Privacy policy
This Privacy Policy explains how Gullyo s.r.o. collects, uses, discloses and otherwise processes your personal data when you visit or use our online store and website, make a purchase or other transaction, or otherwise communicate with us (collectively, the “Services”). It also explains your rights under the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and Czech Act No. 110/2019 Coll., on the processing of personal data.
Our website is operated using the Shopify e-commerce platform, which acts as our processor and, in certain limited respects described below, as an independent controller. Please read this Privacy Policy carefully. If you do not agree with it, please do not use the Services.
1. Who we are (Data Controller)
The controller responsible for the processing of your personal data is:
- Gullyo s.r.o., Company Reg. No. (IČO): 234 82 923
- Registered office: Děčínská 552/1, Střížkov, 180 00 Prague 8, Czech Republic
- Registered with the Municipal Court in Prague, Section C, File No. 427813
- E-mail: house@gullyo.com
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR. For all data protection matters, please use the contact details above.
2. Personal data we collect or process
“Personal data” means any information relating to an identified or identifiable natural person. It does not include anonymous or irreversibly de-identified data. Depending on how you interact with the Services, we may process the following categories of personal data:
- Contact details — your name, billing address, shipping address, telephone number and e-mail address.
- Financial and payment information — payment card details, financial account information, transaction details, form of payment and payment confirmations. Note: full card numbers are processed by our payment service providers, not stored by us.
- Account information — username, password (in hashed form), preferences and settings.
- Transaction information — items you view, add to your cart or wishlist, and orders you purchase, return, exchange or cancel.
- Communications — the content of messages you send us, for example customer-support enquiries.
- Device and technical information — your device, browser and network information, IP address and other online identifiers, collected partly through cookies and similar technologies.
- Usage information — information about how and when you interact with and navigate the Services.
We do not intentionally collect special categories of personal data (Article 9 of the GDPR) such as data on health, ethnicity or political opinions. Please do not provide such data to us through the Services.
3. Sources of personal data
We obtain personal data from the following sources:
- Directly from you — when you create an account, place an order, use the Services or communicate with us;
- Automatically — from your device and through cookies and similar technologies when you use the Services;
- From our processors and service providers — including Shopify and payment, logistics and analytics providers acting on our behalf;
- From third parties — such as marketing partners, where permitted by law.
4. Purposes and legal bases of processing
Under Article 6 of the GDPR, we may only process your personal data where we have a valid legal basis. The table below sets out each purpose and the corresponding legal basis.
| Purpose of processing | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing the Services, processing and fulfilling your orders, managing your account, handling returns and exchanges | Performance of a contract — Art. 6(1)(b) |
| Processing payments and preventing payment fraud | Performance of a contract — Art. 6(1)(b); and our legitimate interest in securing transactions — Art. 6(1)(f) |
| Responding to your enquiries and providing customer support | Performance of a contract — Art. 6(1)(b); or our legitimate interest in responding to you — Art. 6(1)(f) |
| Direct marketing to existing customers about similar products (e-mail), which you can object to at any time | Our legitimate interest in promoting our business — Art. 6(1)(f) |
| Sending marketing communications to non-customers, and personalised/online behavioral advertising and related cookies | Your consent — Art. 6(1)(a) (and § 7 of Act No. 110/2019 Coll. / ePrivacy rules for cookies) |
| Security, authentication, and detecting or preventing fraud, abuse or unlawful activity | Our legitimate interest in protecting the Services and users — Art. 6(1)(f) |
| Keeping accounting and tax records and meeting statutory retention duties | Compliance with a legal obligation — Art. 6(1)(c) |
| Establishing, exercising or defending legal claims, and responding to lawful requests from authorities | Compliance with a legal obligation — Art. 6(1)(c); or our legitimate interest in protecting our rights — Art. 6(1)(f) |
Where we rely on legitimate interests, we have carried out a balancing test to ensure that our interests are not overridden by your rights and freedoms. You may ask us for more information about this balancing test using the contact details above. Where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
5. Cookies and similar technologies
We use strictly necessary cookies to operate the Services; these do not require consent. We use analytics, functional and advertising cookies only on the basis of your consent, which we obtain through our cookie banner when you first visit the website. You can withdraw or change your cookie preferences at any time via the cookie settings on the website. For details of the specific cookies used, please see our Cookie Policy / cookie settings panel.
6. Recipients — how we disclose personal data
We may disclose your personal data to the following categories of recipients:
- Processors and service providers acting on our behalf, including Shopify (platform hosting), and providers of payment processing, IT, data analytics, customer support, cloud storage, fulfilment and shipping. These act under a data processing agreement pursuant to Article 28 of the GDPR.
- Marketing and advertising partners, only where you have consented to personalised advertising. These partners use your data in accordance with their own privacy notices.
- Third parties at your direction, such as carriers when we ship your order, or social-media or login integrations you choose to use.
- Public authorities, courts and advisors, where necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
- A successor entity in connection with a merger, acquisition, insolvency or other business transaction, subject to this Privacy Policy.
We do not sell your personal data.
7. Relationship with Shopify
The Services are hosted by Shopify, which processes personal data on our behalf as our processor in order to provide and improve the Services. In addition, for certain enhanced features Shopify may process personal data as an independent controller — for example to support fraud prevention and personalised advertising across merchants that use its platform. Where Shopify acts as an independent controller, it is responsible for that processing and for handling your requests in respect of it. To learn more, see the Shopify Consumer Privacy Policy at https://privacy.shopify.com/en.
8. International transfers
Your personal data is primarily processed within the European Economic Area (EEA). Some of our processors (including Shopify and certain sub-processors) may transfer personal data to countries outside the EEA, including the United States.
Where we or our processors transfer personal data outside the EEA, we ensure an appropriate safeguard under Chapter V of the GDPR, namely one or more of the following:
- a European Commission adequacy decision for the recipient country (Article 45 of the GDPR);
- for transfers to the United States, certification of the recipient under the EU–U.S. Data Privacy Framework, where applicable;
- the European Commission’s Standard Contractual Clauses (Article 46 of the GDPR), together with supplementary measures where necessary.
You may request a copy of the relevant safeguard using the contact details in Section 1.
9. How long we keep your personal data
We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting or reporting requirements. Our principal retention periods are:
- Account data — for as long as your account is active, and then deleted or anonymised within 12 months of account closure.
- Order and transaction data — kept as part of accounting and tax records for 10 years from the end of the relevant accounting period, as required by Czech accounting and VAT legislation.
- Customer-support communications — typically for up to 3 years after the last contact.
- Marketing data processed on consent — until you withdraw consent or object, and in any case reviewed periodically.
- Cookies and similar identifiers — for the lifetime stated in our cookie settings, generally no longer than 13 months.
10. Your rights
Subject to the conditions and exceptions set out in the GDPR, you have the following rights in relation to your personal data:
- Right of access (Art. 15) — to obtain confirmation of, and a copy of, the personal data we hold about you.
- Right to rectification (Art. 16) — to have inaccurate or incomplete data corrected.
- Right to erasure (Art. 17) — to have your data deleted in certain circumstances (“right to be forgotten”).
- Right to restriction of processing (Art. 18) — to restrict processing in certain circumstances.
- Right to data portability (Art. 20) — to receive data you provided in a structured, commonly used, machine-readable format and to have it transmitted to another controller.
- Right to object (Art. 21) — to object to processing based on legitimate interests, and at any time to processing for direct-marketing purposes.
- Right to withdraw consent (Art. 7(3)) — where processing is based on consent, at any time, without affecting prior processing.
- Right not to be subject to solely automated decisions (Art. 22) producing legal or similarly significant effects.
To exercise any of these rights, contact us at house@gullyo.com. We will respond without undue delay and in any event within one month, as required by Article 12 of the GDPR. We may need to verify your identity before acting on your request. Exercising your rights is free of charge unless your request is manifestly unfounded or excessive.
11. Right to lodge a complaint
If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement. The supervisory authority in the Czech Republic is:
- Úřad pro ochranu osobních údajů (Office for Personal Data Protection)
- Pplk. Sochora 727/27, 170 00 Prague 7, Czech Republic
- E-mail: posta@uoou.gov.cz · Data box: qkbaa2n · Web: https://uoou.gov.cz
We would, however, appreciate the opportunity to address your concerns before you approach the supervisory authority, so please consider contacting us first.
12. Children
The Services are intended for adults and are not directed at children. In the Czech Republic, in relation to information-society services, a child may give valid consent to the processing of personal data from the age of 15 (§ 7 of Act No. 110/2019 Coll.); below that age, consent must be given or authorised by the holder of parental responsibility. We do not knowingly process the personal data of children below this age without such authorisation. If you believe that a child has provided us with personal data without the required consent, please contact us and we will delete it.
13. Security of your personal data
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, taking into account the state of the art and the risks of the processing (Article 32 of the GDPR). However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please avoid sending us sensitive information through unsecured channels.
14. Third-party websites and links
The Services may contain links to websites or platforms operated by third parties. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing them with your personal data.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for operational, legal or regulatory reasons. We will post the updated version on this website and revise the “Last updated” date below. Where required by law, we will provide additional notice or seek your consent.
16. Contact us
If you have any questions about this Privacy Policy or about how we process your personal data, or if you would like to exercise your rights, please contact us:
- Gullyo s.r.o. — Děčínská 552/1, Střížkov, 180 00 Prague 8, Czech Republic
- E-mail: house@gullyo.com
For the purposes of applicable data protection law, Gullyo s.r.o. is the controller of your personal data.
Last updated on 17th June 2026