Privacy policy
1. Who processes your data
Controller: Pelješko vino s.r.o., Company ID (IČ) 04943686, Dominikánské náměstí 256/3, 412 01 Litoměřice, Czech Republic, registered in the Commercial Register kept by the Regional Court in Ústí nad Labem (Krajský soud v Ústí nad Labem), Section C, File 37310.
Contact for personal data matters: peljesko.vino@gmail.com, or by letter to the address of our registered office.
We have not designated a data protection officer, because the law does not require us to.
2. What we process, why and for how long
2.1 Orders and their handling
Data: first name and surname, e‑mail, telephone (if you give it), delivery address, billing details (for companies the company name, Company ID, Tax ID), the goods ordered, the price, the payment method and its status, the language of the order, the options chosen (dedication text, gift message), communication about the order. For card payments we do not see the card number - Stripe gives us only the result of the payment, the card type and the last 4 digits.
Data of the gift recipient: if you send the book as a gift, we process the name and address of the recipient that you give us only to deliver the parcel. We send the recipient nothing else.
Why: conclusion and performance of the purchase contract (handling and dispatch of the book, e-mails about the order status).
Legal basis: performance of a contract (Article 6(1)(b) GDPR); for the data of the gift recipient, our legitimate interest in delivering the gift (Article 6(1)(f) GDPR).
How long: while the order is being handled and then 5 years from delivery because of possible complaints and contractual claims. Accounting documents longer, see 2.4.
Providing the data is a contractual requirement; without it we cannot deliver the book.
2.2 Orders and questions by e‑mail
Data: everything you write to us (typically name, address, e‑mail, content of the order or question).
Why: answering questions.
Legal basis: performance of a contract or steps prior to entering into it (Article 6(1)(b) GDPR); for general questions, our legitimate interest in answering you (Article 6(1)(f) GDPR).
Where: we receive e-mails in a Gmail mailbox (Google).
How long: e-mails about orders as long as the orders (5 years from delivery); other questions 1 year after they have been dealt with.
2.3 Withdrawal from the contract and complaints
Data: identification and contact details, order number, content of the statement, date and time of sending, description of the defect, photos, manner of handling, account number for the refund.
Why: handling your withdrawal or complaint and refunding the money.
Legal basis: compliance with legal obligations (Article 6(1)(c) GDPR - the Civil Code, the Consumer Protection Act) and performance of a contract.
How long: as long as the order (5 years from delivery), documents on refunds as accounting documents (2.4).
Online withdrawal: the withdrawal form on the website stores only the data from the statement (name, e‑mail from the order, order number, books, the reason if you give one, and the date and time of sending), not the IP address or browser data. Looking up the order by number and e‑mail is protected by Cloudflare Turnstile; to prevent abuse we store for one hour only a hash of the IP address, not the address itself.
2.4 Accounting and taxes
Data: the data on invoices and documents (name or company name, address, Company ID or Tax ID, goods, price, payment).
Why: compliance with obligations under the Accounting Act and tax regulations.
Legal basis: legal obligation (Article 6(1)(c) GDPR).
How long: 10 years from the end of the accounting period in which the document was created.
2.5 Operation and security of the website
Data: IP address, time of access, page requested, browser type (technical server logs).
Why: ensuring operation and security and fixing errors.
Legal basis: legitimate interest (Article 6(1)(f) GDPR).
How long: technical logs at most 30 days.
2.6 Traffic analytics
We measure traffic with Cloudflare Web Analytics. It uses no cookies or other storage in the browser, does not track individual visitors across websites and creates no profiles. We see only aggregate statistics (numbers of page views, where visitors came from, device type, country). The IP address is processed only transiently to create these aggregates.
Legal basis: legitimate interest in finding out how the website is used (Article 6(1)(f) GDPR). We do not need consent, because we store nothing on your device.
Our own visit count: to know which pages are read and how many visitors look at the book and order it, we also count visits ourselves, on our server. We use no cookies or other storage in your browser for this. Your browser sends us only the page address (without parameters) and the type of event (page view, click on a link or button leading to the book, such as the Buy button, opening of the book sample, start of payment, signup for a stock notice). So as not to count a visitor more than once a day, we create a one-way hash from the IP address and the browser type with a random key that changes every day. We delete the hash and the key after the end of the day, in the clean-up run at 0:05 Prague time (if it fails, it is repeated every hour). We do not store the IP address or the browser type for the count (technical server logs see point 2.5). We also store the country of the visit as determined by the Cloudflare network, only as an aggregate daily count. We keep only aggregate daily counts. Legal basis: legitimate interest in finding out how the website is used (Article 6(1)(f) GDPR).
In addition to Cloudflare Web Analytics we use Google Analytics 4 (provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), but only if you give your consent in the cookie bar.
- Data: a pseudonymous browser identifier (cookie), pages viewed, events (for example starting an order), approximate location derived from the IP address (Google Analytics 4 does not store the IP address), device and browser type, source of the visit.
- Why: a more detailed evaluation of the traffic and success of the website.
- Legal basis: your consent (Article 6(1)(a) GDPR and Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications).
- Without consent Google Analytics is not loaded at all (Consent Mode in basic mode).
- How long: Google keeps user-level and event-level data for 14 months; aggregate reports longer. Cookies see section 5.
- You can withdraw your consent at any time with the "Cookie settings" link in the website footer.
- Google may transfer data to the USA (see section 4). We do not use Google Signals or share data with Google for advertising.
2.7 Availability alerts and news about the book
Data: e‑mail, the edition you are watching, the language of the page, the time of signing up and a random code for unsubscribing. If you also tick the box for news about the book, we separately record the e‑mail, language and time of that consent.
Why: confirmation of the signup and one notice that a sold-out edition is back in stock (with a link to the order); with the second, optional consent, occasional news about the book.
Legal basis: your consent (Article 6(1)(a) GDPR), for the notice and for the news each separately. You can withdraw your consent at any time with the unsubscribe link in each of these e-mails, or by e‑mail to peljesko.vino@gmail.com. When you unsubscribe, we delete your availability alert and your consent to receive news.
How long: the availability alert until the notification is sent, after which we delete the address from the list; if the edition does not come back in stock, at most 12 months from signing up. The consent to receive news until you unsubscribe. We do not keep sent e-mails in our database; operational delivery records are kept by the mailing provider (Resend, section 3).
Protection of the form: the form is protected by Cloudflare Turnstile. To prevent abuse we store for one hour only a hash of the IP address, not the address itself.
We do not pass the list of consents to receive news to any other service. If we start using another service for sending news, we will add it to section 3 before we pass the list to it.
3. To whom we disclose data
We do not sell data. We disclose it only to these recipients, to the extent necessary for the purpose concerned:
| Recipient | What they do for us | Role |
|---|---|---|
| Cloudflare, Inc. (USA) | website hosting, security, Web Analytics | processor |
| Stripe Payments Europe, Ltd. (Ireland) | processing of online payments | processor when carrying out the payment; separate controller for fraud prevention, anti-money-laundering and regulatory obligations and for Stripe services you use directly (for example Link) - under Stripe's policy: https://stripe.com/privacy |
| Resend (USA) | sending e-mails about orders (confirmation, dispatch, withdrawal) and availability-alert e-mails (confirmation, notification) | processor; e-mails are sent from the EU (Ireland), operational records are stored by Resend in the USA |
| Google (Google LLC, USA / Google Ireland Limited, Ireland) | Gmail mailbox (receiving e‑mail orders and correspondence); Google Analytics 4 - only with your consent | e‑mail service provider; processor (Google Analytics 4) |
| Česká pošta, s.p.; Zásilkovna s.r.o.; for parcels abroad the postal or parcel service concerned | delivery of the parcel (name, address, telephone, e‑mail for the delivery notice) | separate controllers |
| public authorities | only where the law requires us to (for example the tax office, the Czech Trade Inspection Authority) | separate controllers |
4. Transfers outside the EU
Some of our suppliers (Cloudflare, Stripe, Resend, Google) may also process data in the United States. The transfer is protected by the European Commission's adequacy decision for the EU-US Data Privacy Framework, in which these suppliers participate, and by standard data protection clauses adopted by the European Commission, which are part of their data processing agreements.
We will provide you with a copy of the relevant safeguards on request.
5. Cookies
We use a strictly necessary technology without which the website cannot work securely: Cloudflare may set a security cookie (for example __cf_bm) to protect against abuse. Stripe stores cookies on its own domain (checkout.stripe.com) when you pay; these are governed by Stripe's policy.
These technologies are strictly necessary to provide the service you request and do not require consent (Section 89(3) of Act No. 127/2005 Coll.).
With your consent we also use Google Analytics 4 analytics cookies:
| Cookie | Purpose | Expiry |
|---|---|---|
_ga | distinguishing browsers (pseudonymous identifier) | 2 years |
_ga_S6XEZWVWZ2 | keeping the session state | 2 years |
On your first visit a bar is shown where you can accept or reject analytics cookies equally easily (the "Accept" and "Reject" buttons are equivalent). Until you consent, no analytics cookies are stored. You can change your choice or withdraw your consent at any time with the "Cookie settings" link in the footer of every page; after withdrawal we delete the _ga* cookies. We remember your choice in the strictly necessary pv_consent cookie for 12 months.
6. Your rights
You have the right:
- of access to the data we process about you, and to a copy of it;
- to rectification of inaccurate data;
- to erasure, if we no longer need the data or the processing has no legal basis (we cannot, however, erase data we must keep by law, for example accounting documents);
- to restriction of processing;
- to data portability for the data you provided to us on the basis of a contract or consent;
- to object to processing based on legitimate interest;
- to withdraw consent at any time, without affecting the processing before the withdrawal.
Just write to us at peljesko.vino@gmail.com. We will reply within one month at the latest. We may ask you to verify your identity.
We do not use automated decision-making or profiling with legal effects. (As part of its fraud prevention, Stripe may automatically decline a risky payment; in that case please contact us.)
You can lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, https://uoou.gov.cz, or with the supervisory authority in the state of your residence or place of work.
7. Changes to this policy
We may update this policy, for example when we start using a new service. The current version is always at https://peljeskovino.eu/en/privacy/. We will inform you by e‑mail of material changes that concern you.
Version 1.6, effective from 14 October 2026.