Privacy Policy

Effective from 30 September 2026

Information on the processing of personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council – GDPR.

This is an English translation provided for your convenience. The legally binding version is the Czech original; in the event of any discrepancy, the Czech version shall prevail.

1. Who processes your personal data

The controller of personal data is:

Name / business name: Martin Klíbr
Company ID (IČO): 86960512
Sole trader registered in the Czech Trade Register
Registered address / place of business: Školní 264, 294 29 Bezno, Czech Republic
E-mail: tichaknihovna@gmail.com
Website: tichaknihovna.cz
(the “Controller”).

The Controller determines the purposes and means of processing personal data.

2. What personal data we process

In connection with the operation of the online shop, we may process in particular the following data:

Identification data

• first name and surname,
• company name, where applicable,
• company ID (IČO),
• VAT ID (DIČ).

Contact data

• e-mail address,
• telephone number, where applicable,
• billing address, if required.

Order data

• purchased products,
• date and time of the order,
• order price,
• order status,
• order identifier,
• information on making the digital product available,
• information on complaints or communication regarding the order.

Payment data

We may process information on the status of a payment, for example:

• whether the payment was successful,
• the amount,
• the payment method used,
• the payment transaction identifier.

We do not process or store full payment card details. These are processed by the relevant payment service provider.

Technical data

When you visit the website, the following may be processed to the necessary extent, for example:

• IP address,
• device type,
• browser type,
• operating system,
• time of visit,
• technical logs,
• data necessary to secure the service.

Data related to downloading digital content

To protect digital products, we may record in particular:

• the order identifier,
• the date the link was created,
• the date or number of downloads,
• the validity of the link,
• any technical information needed to prevent misuse of the service.

3. Purposes of processing

We process personal data only to the extent necessary for the specific purpose.

A. Processing the order and delivering the digital product

We process data for the purpose of:

• accepting the order,
• processing the payment,
• creating the contractual relationship,
• making the purchased PDF or other digital product available,
• sending the download link,
• communication regarding the order.

Legal basis: performance of a contract or steps taken prior to entering into a contract.

B. Accounting and tax obligations

We are required by law to keep certain data. This applies in particular to data contained in:

• accounting documents,
• invoices,
• tax documents,
• transaction records.

Legal basis: compliance with a legal obligation.

C. Complaints and customer support

We may process personal data when:

• handling a complaint,
• solving download problems,
• answering customer questions,
• processing a refund, if one is due,
• protecting the rights of the customer and the Controller.

Legal basis: performance of a contract, legal obligation or legitimate interest, depending on the situation.

D. Security of the online shop

Technical data may be processed for the purpose of:

• securing the website,
• preventing fraud,
• protecting digital products against unauthorised distribution,
• protecting the infrastructure,
• diagnosing technical errors.

Legal basis: the Controller’s legitimate interest in the security and proper operation of the service.

E. Protection of legal claims

We may keep some personal data for the time necessary to:

• exercise legal claims,
• defend against legal claims,
• prove the conclusion or content of a contract,
• resolve disputes.

Legal basis: the Controller’s legitimate interest in protecting its rights.

4. Newsletter and marketing

If the online shop allows subscribing to a newsletter, the e-mail address may be used to send news, information about new publications or other commercial communications in accordance with applicable law.

If consent is required for specific marketing communication, the user will be asked to give it separately.

Consent to marketing:

• is not a condition of purchase,
• must not be pre-ticked,
• can be withdrawn at any time.

Every marketing message will contain an easy way to unsubscribe.

Where the law allows sending offers to existing customers on the basis of legitimate interest, the customer will always be able to object to such processing and stop further messages.

5. Cookies

The website may use cookies or similar technologies.

Necessary cookies

Necessary cookies may be used without consent if they are required, for example, for:

• securing the website,
• the functioning of the purchase process,
• keeping the technical state of the order,
• fraud protection,
• the correct functioning of the payment process.

Analytics and marketing cookies

Analytics or marketing technologies will only be used in accordance with applicable law.

If user consent is required, these technologies will only be activated after it has been given.

The user can subsequently change or withdraw consent via the cookie settings on the website.

If the website does not use analytics or marketing cookies, these technologies need not be activated.

6. Who data may be shared with

To operate the online shop, we may use external service providers.

Personal data may be shared to the necessary extent in particular with the following categories of recipients:

Payment gateway provider

For the purpose of:

• processing the payment,
• verifying the payment,
• fraud prevention.

For example: Comgate, a.s.

Hosting and infrastructure provider

For the purpose of operating the website, the database and related services.

For example: Cloudflare, Inc. (Cloudflare)

E-mail service provider

For the purpose of:

• confirming the order,
• sending the download link,
• customer communication.

For example: Resend, Inc. (Resend)

Accountant or tax adviser

If used, they may receive data necessary to fulfil accounting and tax obligations.

7. Data processors

External providers who process personal data on our behalf act as data processors where applicable.

Processing by service providers is set up to comply with the requirements of the GDPR.

We only share personal data with them to the extent necessary to provide the specific service.

8. Transfers of data outside the European Union

Some technical service providers may have their registered office or infrastructure outside the European Union or the European Economic Area.

Any transfer of personal data to third countries only takes place where the conditions laid down by the GDPR are met. This may be, for example:

• a European Commission adequacy decision,
• standard contractual clauses,
• another valid mechanism under the GDPR.

The specific transfer mechanism depends on the service provider used.

9. How long we keep personal data

We do not keep personal data longer than necessary. The retention period depends on the purpose of processing.

Orders

We keep order-related data for the time needed to:

• perform the contract,
• handle complaints,
• protect legal claims,
• fulfil legal obligations.

Accounting documents

We keep accounting and tax documents for the period laid down by applicable law.

Customer communication

We keep routine customer communication only for the time needed to handle the specific request and to protect any legal claims.

Marketing

Where processing is based on consent, we process personal data for marketing until consent is withdrawn or until processing is no longer relevant for the purpose.

Where marketing is based on legitimate interest, processing ends in particular after a justified objection is raised.

Technical logs

Technical and security records are kept only for a reasonable period necessary to secure the service and diagnose problems.

10. Obligation to provide data

Providing the personal data needed to process an order is a contractual requirement.

Without, for example, a working e-mail address, it may not be possible to:

• accept the order,
• confirm the order,
• deliver the purchased digital product,
• send the download link.

Providing data for optional marketing is not a condition for concluding the contract.

11. Automated decision-making

In the normal operation of the online shop, there is no automated individual decision-making that would have legal effects on the customer or similarly significantly affect them, unless stated otherwise for a specific service.

However, the payment gateway or third-party security systems may use their own automated mechanisms, for example for fraud prevention.

Their operators may be responsible for these processes depending on the specific setup.

12. How we protect personal data

We take appropriate technical and organisational measures to protect personal data. These include in particular:

• encrypted HTTPS connection,
• restricted access to the administration,
• securing user accounts,
• database protection,
• restricted permissions,
• system updates,
• secure payment processing via an external payment gateway,
• time-limited download links, where used,
• technical logging of security incidents.

However, no system connected to the internet can be considered absolutely secure.

13. Your rights

In connection with the processing of personal data, you have in particular the following rights under the GDPR, subject to the statutory conditions:

Right of access

You have the right to obtain information on whether and what personal data about you we process.

Right to rectification

If your personal data is inaccurate or incomplete, you may request its correction or completion.

Right to erasure

Under the conditions laid down by the GDPR, you may request the erasure of personal data.

However, the right to erasure is not absolute. We cannot erase some data, for example, if we must keep it under a legal obligation.

Right to restriction of processing

Under the conditions laid down by the GDPR, you may request restriction of the processing of personal data.

Right to data portability

If the statutory conditions are met, you may have the right to receive your personal data in a structured, commonly used and machine-readable format.

Right to object

If processing is based on legitimate interest, you have the right to object to it under the conditions laid down by the GDPR.

In the case of direct marketing, you may object to its processing at any time.

Right to withdraw consent

If processing is based on your consent, you may withdraw it at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

14. How to exercise your rights

You can exercise your rights via e-mail: tichaknihovna@gmail.com

We recommend including sufficient information in your request to allow us to verify your identity and identify the data the request concerns.

For security reasons, we may ask for reasonable verification of your identity in justified cases.

We will respond to your request within the statutory deadline.

15. Right to lodge a complaint

If you believe that we process personal data in breach of the law, you have the right to lodge a complaint with a supervisory authority.

In the Czech Republic, this authority is:
Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27
170 00 Prague 7, Czech Republic
www.uoou.gov.cz

However, we recommend contacting us first so that we have the opportunity to resolve the situation.

16. Personal data of children

The online shop is not primarily intended for collecting personal data of children.

If we find that we have obtained personal data of a child in breach of applicable law, we will take reasonable steps to delete it.

17. Links to third-party services

The website may contain links to or integrations of third-party services. These third parties may have their own privacy policies.

Their operators are responsible for the way personal data is processed by these independent controllers.

18. Changes to this policy

We may update this policy from time to time, in particular in the event of:

• changes to the technologies used,
• changes of service providers,
• changes in legislation,
• changes in the way personal data is processed.

The current version will always be available on the website.

19. Contact details

If you have any questions about personal data protection, you can contact us:

Controller: Martin Klíbr
Company ID (IČO): 86960512
E-mail: tichaknihovna@gmail.com
Address: Školní 264, 294 29 Bezno, Czech Republic

Last updated: 30 September 2026