No products in the cart.
Privacy Policy
Privacy Policy
Effective Date: 12 May 2025
This document (hereinafter the “Policy”) describes how CIA – Central Information Agency s.r.o., ID No. 215 12 540, Plzeňská 3352/156, 150 00 Prague 5, registered with the Municipal Court in Prague, Section C, Insert 403032 (hereinafter the “controller” or “we”), as the operator of the online stores ciasecured.cz / ciasecured.com / ciasecured.de (collectively the “e-shop”), processes personal data of natural persons – customers and website visitors.
We want you to know exactly what data we need about you, why we collect it, how we handle it and what rights you have. The text is divided into logical blocks and includes examples, retention periods and contact details so that you can navigate it easily.
1 What personal data we process and why
Registration and management of a customer account
- Data processed: first name, last name, e-mail, password (hash), address, company details (name, ID, VAT ID); optionally an avatar and links to social profiles (Google / Facebook).
- Legal basis: performance of a contract (Art. 6 (1)(b) GDPR); consent (a) only for optional data.
- Retention period: for the lifetime of the account; accounts with no login or order for more than 3 years are anonymised.
Conclusion of a purchase contract (order, reservation, enquiry)
- Data processed: first name, last name, e-mail, billing and delivery address, company details (ID, VAT ID).
- Legal basis: performance of a contract (b); legal obligation (c); legitimate interest (f).
- Retention period:
- Pending / Failed / Cancelled – 30 days, then anonymisation
- Completed / Refunded – 10 years (accounting documents)
Card payments (Stripe)
- Data processed: first name, last name, e-mail, billing address, card token, amount, currency, last 4 digits of the card.
- Legal basis: performance of a contract (b); legal obligation (c); legitimate interest (f – fraud prevention).
- Retention period: 10 years.
Parcel delivery (GLS – courier, pick-up point, ParcelShop)
- Data processed: first name, last name, address, e-mail, phone.
- Legal basis: performance of a contract (b).
- Retention period: for the time necessary to deliver and for standard complaint periods.
Claims, service and communication
- Data processed: identification, contact (excluding phone) and transaction data.
- Legal basis: performance of a contract (b); legal obligation (c).
- Retention period: 5 years after settlement.
Sending commercial communications (newsletter)
- Data processed: e-mail.
- Legal basis: legitimate interest (f) under § 7(3) Act 480/2004 Sb.
- Retention period: 3 years from the last purchase or until unsubscribe.
Cookies and online identifiers
- Data types: IP address, cookies, pixel ID, device data.
- Legal basis: legitimate interest (f) / consent (a).
Note: without the mandatory data marked above we could not process your order or create an account. Giving consent is always voluntary and can be withdrawn at any time.
2 Who processes your data
- Controller (us) – operation of the e-shop, customer support.
- Stripe Payments Europe, Ltd. – payment gateway.
- GLS Czech Republic s.r.o. – parcel delivery.
- Google Ireland Ltd. – Google Analytics 4.
- Meta Platforms Ireland Ltd. – Meta Pixel / Ads.
- Security CDN – DDoS protection and faster loading.
An extended list of processors including technical details is available on request.
3 Transfer of data outside the EU / EEA
When using the above services, data may be transferred to the USA. The transfer is secured by certification under the EU-US Data Privacy Framework or by Standard Contractual Clauses (SCC) together with supplementary technical measures (TLS 1.2+, token pseudonymisation, IP masking in GA4).
4 How we protect your data
- Data are stored in encrypted repositories and transmitted via secured protocols TLS 1.2+.
- Access is restricted by role-based access control and protected by multi-factor authentication.
- Back-ups are kept separately for 30 days and we regularly test restoration.
- Security incidents are handled within < 24 h of detection.
- Employees are bound by confidentiality and trained regularly.
5 Automated decision-making and profiling
Based on cookies and purchase data we create marketing segments (e.g. “customers of consumable goods”) and display targeted advertising on Meta and Google platforms. This procedure has no legal or significant personal effect on the data subject. You can:
- withdraw consent to marketing cookies in the cookie banner,
- object to marketing by e-mail at support@ciasecured.cz.
6 Cookies
- Necessary cookies (WooCommerce, security service) – 1 year, core functionality of the e-shop, legal basis: legitimate interest.
- Analytical cookies (GA4) – 14 months, traffic measurement, legal basis: consent.
- Marketing cookies (Meta Pixel, Google Ads) – 90 days, personalised advertising, legal basis: consent.
You can modify your consent at any time in the cookie banner or by adjusting your browser settings.
7 Sending commercial communications (newsletter)
In accordance with § 7(3) Act 480/2004 Sb. and Art. 6 (1)(f) GDPR, we may send offers of similar goods to your e-mail. You can unsubscribe with one click or change preferences in your account.
8 Your rights
- Right to information
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to data portability
- Right to object
- Right to lodge a complaint with the supervisory authority
We accept requests by e-mail at support@ciasecured.cz or by post. We will respond without undue delay, at the latest within 1 month.
9 Final provisions
This Policy enters into force on the date stated at the top. This is the first public version of the document; future versions will be archived and made available on request. The controller reserves the right to update the Policy; the new wording will always be published on the website.
If you have any questions, write to support@ciasecured.cz. We will be happy to help.