods, issue a document, communicate with you and deal with any complaints or withdrawal from the contract.
Without this data, the order cannot be properly processed.
The legal basis is the performance of a contract and taking steps prior to entering into a contract.
Payments
For payment processing, we mainly use the ComGate payment gateway and bank transfer.
For the purpose of processing the payment, the relevant data may be transferred to the payment gateway provider or to a bank. Processing this data is necessary for payment of the order, matching the payment and any refund.
The legal basis is the performance of a contract, compliance with a legal obligation and our legitimate interest in keeping proper payment records.
Delivery
For the purpose of delivering the ordered goods, we transfer the necessary data to carriers, in particular PPL and Zasilkovna.
We mainly provide carriers with your first name and surname, delivery address, e-mail, telephone number and shipment details.
The legal basis is the performance of the purchase contract.
User account
If you create a user account, we process the data needed to manage this account, provide access to orders, manage customer data and make future purchases easier.
The legal basis is the performance of a contract and our legitimate interest in operating the customer account and securing the e-shop.
The customer may request cancellation of the user account. However, cancellation of the account does not affect personal data processing that we are obliged or entitled to carry out on other legal grounds, for example due to accounting, complaints, protection of legal claims or performance of contractual obligations.
Login via Google or Facebook
If you use registration or login through third-party services, in particular Google or Facebook, these services may provide us with the basic data needed to create or log in to a user account, in particular your first name, surname and e-mail address.
We use this data to create and manage the user account, log the customer in, link the account to their orders and ensure safe use of the e-shop.
If you register or log in in several ways and the individual registrations use the same e-mail address, these access methods may be merged into one customer account. The purpose is to prevent duplicate accounts and enable order management under one account.
The legal basis is the performance of a contract or, where applicable, our legitimate interest in managing customer accounts, securing the e-shop and removing duplicates.
Use of login via Google or Facebook is voluntary. If you do not use this option, you may register or place an order in another way, if offered by the e-shop.
Custom texts and personalised products
For selected products, you may enter custom text, a name, a motif or other data needed to manufacture or modify the product.
We process this data for the purpose of manufacturing, modifying and delivering the ordered goods according to your instructions.
The legal basis is the performance of a contract.
Complaints, withdrawal from the contract and customer communication
We also process personal data when handling complaints, withdrawals from the contract, enquiries, complaints in the broader sense, and other communication with the customer.
This may include, in particular, identification data, contact details, order number, description of the defect, photographs of the defect, information about the requested complaint resolution method, refund details or the content of communication.
The legal basis is the performance of a contract, compliance with a legal obligation and our legitimate interest in protecting legal claims and properly handling customer requests.
Electronic withdrawal from the contract
An electronic function for withdrawal from the contract is available on the e-shop. The link "Withdraw from the contract" is located in the footer of the e-shop.
After clicking this link, the customer may enter the order number and the e-mail address used in the order. A registered customer may also have this function available directly for a specific order in their customer account.
We use the personal data processed when this function is used for the purpose of receiving, recording and manually assessing the withdrawal from the contract or the request for its assessment.
The legal basis is the performance of a contract, compliance with a legal obligation and our legitimate interest in properly handling the customer request and protecting legal claims.
Customer reviews and ratings
We may work with customer reviews and ratings on the e-shop or through third-party services.
This may include in particular:
- the Heureka Verified by Customers service,
- the Google Customer Reviews service,
- our own review system directly in the e-shop.
For the Heureka Verified by Customers and Google Customer Reviews services, we transfer personal data for the purpose of sending a satisfaction questionnaire or verifying a customer review only if the customer actively consents to this during the order process.
For this purpose, we may transfer in particular the customer's e-mail address, order identification and information needed to verify the purchase or send the satisfaction questionnaire.
The legal basis for this processing is the customer's consent.
Consent is voluntary. If the customer does not give consent, this does not affect the possibility of placing an order or the performance of the purchase contract.
Consent may be withdrawn. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
Google reviews are reviews published through Google services. If the customer uses Google services, Google may also process personal data according to its own rules.
If the e-shop enables customers to submit their own reviews directly in the e-shop, for the purpose of verifying the review we may process in particular the link to the order, product, customer account or e-mail, the text of the review, rating, date of submission, information on whether the review is verified, the status of the review and any reason for not publishing or removing it.
We may process our own reviews in the e-shop on the basis of our legitimate interest in displaying verified reviews, preventing fake reviews, transparent moderation and protecting the rights of us, our customers and third parties.
We may moderate reviews in order to protect against vulgar language, spam, unlawful content, personal data of third parties, content unrelated to the product or clearly fake reviews. Moderation is not intended to remove factual negative reviews merely because they are unfavourable to us.
Commercial communications and newsletter
If you are our customer and we obtained your e-mail in connection with the sale of goods, we may send you commercial communications concerning our own similar products and services, unless you have refused such sending. We may send such communications for a period of 3 years from your last purchase, unless you opt out earlier.
If you give us separate consent to receive commercial communications or to other marketing processing, we may also send you commercial communications on the basis of that consent.
For sending commercial communications, we may use the integrated e-mail tool provided by the e-shop solution provider, Irius s.r.o.
You may refuse the sending of commercial communications at any time via the link in each newsletter or by sending an e-mail to our contact address.
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
What about cookies?
For the proper operation of the e-shop, we use cookies and similar technologies. These are small files or other technical identifiers that enable, for example, proper operation of the cart, order process, login, remembering certain settings, measuring traffic, evaluating campaigns, personalising advertising or protecting the website against bots, spam and fraudulent conduct.
What specific cookies do we use?
| Cookie type | What is it called? | What is it used for? | How long does it remain stored? | Who else has access to it apart from us? |
| Essential | SIRIUS-CONSENT-COOKIE-<container-type> | Information on cookie storage preferences | 9 months | no one |
| Essential | cartToken | To identify your shopping basket | 9 months | none |
| Required | last_used_lang | To set the correct language | 9 months | no one |
| Required | PHPSESSID | User ID for communication with the server | 9 months | nobody |
| Required | eu-cookies | Cookie preferences from 2021 | - | None |
| Essential | _ga_<container-id> | Used to maintain session state. | 2 years | |
| Analytics | _ga<container-id> | For measuring website traffic | 1 day | |
| Analytics | _gid | Used to distinguish between users. | 1 day | |
| Analytics | _ga | Used to distinguish between users. | 2 years | Google, Heureka |
| Marketing | _gac_gb_<container-id> | Contains information related to the campaign. If you have linked your Google Analytics and Google Ads accounts, Google Ads website conversion tags will read this cookie unless you log out. | 3 months | |
| Marketing | APISID | Google collects information about visitors to videos hosted on YouTube. | Persistent | |
| Marketing | SID | Personalised Google adverts on websites based on recent searches and interactions. | 2 years | |
| Marketing | 1P_JAR | |||
| Marketing | AEC | |||
| Marketing | AdminTopBarClosed | Close the information bar | 1 month | no one |
| Marketing | CONSENT | permanent | ||
| Marketing | DV | |||
| Marketing | HSID | |||
| Marketing | NID | |||
| Marketing | OTZ | |||
| Marketing | S | with session expiry | ||
| Marketing | SAPISID | |||
| Marketing | SEARCH_SAMESITE | |||
| Marketing | SESSID_PHP | 1 month | Heureka | |
| Marketing | SID | 2 years | ||
| Marketing | SIDCC | |||
| Marketing | UULE | |||
| Marketing | __Secure-1PAPISID | |||
| Marketing | __Secure-1PSID | |||
| Marketing | __Secure-3PAPISID | |||
| Marketing | __Secure-3PSID | |||
| Marketing | __Secure-3PSIDCC | |||
| Marketing | __gfp_64b | Heureka | ||
| Marketing | __gsync_gdpr | Heureka | ||
| Marketing | _gat_ | Heureka | ||
| Marketing | _gcl_au | Heureka | ||
| Marketing | _hjSessionUser_<container-id> | 1 year | Heureka | |
| Marketing | _hjid | 1 year | Heureka | |
| Required | chosenCountry | Saves country selection | with session expiry | none |
| Marketing | didomi_token | 1 year | Heureka | |
| Marketing | euconsent-v2 | 1 year | Heureka | |
| Marketing | exports | with session expiry | ||
| Marketing | gtm_<container-type> | with session expiry | ||
| Marketing | heureka_<container-type> | weekly to permanent | Heureka | |
| Marketing | hrk_onweb | 1 month | Heureka | |
| Required | last_used_lang | To select the correct language | 6 months | no one |
| Marketing | nette-browser | Browser type | with session expiry | Heureka |
| Required | newsletterSubscriptionModal | To prevent the newsletter window from appearing | 1 day | No one |
| Marketing | ocm_consent | Heureka | ||
| Marketing | session | with session expiry | Heureka | |
| Marketing | widget_capping_<container-id> | 1 month | Heureka | |
| Marketing | yottly-client-id | with session expiry | Heureka |
Necessary for website operation
These technologies are necessary for the proper operation of the e-shop, cart, order process, login, security, storing consent settings and protecting the website against misuse. Without them, the e-shop might not function properly or securely. These cookies and technologies cannot be disabled through the cookie banner. Necessary technologies also include Google Fraud Defense, if it is used only for the purpose of protecting forms, orders and the website against bots, spam and fraudulent conduct. Google Fraud Defense runs in the basic e-shop setup and its operation cannot be restricted by ordinary cookie consent.
Analytics cookies
Analytics cookies help us measure e-shop traffic, monitor how the website is used, where visitors come from and how we can improve the e-shop. We mainly use Google Analytics 4 and the related Google Tag / GTAG tools. We use analytics cookies only where we have an appropriate legal basis for doing so, in particular your consent, if required.
Marketing cookies
Marketing cookies help us evaluate marketing campaigns, measure their effectiveness and display more relevant advertising. We mainly use Google Ads / AdWords, Meta Pixel and Meta Conversions API. We use marketing cookies and advertising technologies only where we have an appropriate legal basis for doing so, in particular your consent, if required.
Personalisation and advertising data for partners
These technologies may enable advertising personalisation or the transfer of selected advertising signals to external partners, in particular Google and Meta/Facebook. We use them only where we have an appropriate legal basis for doing so, in particular your consent. You can give, refuse or adjust your consent to cookies through the cookie banner. You may later change or withdraw your consent if this function is available on the website. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
What specific cookies do we use?
A technical table of the specific cookies and similar technologies used on the e-shop will be provided here.
We recommend keeping the current cookie table as a technical annex to this Policy, but it must be updated on an ongoing basis according to the cookies and tools actually used.
Before deploying the new version, it is advisable to verify in particular:
- that Google Analytics cookies are not incorrectly classified as necessary,
- that Google Fraud Defense technologies are classified as necessary security technologies,
- that Meta Pixel and Meta Conversions API are listed as marketing / advertising technologies,
- that Heureka cookies are listed according to their actual use,
- that the table corresponds to the categories in the cookie banner.
Who else has access to your personal data besides us?
We also involve other persons and services in the processing of personal data. Some of them act for us as personal data processors, while others may be independent controllers if they process personal data for their own purposes according to their own rules.
We transfer or make personal data accessible only to the extent necessary for the given purpose.
This may mainly include the following persons, services and categories of recipients:
- persons involved in operating the e-shop and customer support;
- the provider of the e-shop solution, technical operation of the e-shop and integrated e-mail tool, in particular Irius s.r.o.;
- accountants and persons providing accounting and tax services, in particular Barbora Mitrova;
- payment service providers, in particular the ComGate payment gateway and banks;
- carriers, in particular PPL and Zasilkovna;
- providers of customer rating and review services, in particular Heureka Verified by Customers and Google Customer Reviews;
- login service providers, in particular Google and Facebook/Meta, if you use login through these services;
- providers of analytics, advertising and marketing tools, in particular Google Analytics 4, Google Tag / GTAG, Google Ads / AdWords, Meta Pixel and Meta Conversions API;
- providers of security and anti-spam technologies, in particular Google Fraud Defense;
- public authorities, where such an obligation is imposed on us by law.
The accounting agenda is processed by an accountant outside a cloud environment. If the accountant uses her own accounting software, personal data is processed in it only to the extent necessary for accounting, tax obligations and related legal obligations.
Is personal data transferred outside the European Union?
Some tools, in particular Google, Meta/Facebook or other analytics, advertising, security and marketing services, may in certain cases involve the processing of personal data outside the European Union or the European Economic Area.
If such transfer takes place, it is carried out only under the conditions laid down by law, in particular on the basis of an adequacy decision, standard contractual clauses or other appropriate safeguards under the GDPR.
How long do we retain personal data?
We retain personal data only for as long as necessary for the relevant purpose.
Data related to orders, contract performance, accounting and tax obligations is retained for the period required by law.
Data related to complaints, withdrawal from the contract, customer communication or legal claims is retained for the period needed to deal with the matter and subsequently for the period necessary to protect legal claims.
Data in the user account is retained for the duration of the account and, where applicable, for the period necessary for related contractual, statutory or legitimate purposes.
Data processed on the basis of consent is retained until consent is withdrawn or until the purpose of processing ceases to exist.
Data used for commercial communications is retained until you unsubscribe, withdraw consent or object to direct marketing.
What rights do you have in connection with the processing of personal data?
As the personal data controller, we are obliged to ensure that your personal data is processed properly, securely and transparently.
In connection with the processing of personal data, you have in particular the following rights:
- the right of access to personal data,
- the right to rectification of inaccurate or incomplete data,
- the right to erasure of personal data,
- the right to restriction of processing,
- the right to object to processing,
- the right to data portability,
- the right to withdraw consent where processing is based on consent,
- the right to lodge a complaint with the Office for Personal Data Protection.
If we process personal data for direct marketing purposes, you have the right to object to such processing at any time. In that case, your personal data will no longer be processed for direct marketing purposes.
Where processing is based on your consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
You may exercise your rights in writing, by e-mail or by telephone using the contact details provided above.
If you suspect that your personal data is being processed unlawfully, you have the right to lodge a complaint with the Office for Personal Data Protection.
Changes to this Policy
We may update this Policy, in particular in the event of changes to legislation, services used, the technical solution of the e-shop or the way personal data is processed.
The current version of the Policy is always available on www.pitynottobuy.com
This Policy is valid from 23. 06. 2026.
