Legal

Privacy Policy

Data controller

The controller of your personal data within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Czech Act No. 110/2019 Coll., on the processing of personal data, is:

For all data-protection matters please contact us at info@thearchive-store.eu.

§1 General information

This privacy policy applies to this website and to all related online services we provide. We process personal data in accordance with the GDPR, the Czech Act No. 110/2019 Coll. on personal data processing, Act No. 480/2004 Coll. on certain information-society services (electronic marketing), and other applicable Czech and EU legislation.

We are committed to protecting your privacy and processing your data lawfully, fairly and transparently.

§2 Purposes and legal bases of processing

• Order processing (name, delivery address, e-mail, telephone, payment data) — performance of a contract, Art. 6(1)(b) GDPR. Retained for the duration of the contract and statutory retention periods.
• Customer account — performance of a contract, Art. 6(1)(b) GDPR. Retained until the account is deleted.
• Complaints and warranty claims — performance of a contract and legal obligation, Art. 6(1)(b) and (c) GDPR.
• Accounting and tax records — legal obligation, Art. 6(1)(c) GDPR. Retention 10 years from the end of the relevant tax period in accordance with Act No. 235/2004 Coll. on VAT and Act No. 563/1991 Coll. on accounting.
• Newsletter and direct marketing — consent, Art. 6(1)(a) GDPR, or legitimate interest in marketing to existing customers under § 7(3) of Act No. 480/2004 Coll. Retained until consent is withdrawn, no longer than 3 years of inactivity.
• Website analytics and optimisation — consent, Art. 6(1)(a) GDPR, given via the cookie banner.
• Establishment, exercise and defence of legal claims — legitimate interest, Art. 6(1)(f) GDPR.
• Inquiries via contact form or e-mail — legitimate interest, Art. 6(1)(f) GDPR. Retained up to 12 months.
• Age verification (18+) — legitimate interest in lawful sale of research materials, Art. 6(1)(f) GDPR.
• Fraud prevention and IT security — legitimate interest, Art. 6(1)(f) GDPR.

§3 Recipients of personal data

Your personal data may be disclosed to the following categories of recipients, each of whom is bound by a data-processing agreement under Art. 28 GDPR:

• Hosting and infrastructure providers
• Carriers and logistics providers for shipping orders within the EU
• Accounting and tax-advisory service providers
• E-commerce and order-management software providers
• Analytics and marketing providers (Google LLC — Google Analytics, Google Ads, Google Tag Manager; Meta Platforms Ireland Ltd. — Facebook/Instagram Pixel)
• Cookie-consent management providers
• Banks and payment service providers
• IT service providers for maintenance and support
• Public authorities where required by law

§4 Transfers to third countries

When using services of Google LLC and Meta Platforms, data may be transferred to the United States. Such transfers take place on the basis of the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023); both providers are certified under the framework.

For other third countries without an adequacy decision we rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR. A copy is available on request at info@thearchive-store.eu.

§5 Your rights

Under the GDPR you have the following rights:

• Right of access to your personal data (Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure ("right to be forgotten", Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interests, including profiling for direct marketing (Art. 21 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
• Right not to be subject to a decision based solely on automated processing (Art. 22 GDPR)

Requests can be sent to info@thearchive-store.eu. We will respond within one month of receipt in accordance with Art. 12(3) GDPR.

You also have the right to lodge a complaint with the Czech supervisory authority:

You may also contact the supervisory authority in your country of residence.

§6 Data security

We implement appropriate technical and organisational measures under Art. 32 GDPR to protect your personal data, in particular:

• SSL/TLS encryption of the entire website
• Regular updates of software, libraries and dependencies
• Access control based on the principle of least privilege
• Regular encrypted backups
• Encrypted transmission for payment processing
• Internal data-protection training and confidentiality obligations of staff

§7 Analytics and marketing tools

7.1 Google Analytics 4 — we use Google Analytics 4 (Google LLC) to analyse the use of our website. IP anonymisation is enabled. Cookies are set only with your consent.

7.2 Google Ads and Google Tag Manager — used to measure advertising effectiveness and to display relevant ads. You can manage your ad settings at adssettings.google.com.

7.3 Meta Pixel — operated by Meta Platforms Ireland Ltd. for conversion measurement and campaign optimisation on Facebook and Instagram. Activated only with your consent.

7.4 Google reCAPTCHA — used to protect forms against spam and abuse. Google's privacy policy applies (policies.google.com/privacy).

All analytics and marketing tools are activated only after you give your explicit consent via the cookie banner. Consent can be withdrawn at any time with effect for the future.

§8 Cookies

8.1 What cookies are — Cookies are small text files stored on your device that allow a website to recognise it and remember preferences.

8.2 Types we use

• Essential cookies — required for core functions (cart, login, language). Retention up to 12 months. Legitimate interest, Art. 6(1)(f) GDPR; no consent required.
• Functional cookies — preferences such as language and currency. Retention up to 12 months. With consent.
• Analytical cookies — Google Analytics 4 for usage statistics. Retention up to 26 months. With consent.
• Marketing cookies — Google Ads, Meta Pixel for personalised advertising. Retention up to 13 months. With consent.

8.3 Managing cookies — you can change or withdraw your consent at any time via the cookie banner, or block cookies in your browser settings. Disabling essential cookies may affect site functionality.

§9 Server logs and hosting

When you visit the website, the following data is processed in server logs for the purpose of operational security and stability under Art. 6(1)(f) GDPR:

• Requested URL
• Date and time of the request
• HTTP status code and amount of data transferred
• Referrer URL
• Browser and operating-system information
• IP address (shortened/anonymised after a short period)

§10 Shipping and payment processing

To fulfil your order we transmit the necessary data (name, delivery address, e-mail and, where applicable, telephone) to the selected carrier. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

For payment processing your data is transmitted to the relevant payment service provider or bank chosen at checkout. Card details are entered directly with the certified payment provider and are not stored by us.

§11 Information provided via forms

When using order, registration or contact forms you provide personal data voluntarily. Mandatory fields are marked. Without these we cannot process your order or reply to your inquiry. Connection metadata (IP address, timestamp) is logged briefly for security purposes.

§12 Automated decision-making and profiling

We use profiling for advertising purposes (e.g. Google Ads remarketing, Meta Pixel) to display relevant ads. This processing does not produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR. Fully automated individual decisions with legal effect are not made. You may object to profiling at any time.

§13 Newsletter

If you subscribe to our newsletter we process your e-mail address (and optionally your name) on the basis of your consent under Art. 6(1)(a) GDPR and § 7 of Act No. 480/2004 Coll. You may unsubscribe at any time using the link in every message or by writing to info@thearchive-store.eu.

§14 Age verification

Because we sell research materials, we verify that visitors and customers are at least 18 years of age. The age confirmation is stored locally in your browser. No personal identification document is collected for this purpose.

§15 Changes to this privacy policy

We reserve the right to update this privacy policy to reflect changes in legislation or in our processing practices. Material changes will be announced on the website. We recommend you review this page periodically.

Contact

For any privacy-related question or to exercise your rights, please contact us at info@thearchive-store.eu.