PRIVACY POLICY
PRIVACY POLICY
I. DATA CONTROLLER
The controller of personal data is:
VictoryImport s.r.o.
Company ID No.: 11851481
Registered office: Jičínská 226/17, Žižkov, 130 00 Prague 3, Czech Republic
Email: info@korejskaskincare.cz
Telephone: 608 487 789
(hereinafter referred to as “we”, “us” or the “Controller”).
We operate an online store at www.korejskaskincare.cz.
In connection with operating our online store, selling goods, providing services, communicating with customers and operating our website, we process certain personal data.
The processing of personal data is governed in particular by Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (“GDPR”), Act No. 110/2019 Coll., on the Processing of Personal Data, and, where relevant, Act No. 480/2004 Coll., on Certain Information Society Services, and Act No. 127/2005 Coll., on Electronic Communications.
II. WHAT PERSONAL DATA WE PROCESS AND WHY
A. Contact form, email and other communications
If you contact us via our contact form, by email, telephone or by other means, we may process in particular:
- your first and last name;
- email address;
- telephone number;
- the content of your message and our subsequent communication;
- information about the goods or services to which your enquiry relates;
- any other information that you voluntarily provide to us.
If your enquiry is aimed at entering into a contract, we process your personal data pursuant to Article 6(1)(b) GDPR for the purpose of taking steps at your request prior to entering into a contract.
In the case of general communication or a customer enquiry that is not directly related to entering into or performing a contract, we process the data on the basis of our legitimate interest pursuant to Article 6(1)(f) GDPR in handling communications and providing customer support.
If the communication does not result in the conclusion of a contract, we generally retain it for no longer than 2 years from the date of the last communication, unless a shorter or longer period is necessary for a specific reason.
B. Orders, payments and delivery of goods
If you place an order with us, we process the data necessary to handle your order and perform the purchase contract.
This includes in particular:
- first and last name;
- billing and delivery address;
- email address;
- telephone number;
- information about the goods ordered;
- order value;
- order number;
- selected payment method;
- selected delivery method;
- information about payment and delivery status;
- Company ID No. and VAT ID No., where applicable;
- bank account number where necessary, for example for issuing a refund;
- transaction or other technical identifiers related to the payment;
- related customer communications.
We process this data:
pursuant to Article 6(1)(b) GDPR, because it is necessary for entering into and performing the purchase contract, processing the order, receiving payment, delivering the goods and related communications;
pursuant to Article 6(1)(c) GDPR, where processing is necessary to comply with our legal obligations, in particular accounting, tax and consumer protection obligations;
pursuant to Article 6(1)(f) GDPR, where processing is necessary for our legitimate interest in protecting and enforcing legal claims, preventing fraud and protecting our business.
C. Complaints, withdrawal from the contract, returns and refunds
When handling a complaint, withdrawal from the contract, return of goods or another request related to a purchase, we may process in particular:
- identification and contact details;
- information about the order;
- information about the goods being complained about or returned;
- the content of our mutual communications;
- photographs or other supporting materials you provide to us;
- the bank account number required to issue a refund;
- other information necessary to handle the relevant request.
Depending on the specific circumstances, the legal basis is performance of a contract pursuant to Article 6(1)(b) GDPR, compliance with legal obligations pursuant to Article 6(1)(c) GDPR, and our legitimate interest pursuant to Article 6(1)(f) GDPR in protecting and enforcing legal claims.
D. Customer account
If you create a customer account in our online store, we process the data necessary to create and operate the account.
This may include in particular:
- registration and login details;
- first and last name;
- email address;
- telephone number;
- billing and delivery details;
- order history;
- information related to the use of your customer account.
The legal basis for this processing is Article 6(1)(b) GDPR.
Creating a customer account is voluntary.
Data processed solely for the purposes of the customer account is retained for as long as the account exists.
Closing your customer account does not affect our obligation or right to retain information about orders already completed, accounting and tax documents, or data necessary to protect legal claims for the applicable period.
E. Marketing communications to existing customers
If you are our customer, we may use the email address obtained in connection with your purchase to send you marketing communications concerning our own similar products or services.
The legal basis for processing your email address is our legitimate interest in direct marketing pursuant to Article 6(1)(f) GDPR.
The sending of marketing communications itself is carried out under the conditions set out in Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services.
When we obtain your email address and subsequently in every marketing communication, we provide you with a simple and free way to opt out of receiving further marketing communications.
You have the right to object at any time to the processing of your personal data for direct marketing purposes.
If you object or unsubscribe, we will no longer use your personal data for this purpose.
We process your email address for this purpose until you opt out of further communications or object to the processing, but no longer than 4 years from your most recent purchase.
F. Newsletter for persons who are not our customers
If you are not our customer and voluntarily subscribe to our newsletter, we process your email address on the basis of your consent pursuant to Article 6(1)(a) GDPR.
We send you marketing communications on the basis of your prior consent in accordance with Act No. 480/2004 Coll.
You may withdraw your consent at any time, in particular by using the unsubscribe link included in every marketing communication, or you may contact us at:
Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.
We process your email address until you withdraw your consent or until the conditions for its further processing no longer apply.
Information necessary to demonstrate that consent was given or withdrawn may subsequently be retained for as long as necessary to demonstrate compliance with our legal obligations or to protect legal claims.
G. Cosmetic skincare consultations
If you use our cosmetic skincare consultation service or voluntarily provide us with information necessary to recommend suitable cosmetic skincare, we may process the information that you provide to us.
This may include, for example, information about your skin type and condition, skincare needs, cosmetic products you use, or a photograph of your skin.
If, as part of a cosmetic skincare consultation, you voluntarily provide us with information from which details about your health may be inferred, such as information about a specific skin condition, allergy, diagnosis, treatment or other health-related information, such information may constitute a special category of personal data under Article 9 GDPR.
We process such data only where its processing is necessary for the consultation you have requested and where we have an appropriate legal basis for doing so. Where processing is based on your explicit consent, you may withdraw that consent at any time.
We will not use data obtained through cosmetic skincare consultations for other incompatible purposes.
If the cosmetic skincare consultation form allows users to provide health-related data, an appropriate mechanism for obtaining explicit consent must be provided directly within or alongside the form. Publication of this Privacy Policy alone does not constitute explicit consent.
III. RETENTION PERIODS FOR PERSONAL DATA
We do not retain personal data for longer than is necessary for the purpose for which it was obtained or for longer than required by applicable law.
Data relating to orders and the performance of contracts is retained for the duration of the contractual relationship and subsequently for the period necessary to protect and enforce any legal claims, generally at least for the applicable limitation period.
Accounting and tax documents are retained for the periods prescribed by applicable legislation. Depending on the type of document, this will generally be 5 or 10 years.
Where a transaction is subject to the special One Stop Shop (OSS) scheme, we retain the relevant records for the period prescribed by legislation applicable to that scheme, generally 10 years from the end of the calendar year in which the transaction took place.
Data relating to complaints, withdrawal from contracts, returns of goods or legal disputes is retained for the duration of the matter concerned and subsequently for the period necessary to protect our legal claims.
Where judicial, administrative, tax or other proceedings are ongoing, relevant data may be retained until those proceedings have been finally concluded.
Specific retention periods for newsletters, direct marketing, communications and customer accounts are also set out in the relevant sections of this Privacy Policy.
IV. WHO MAY HAVE ACCESS TO PERSONAL DATA
We primarily process your personal data ourselves. To the extent necessary, however, we may also disclose it to other persons and companies that assist us with operating our online store, communicating with customers, marketing, processing payments or delivering orders.
Depending on the specific services used, these recipients or processors may include in particular:
- Shoptet a.s., as the provider of the e-commerce platform and related technical services;
- ECOMAIL.CZ, s.r.o. (Ecomail), as a provider of email marketing and marketing services;
- SmartSelling a.s. (SmartEmailing), as a provider of email marketing and marketing services;
- Česká pošta, s.p. – Balíkovna service, as a provider of shipping and delivery services;
- Packeta / Zásilkovna, where this delivery method is selected by the customer;
- PPL, where this delivery method is selected by the customer;
- GLS, where this delivery method is selected by the customer;
- payment service providers and banks according to the payment method selected by the customer, for example Shoptet Pay or Fio banka;
- providers of accounting, tax and legal services;
- providers of IT services, technical support, hosting, security and backup services;
- providers of analytics, advertising and marketing services, in particular Google and Meta, where their services are actually used on our website and an appropriate legal basis exists for the relevant processing or the necessary consent has been obtained;
- other service providers and integrations connected to our online store where their involvement is necessary to provide a specific service;
- public authorities where we are required by law to disclose personal data.
Depending on the nature of the service provided, individual recipients may act as our processors, independent controllers or, where applicable, joint controllers.
Where a recipient acts as our processor, we ensure that the processing of personal data is carried out on the basis of an appropriate contractual arrangement pursuant to Article 28 GDPR, where such an arrangement is required by law.
The specific recipients may vary depending on the delivery method, payment method or other service used by the customer.
V. TRANSFERS OF PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA
Some providers of technical, analytics, advertising, communications or cloud services, or their subcontractors, may also process personal data outside the European Economic Area.
Where personal data is transferred to a third country, such transfers take place only in compliance with the conditions set out in Chapter V GDPR.
Transfers may be based in particular on:
- an adequacy decision adopted by the European Commission pursuant to Article 45 GDPR;
- the EU–US Data Privacy Framework, where the recipient in the United States is an organisation covered by the relevant adequacy decision;
- the European Commission’s Standard Contractual Clauses pursuant to Article 46 GDPR;
- other appropriate safeguards required by applicable law, where relevant.
Information about the specific analytics and marketing tools currently used is also available through the cookie settings on our website.
VI. COOKIES AND SIMILAR TECHNOLOGIES
Cookies are small data files or other information stored on or read from a website visitor’s device.
Similar rules may also apply to other technologies, such as local storage, pixels and other identifiers.
Necessary cookies
Necessary cookies are required for the proper functioning of the online store or for providing a service that you have expressly requested.
They may be required, for example, for:
- the operation of the shopping cart;
- logging into a customer account;
- website security;
- storing cookie preferences;
- the technical operation of the ordering process.
We do not require consent for storing or accessing strictly necessary cookies in the circumstances provided for in Section 89(3) of Act No. 127/2005 Coll.
If you block necessary cookies through your device or browser settings, some parts of the online store may not function properly.
Analytics and statistical cookies
Analytics and statistical technologies may help us evaluate traffic to our website, how the website is used and the performance of individual parts of the website.
Where their use requires your consent under applicable law, we activate them only after you have given your consent.
Marketing cookies
Marketing technologies may be used, for example:
- to measure advertising effectiveness;
- for remarketing;
- to create advertising audiences;
- to personalise advertising;
- to evaluate purchases or other conversions.
Where their use requires consent, we activate them only after you have given your prior consent.
Cookie settings and withdrawal of consent
Analytics and marketing technologies that require consent are not activated before the relevant consent has been given.
When you first visit our website, you can choose which optional categories of cookies you wish to allow.
You may subsequently change or withdraw your consent at any time through the cookie settings available on our website.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
Up-to-date information about the specific cookies and similar technologies used, their providers, purposes and duration is available through the cookie settings on our website.
VII. PROFILING AND AUTOMATED DECISION-MAKING
We do not carry out decision-making based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.
Where we use analytics or advertising tools on the basis of your consent, these tools may involve automated evaluation of visitor behaviour or interactions, advertising measurement, segmentation or the creation of advertising audiences.
Such processing does not in itself constitute automated decision-making within the meaning of Article 22 GDPR unless it produces legal or similarly significant effects concerning a particular individual.
VIII. PERSONAL DATA OBTAINED FROM OTHER SOURCES
We obtain most personal data directly from you.
In some cases, however, we may also obtain personal data from another person or service provider.
This may occur, for example, where:
- another person orders goods and identifies you as the recipient of the shipment;
- a carrier provides us with information about the delivery status;
- a payment service provider provides us with information about the payment status;
- another service provider provides us with data necessary to fulfil an order or handle a customer request.
In these cases, we process only the data necessary for the relevant purpose and comply with the information obligations under Article 14 GDPR where they apply to the particular situation and none of the exemptions provided for by the GDPR applies.
IX. IS PROVIDING PERSONAL DATA MANDATORY?
Data marked as mandatory during the ordering process is necessary for entering into and performing the purchase contract or for complying with our legal obligations.
Without this data, we may not be able to:
- accept your order;
- process your order;
- deliver the goods;
- receive or correctly allocate your payment;
- issue the required documents;
- handle a complaint or another related request.
For contact forms, we require at least the contact information necessary to enable us to respond to your enquiry.
Creating a customer account, subscribing to the newsletter, and consenting to analytics or marketing cookies are voluntary.
Refusing these options does not in itself prevent you from making a standard purchase from our online store.
X. SECURITY OF PERSONAL DATA
We implement appropriate technical and organisational measures corresponding to the nature, scope, context and risks of personal data processing.
These measures are aimed in particular at:
- restricting unauthorised access to personal data;
- protecting accounts and information systems;
- ensuring the secure transmission and storage of data;
- protecting data against unauthorised alteration, loss or destruction;
- ensuring data availability and recoverability;
- appropriately managing access permissions;
- responding to potential security incidents.
We regularly review the level of security and the measures implemented, taking into account current risks and the state of the art.
XI. DATA PROTECTION OFFICER
We currently have not appointed a Data Protection Officer.
If the nature or scope of our processing changes in the future so that the conditions under Article 37 GDPR requiring the appointment of a Data Protection Officer are met, we will reassess this obligation.
XII. YOUR RIGHTS
Subject to the conditions set out in the GDPR, you have in particular the following rights:
Right of access
You have the right to obtain confirmation as to whether we process your personal data and, subject to the conditions laid down by law, to obtain access to that data and further information about its processing.
Right to rectification
You have the right to request the correction of inaccurate personal data or the completion of incomplete personal data.
Right to erasure
Subject to the conditions set out in the GDPR, you may request the erasure of your personal data.
The right to erasure is not absolute. We may or must retain certain data, for example to comply with a legal obligation or to protect legal claims.
Right to restriction of processing
In the circumstances provided for by the GDPR, you may request that the processing of your personal data be restricted.
Right to data portability
In the circumstances provided for by the GDPR, you have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format and, where applicable, to transmit that data to another controller.
Right to object
Where we process personal data on the basis of a legitimate interest pursuant to Article 6(1)(f) GDPR, you have the right to object to such processing on grounds relating to your particular situation.
Right to object to direct marketing
You may object at any time to the processing of personal data for direct marketing purposes.
If you object to processing for direct marketing purposes, we will no longer process your personal data for that purpose.
Right to withdraw consent
Where processing is based on your consent, you may withdraw your consent at any time.
Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint
If you believe that we are processing your personal data in breach of applicable law, you have the right to lodge a complaint with:
Office for Personal Data Protection of the Czech Republic
www.uoou.gov.cz
This does not affect your right to seek judicial protection.
XIII. HOW TO EXERCISE YOUR RIGHTS
You may exercise your rights in particular by contacting us by email at:
We will respond to your request without undue delay and no later than one month after receiving it.
Taking into account the complexity and number of requests, this period may, subject to the conditions set out in the GDPR, be extended by a further two months.
If we extend the period, we will inform you within the first month after receiving your request and provide the reasons for the extension.
If we have reasonable doubts concerning the identity of the person making the request, we may request additional information necessary to verify their identity.
Requests are generally handled free of charge.
Where a request is manifestly unfounded or excessive, in particular because of its repetitive nature, we may proceed in accordance with Article 12(5) GDPR.
XIV. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time, in particular where there are changes to:
- applicable legislation;
- the way in which personal data is processed;
- service providers;
- analytics or marketing tools used;
- the technical operation of our online store.
The current version of this Privacy Policy is always published on our website at www.korejskaskincare.cz.
Last updated: 7 September 2026