Privacy Policy

policy for the SPOLUM Drum online shop
Effective from 12. 7. 2026

1. Controller and contact details

The personal data controller is Alexandr Jerechinský, Business ID (IČO): 14124661, with registered office at Litoměřická 834/19d, Prosek, 190 00 Praha 9, Czech Republic (the “Controller”). The Controller operates the online shop under the trading name and brand SPOLUM Drum.

Contact for personal data protection questions: [email protected], tel. +420 731 511 998. Main warehouse and operational contact: Neveklovice 44, 294 13 Neveklovice.

2. Data we process

Depending on how the online shop is used, we process in particular first and last name, billing and delivery addresses, email, telephone number, business details, order contents and history, selected shipping and payment, communications, complaints and returns data, customer account data and technical website usage data (for example IP address, cookie identifiers and security logs).

We do not obtain or store payment card details; the Buyer enters them directly with the payment service provider. We receive only the payment result data needed to match the payment to the order and process it.

3. Purposes and legal bases

We process data to accept and fulfil orders, arrange payment and delivery, communicate with customers and handle withdrawals and complaints, on the basis of performing the contract or taking steps before it is concluded.

We process accounting and tax documents, statutory records and cooperation with public authorities to meet legal obligations. Protecting legal claims, preventing fraud, securing the website and producing basic internal statistics are based on the Controller's legitimate interests.

We send commercial communications to customers to the extent permitted by law or on the basis of consent. Every communication provides a simple way to unsubscribe. We use optional analytics and marketing cookies only on the basis of consent given in the cookie banner.

4. Data recipients

We disclose data only to the extent necessary to hosting and IT support providers, the payment gateway, banks, carriers and collection networks, accounting and tax advisers, email and analytics service providers and public authorities where required by law.

Individual recipients act as processors or independent controllers according to the nature of the service. If data is transferred outside the European Economic Area, we will use appropriate GDPR safeguards, in particular an adequacy decision or standard contractual clauses.

5. Retention periods

We retain order data while performing the contract and then for the period needed to protect legal claims, generally no longer than 3 years unless the law requires a longer period. We retain accounting and tax documents for the statutory period, usually up to 10 years. We retain customer account data until the account is closed and afterwards only to the extent necessary for legal obligations and protection of claims.

We process data for commercial communications until consent is withdrawn or the customer unsubscribes, but no longer than a period appropriate to the customer relationship. We retain technical logs for the period necessary for security and incident resolution.

6. Your rights

You have the right to request access to personal data, rectification, erasure or restriction of processing, the right to data portability, the right to object to processing based on legitimate interests and the right to withdraw consent at any time, without affecting the lawfulness of earlier processing.

Send requests to [email protected]. Before handling a request, we may reasonably verify the applicant's identity. We will respond without undue delay, generally within one month. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

7. Automated decision-making and security

We do not carry out decision-making based solely on automated processing that would have legal or similarly significant effects on the customer. We take appropriate technical and organisational measures to protect data and restrict access to people who need it for their work.

8. Earlier orders and policy changes

Orders concluded before 12. 7. 2026 remain with the seller and controller stated in their confirmations and documents. This policy does not itself transfer the database of earlier customers or marketing consents to a new controller.

We may update this policy when services or legal requirements change. The current wording and effective date are always published on this page.