Privacy Policy

1. Data Controller

The entity responsible for your personal data ("Data Controller", "we", "us") is StandaToys s.r.o., a company registered in the Czech Republic, Bohemian Street 12, Prague, Czech Republic (IČO: 12345678, DIČ: CZ12345678).

Email: info@standatoys.cz
Phone: +420 123 456 789

These legal documents, including this Privacy Policy, have been prepared and are maintained on behalf of StandaToys s.r.o. by fastmedia.pro, acting as the responsible entity for legal compliance and data-protection support. Enquiries regarding the content or implementation of these documents may be directed to legal@fastmedia.pro.

2. Scope of this Policy

This Privacy Policy applies to the collection and processing of personal data when you visit standatoys.com, place an order, request a custom commission, create an account, subscribe to our newsletter, or contact us. It complies with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and Act No. 110/2019 Coll., on the Processing of Personal Data, as amended.

3. Personal Data We Collect

When you use our site or place an order, we collect:

• Identity data: name, title, date of birth (only if relevant to a custom commission, e.g. age-appropriate design)
• Contact data: email address, telephone number, billing and shipping address
• Order data: the specification of the commissioned piece (wood type, dimensions, finish, age range, gift message, photographs or references you provide)
• Payment data: processed securely by our payment providers (PayPal and Stripe); we do not store full card numbers
• Account data: login credentials (stored as hashes), order history, saved favourites and wishlist
• Technical data: IP address, browser type, device type, usage data collected via cookies and analytics (see our Cookie Policy)
• Communications data: the content of messages you send us via the contact form, custom-order enquiry, or email

4. How We Use Your Data

We process your personal data for the following purposes:

• To accept, manufacture, and deliver your commissioned piece (contract performance)
• To communicate with you about your order, lead time, and shipping
• To manage your user account, favourites, and order history
• To process payments and prevent fraud
• To respond to enquiries sent via the contact form or by email
• To send our newsletter, only where you have consented (you may unsubscribe at any time)
• To comply with legal, accounting, and tax obligations under Czech law
• To improve our website, products, and customer service (anonymised analytics)

5. Legal Basis for Processing

Our processing of personal data is based on the following legal bases under Article 6 GDPR:

• Article 6(1)(b) — contract performance: processing necessary to take steps at your request before entering a contract and to perform the contract for the manufacture and sale of your commissioned piece
• Article 6(1)(c) — legal obligation: processing to comply with Czech accounting, tax, and consumer-protection law (records retained per Act No. 563/1991 Coll., on Accounting)
• Article 6(1)(f) — legitimate interests: website security, fraud prevention, anonymised analytics, and direct communication with existing customers, subject to your right to object
• Article 6(1)(a) — consent: for marketing newsletters and non-essential cookies; you may withdraw consent at any time without affecting the lawfulness of prior processing

6. Recipients of Your Data

Your personal data is shared only with the following categories of recipients, to the extent necessary:

• Payment processors (PayPal, Stripe) for transaction handling
• Shipping carriers (Česká pošta, DPD, and partners) for delivery
• Hosting and analytics providers based in the EU
• fastmedia.pro, for website maintenance and legal-compliance support, bound by a written data-processing agreement
• Czech public authorities where required by law

We do not sell your personal data to third parties.

7. Data Retention

We retain your personal data only as long as necessary for the purposes set out above. Order and accounting records are retained for 10 years in accordance with Czech accounting law. Account data is retained until you delete your account. Marketing data is retained until you unsubscribe or request deletion. Contact-form messages are retained for 2 years for customer-service continuity.

8. Your Rights Under GDPR

Under Articles 15–22 GDPR, you have the right to:

• Access your personal data and receive a copy (Article 15)
• Rectify inaccurate or incomplete data (Article 16)
• Request erasure of your data ("right to be forgotten") (Article 17)
• Restrict processing (Article 18)
• Object to processing based on legitimate interests or for direct marketing (Article 21)
• Receive your data in a structured, machine-readable format and transmit it to another controller ("data portability") (Article 20)
• Withdraw consent at any time without affecting prior processing (Article 7(3))
• Lodge a complaint with the supervisory authority (Article 77)

To exercise these rights, contact us at info@standatoys.cz. We respond within 30 days; the service is free of charge, except where requests are manifestly unfounded or excessive.

9. International Transfers

Your personal data is processed primarily within the European Union. Where any transfer to a third country is necessary (e.g. by a payment processor), it is carried out under an adequacy decision or with appropriate safeguards under Article 46 GDPR, such as Standard Contractual Clauses.

10. Security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted transmission (TLS), access controls, and regular reviews. Payment data is never stored on our servers — it is handled directly by our certified payment providers.

11. Children

Our toys are intended for children, but our website and ordering process are designed for adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Automated Decision-Making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

13. Supervisory Authority

If you believe we have mishandled your data, you may lodge a complaint with the Czech Data Protection Authority:
Úřad pro ochranu osobních údajů (ÚOOÚ)
Pplk. Sochora 27, 170 00 Praha 7
Phone: +420 234 665 111
www.uoou.cz

14. Changes to this Policy

We may update this Privacy Policy to reflect changes in law or our practices. The "Last updated" date above indicates when the policy was last revised. Continued use of our website after changes constitutes acceptance of the updated policy.

15. Contact

Data Controller: StandaToys s.r.o., Bohemian Street 12, Prague, Czech Republic
Email: info@standatoys.cz
Legal compliance: fastmedia.pro — legal@fastmedia.pro