Privacy policy
PRIVACY POLICY
Information on the processing of personal data by ARCARRA s.r.o.
I. INTRODUCTORY PROVISIONS
This Privacy Policy (hereinafter the “Policy”) sets out how ARCARRA s.r.o., with its registered office at Legerova 1820/39, 120 00 Prague 2, Czech Republic, Company ID No. (IČO): 23480271, registered in the Commercial Register kept by the Municipal Court in Prague under file No. C 427766, as the controller of personal data (hereinafter the “Controller” or the “Company”), collects, processes, stores and protects the personal data of individuals, i.e. customers and visitors to the website, in connection with the operation of the online store www.arcarra.com and the provision of other services.
Contact details of the Controller:
ARCARRA s.r.o.
Legerova 1820/39, 120 00 Prague 2, Czech Republic
Company ID No. (IČO): 23480271
VAT ID (DIČ): CZ23480271
e-mail: info@arcarra.com
The Company is not required to appoint a data protection officer.
The Company protects your personal data to the greatest extent possible, and this Policy is therefore issued in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter the “GDPR”), Act No. 110/2019 Coll., on the Processing of Personal Data, and other related legislation.
The Company declares that it complies with the principles of personal data processing under Article 5 of the GDPR, in particular lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality.
Current scope of the website: As of the effective date of this Policy, the website www.arcarra.com allows you to browse its content, create a user account, send us enquiries and subscribe to the newsletter. Purchasing goods is not yet available. The provisions of this Policy relating to orders, payment and delivery of goods (in particular order-related data, the payment service provider, carriers and the related retention periods) will apply only once purchasing becomes available on the website.
II. WHAT DATA DOES THE COMPANY COLLECT?
| Category of data | Scope |
|---|---|
| Identification and contact data | first name, surname, e-mail address, telephone number, address (billing or delivery), and for business customers the Company ID No. and VAT ID |
| User account data | login e-mail, password (in encrypted form), saved addresses, order history |
| Order-related data (once purchasing is available) | purchase history, selected method of payment or delivery, billing data (see identification and contact data above), content of e-mail or telephone communication, operator notes, complaints, requests or feedback |
| Technical data | IP address, device type, browser data (type, version), pages and products viewed, date and time of access, operating system information (type, version), language settings, referrer |
| Marketing data and preferences | newsletter consent, content preferences (including products viewed, web pages and links visited), date/time of consent, length of visit, interaction with page elements (e.g. clicks, scrolling), and, where applicable, a record of unsubscribing |
In addition to technical data, the Company also collects data on user activity on the website obtained through optional cookies. These data are processed solely on the basis of your consent, which may be withdrawn at any time. We use the data obtained to analyse traffic, to improve the website and to connect our online store with the Klaviyo tool (see Articles III and V).
Cookies
Cookies are small text files stored on your device. Among other things, cookies allow us to recognise your device on your next visit and tailor our website to your needs. For all cookies that are not strictly necessary for the basic functioning of the website, we require your prior consent in accordance with Section 89 of Act No. 127/2005 Coll., on Electronic Communications, and Article 6(1)(a) of the GDPR.
Consenting to cookies may provide you with a better user experience in the Company’s online store. Deleting or blocking certain cookies may cause our website not to behave as intended when cookies are accepted. Information obtained through cookies may, in certain circumstances, constitute personal data within the meaning of the GDPR. We process such data only to the extent necessary to achieve the stated purposes and in accordance with the applicable legislation. If you do not consent to the use of cookies, some website functions may be limited or unavailable.
You can give, refuse or change your consent at any time via the “Cookie settings” link available on the Company’s website. The cookie settings allow you to manage your consent by category of cookies; they do not display individual cookies or their storage periods, which are set out in the overview below. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
We use cookies and similar technologies on our website in the following categories:
- Strictly necessary (technical) cookies – ensure the basic functions of the website (shopping cart, login to the user account, security, storing your language and currency selection, storing your cookie consent settings). These cookies do not require your consent.
- Analytical cookies – allow us to measure traffic and user behaviour on the website and to improve how it works.
- Marketing cookies – allow us to link your visit to the website with your customer or subscriber profile in our e-mail marketing tool (Klaviyo) and to personalise our e-mail communication.
We do not currently use any third-party advertising, conversion-measurement or remarketing tools on the website. Before we start using any such tool, we will update this Policy and the cookie settings accordingly.
Overview of the cookies we have verified on our website:
| Provider | Category | Purpose | Cookie | Storage period |
|---|---|---|---|---|
| Shopify (Shopify International Limited, Ireland) | strictly necessary | storing the selected country / localisation | localization |
approx. 1 year |
| Shopify (Shopify International Limited, Ireland) | strictly necessary | storing the cart currency | cart_currency |
14 days |
| Shopify (Shopify International Limited, Ireland) | analytical (optional) | session analytics | _shopify_s |
30 minutes, renewed with each activity |
| Shopify (Shopify International Limited, Ireland) | analytical (optional) | visitor analytics | _shopify_y |
approx. 1 year |
| Shopify (Shopify International Limited, Ireland), used for the Klaviyo integration | analytical / marketing (optional) | identification of the browser for the integration between our online store and Klaviyo | shopify_client_id |
1 year |
The overview lists the cookies we have verified on the website as of the effective date of this Policy; it is not a complete list of all cookies. Other strictly necessary cookies may be used in particular when you log in to your user account and, once purchasing is available, during checkout. Storage periods are indicative and may vary slightly depending on your browser. The optional cookies _shopify_s, _shopify_y and shopify_client_id are stored only after you give your consent and are no longer stored once you withdraw it.
III. FOR WHAT PURPOSES DO WE PROCESS YOUR PERSONAL DATA?
Once purchasing is available on the website, we need to process your personal data above all in order to properly fulfil orders, i.e. to comply with our basic contractual obligations as a seller. This is linked to our subsequent legal obligations, under which we must collect certain data in order to meet the requirements of the applicable legislation, in particular in the areas of accounting and tax.
Our customer support also cannot operate without your personal data. We need your personal data for effective communication relating to your enquiries and, once purchasing is available, to the handling of orders.
If you create a user account, we process the account data for the purpose of maintaining the account and, once purchasing is available, simplifying purchases and displaying your order history.
We use selected personal data for marketing purposes only if you have given your consent or, in the case of our customers, under the conditions set out below.
We collect identification and contact data and user account data on the following legal bases:
- performance of a contract under Article 6(1)(b) of the GDPR,
- legitimate interest under Article 6(1)(f) of the GDPR,
- legal obligation under Article 6(1)(c) of the GDPR.
We collect order-related data on the following legal bases:
- performance of a contract under Article 6(1)(b) of the GDPR,
- legitimate interest under Article 6(1)(f) of the GDPR,
- legal obligation under Article 6(1)(c) of the GDPR.
We process technical data necessary for the operation, security and proper functioning of the website on the basis of our legitimate interest under Article 6(1)(f) of the GDPR. We process data obtained through analytical or marketing cookies solely on the basis of your consent under Article 6(1)(a) of the GDPR.
We collect marketing data and preferences on the following legal bases:
- consent of the data subject under Article 6(1)(a) of the GDPR (newsletter subscription, optional cookies),
- legitimate interest under Article 6(1)(f) of the GDPR (synchronisation of customer data to our e-mail marketing tool and commercial communications to our customers in accordance with Section 7(3) of Act No. 480/2004 Coll.).
Where we process data on the basis of legitimate interest, we always assess in advance whether our legitimate interests are overridden by your interests or fundamental rights and freedoms (we carry out a so-called balancing test).
We send marketing communications (newsletter) only if you have given us your express consent, or if you are our customer, in accordance with Section 7 of Act No. 480/2004 Coll., on Certain Information Society Services. You can unsubscribe from marketing communications at any time via the link in every e-mail, in your user account settings, or by sending a request to info@arcarra.com.
Klaviyo: We use the Klaviyo tool to manage our customer and subscriber database and marketing consents and to send the newsletter. Our online store is connected to Klaviyo and automatically synchronises to it data on customers (in particular identification and contact data, user account data and, once purchasing is available, order-related data) and data on newsletter subscriptions, including the status of your marketing consent. This synchronisation applies to all customers, not only to newsletter subscribers. We carry it out on the basis of our legitimate interest in keeping a single, up-to-date customer database (Article 6(1)(f) of the GDPR); marketing e-mails are sent only in accordance with the previous paragraph. If you have consented to optional cookies, your activity on the website may also be linked to your profile in Klaviyo (via the shopify_client_id cookie). You may object to this processing at any time by sending a request to info@arcarra.com.
We process data for both registered customers and unregistered website visitors, to the extent corresponding to their activity on the website and the consents to processing they have given.
IV. RETENTION PERIOD OF PERSONAL DATA
We retain your personal data only for as long as is necessary for the given purpose, in particular:
- order-related data – billing and accounting data for which we must meet record-keeping obligations under the applicable legislation: 10 years from the end of the tax period in which the supply took place;
- other order-related data (e.g. communication regarding the order, complaints): for the duration of the limitation period for asserting rights under the purchase contract, i.e. generally 3 years from delivery of the goods, or until the complaint and any related claims have been settled;
- user account data: for as long as the user account exists; you may cancel your account at any time by sending a request to info@arcarra.com;
- marketing data are retained only until you withdraw your consent or unsubscribe;
- customer data synchronised to Klaviyo: for as long as you are our customer or registered user, or until you successfully object to their processing;
- data from customer support communication are retained for as long as necessary to handle the enquiry and for subsequent documentation, but no longer than 3 years, unless otherwise stipulated in the service settings;
- the storage periods of the verified cookies are set out in the cookie overview in Article II of this Policy.
After these periods expire, your personal data will be securely deleted or anonymised.
V. DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES
We may share your personal data, to the extent necessary, in particular with the following third parties:
- e-commerce platform provider – our website and online store run on the Shopify platform provided by Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland; data about your user account and, once purchasing is available, your orders are stored on its servers;
- payment service provider (once purchasing is available) – payments in our online store are processed by Shopify Payments (Shopify International Limited) for the purpose of secure and transparent payment processing; when making a payment, the payment service provider may process, for example, payment card data and your IP address in accordance with its own privacy policy; the Company itself does not store your payment card data;
- carriers and logistics companies (once purchasing is available), for the purpose of delivering the goods, i.e. fulfilling our contractual obligation; you select the specific carrier at checkout;
- IT providers, hosting and related technical services (e.g. website security and operation, e-mail communication), for the purpose of ensuring the operation and security of the website; they process the data obtained solely on our instructions and in accordance with a data processing agreement complying with the applicable legislation;
- customer database and e-mail marketing tool provider – Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA, to which our online store synchronises data on customers (including registered users) and newsletter subscribers, for the purpose of managing the customer and subscriber database and marketing consents and sending the newsletter (see Article III); data are transferred to the USA under the conditions set out in the “General rules” below;
- accounting and tax services, for the purpose of fulfilling our legal obligations.
Public authorities
Public authorities have access to your data whenever required by law or other legislation.
General rules
If certain services process data outside the European Union or the European Economic Area (e.g. cloud servers or Klaviyo, Inc., established in the USA), we always ensure an adequate level of protection in accordance with Chapter V of the GDPR – in particular through European Commission adequacy decisions (Article 45 of the GDPR, including the EU–U.S. Data Privacy Framework) or standard contractual clauses (Article 46 of the GDPR).
The processors we work with are obliged to secure personal data and handle them in accordance with the GDPR.
Information on the processing of personal data by third parties in connection with cookies can be found in Article II of this Policy.
Once purchasing is available, when paying via the payment gateway, you should read the terms of the specific provider of that service. These third parties have access to your personal data only to the extent necessary to process the payment and in accordance with their terms.
VI. YOUR RIGHTS UNDER THE GDPR
- Right of access: You may request confirmation of whether we process your data and a copy of those data.
- Right to rectification: You may request the correction of inaccurate or incomplete data.
- Right to erasure (“right to be forgotten”): Under certain conditions, you may request the deletion of your data.
- Right to restriction of processing: You may request that the processing of your data be restricted.
- Right to data portability: You may request that your data be provided in a commonly used format.
- Right to object: You may object to the processing of data based on legitimate interest. You may object to processing for direct marketing purposes at any time.
- Right to withdraw consent: If you have given consent to processing, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
- Right to lodge a complaint with a supervisory authority: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz.
To exercise these rights, please contact us at: info@arcarra.com.
We handle your requests without undue delay and no later than within 1 month. In justified cases, this period may be extended by a further 2 months.
Withdrawal of consent (including partial withdrawal) may affect the achievement of the purpose for which the consent was given, if that purpose cannot be achieved otherwise.
If you believe that the processing of your personal data has breached the law, you also have the right to lodge a complaint with the competent supervisory authority in another Member State of the European Union in which you have your habitual residence or place of work, or in which the alleged infringement took place.
VII. SECURITY OF PERSONAL DATA
We protect your personal data by technical and organisational measures appropriate to the risks associated with the processing, in order to ensure their security and prevent unauthorised access, loss or misuse. For example, we use encrypted data transmission (TLS/SSL), access rights control and regular backups.
Access to personal data is restricted to authorised persons who have been duly instructed on their obligations and duty of confidentiality. We regularly assess security risks and adopt measures to enhance protection, including two-factor authentication and encryption of data storage.
VIII. AUTOMATED DECISION-MAKING AND PROFILING
We do not use any automated decision-making or profiling within the meaning of Article 22 of the GDPR that would produce legal effects concerning you or similarly significantly affect you. Any personalisation of our e-mail communication based on optional cookies takes place only with your consent and has no legal or similarly significant effects on you.
IX. FINAL PROVISIONS
The current version of this Policy is effective from 25 September 2026. This Policy may be updated, and you will be informed of any updates in an appropriate manner (e.g. on the website).
This English version is provided for convenience. In the event of any discrepancy between the Czech and English versions, the Czech version prevails.