PROCESSING OF PERSONAL DATA

The company NAYAVITA s.r.o., with its registered office at Radniční 133/1, 370 01 České Budějovice, Czech Republic, Company ID: 09435271, registered in the Commercial Register maintained by the Regional Court in České Budějovice, Section C, File No. 30198 (hereinafter referred to as the “Controller”), hereby informs its customers, in accordance with Article 12 et seq. of Regulation (EU) 2016/679 of the European Parliament and of the Council, effective as of 25 May 2018, about the processing of their personal data when using its services.

I. PERSONAL DATA

The Controller declares that it collects, processes, and uses customers’ personal data in accordance with applicable data protection laws and the General Data Protection Regulation (GDPR).

Personal data means any information relating to an identified or identifiable natural person (Article 4(1) GDPR).

The Controller primarily processes personal data obtained directly from customers. These are data provided by customers in connection with order processing. Data transmission takes place in encrypted form using the SSL protocol. This category does not include statistical data that cannot be directly linked to a specific person and that the Controller collects, for example, when a visitor accesses the e-shop.

The Controller processes in particular the following personal data, and where applicable other data necessary for the processing purpose:

  • First and last name

  • Address

  • Telephone number

  • E-mail address

II. PURPOSE OF PROCESSING

The purpose of processing personal data is the fulfillment of the Controller’s obligations arising from the contract concluded between the customer as the buyer and the Controller as the seller, as well as the fulfillment of legal obligations arising from generally binding legal regulations.

Further purposes of processing may include, in particular, responding to inquiries, adjusting future customer orders, improving the Controller’s business activities, and communicating with customers.

III. LEGAL GROUNDS (BASES) FOR PROCESSING PERSONAL DATA

The Controller processes personal data in accordance with Article 6 of Regulation (EU) 2016/679 (GDPR) solely on the basis of the following legal grounds:

a) Performance of a contract
Personal data are processed for the purpose of concluding and performing a contract between the Controller and the customer, in particular for order processing, payment handling, delivery of goods, and complaint handling.

b) Fulfillment of a legal obligation
Personal data are processed to comply with obligations arising from legal regulations, especially in the area of accounting, taxation, and archiving.

c) Legitimate interest of the Controller
Personal data may be processed on the basis of the Controller’s legitimate interest, in particular for the purposes of:

  • ensuring the functionality and security of the website,

  • protection of the Controller’s legal claims,

  • prevention of fraud and misuse of services,

  • communication with customers regarding their inquiries or orders.

d) Consent of the data subject
Personal data are processed on the basis of the data subject’s consent, in particular for sending commercial communications (newsletters), personalization of marketing communications, and the use of analytical or marketing cookies.
Consent is always voluntary and may be withdrawn at any time in the manner specified in these data protection principles.

IV. OBLIGATION TO PROVIDE PERSONAL DATA

Providing personal data is necessary for the fulfillment of rights and obligations arising from the concluded contract.

V. DURATION OF PROCESSING

Personal data are processed for the period strictly necessary to fulfill the purpose for which they were collected.

Personal data processed for the performance of a contract (order processing, invoicing, delivery of goods) are stored for the duration of the contractual relationship and subsequently for the period required by the Controller’s legal obligations, in particular under accounting and tax regulations.

Personal data processed for communication with customers (inquiries, complaints, feedback) are stored for the time necessary to resolve the matter, but no longer than 3 years, unless otherwise required by law.

Personal data processed on the basis of consent (e.g. newsletter subscription) are stored for the duration of the consent or until its withdrawal.

If a visitor leaves a comment on the website, the personal data included in the comment and related metadata are stored for the duration of the comment’s existence, but no longer than necessary for moderation, spam prevention, and protection of the Controller’s legitimate interests. Comments may be removed upon the data subject’s request unless another legal reason for retention exists.

After the expiration of the above retention periods, personal data are securely deleted or anonymized.

VI. INFORMATION FOR DATA SUBJECTS

NAYAVITA s.r.o. informs its customers that they have the right to:

  • obtain confirmation from the Controller as to whether personal data concerning them are being processed and, if so, to access such data and information regarding:

    • the purposes of processing,

    • categories of personal data concerned,

    • recipients or categories of recipients, including recipients in third countries or international organizations,

    • the planned storage period or criteria used to determine it,

    • the existence of the right to request rectification or erasure, restriction of processing, or to object to processing,

    • the right to lodge a complaint with a supervisory authority;

  • request rectification of inaccurate personal data or completion of incomplete personal data without undue delay;

  • request erasure of personal data without undue delay where one of the following grounds applies:

    • personal data are no longer necessary for the purposes for which they were collected,

    • consent has been withdrawn and no other legal basis applies,

    • personal data were processed unlawfully,

    • erasure is required to comply with a legal obligation;

  • request restriction of processing if:

    • the accuracy of personal data is contested,

    • processing is unlawful and restriction is requested instead of erasure,

    • data are no longer needed for processing purposes but are required for legal claims;

  • data portability, i.e. to receive their personal data or have them transferred to another controller, where technically feasible;

  • object to the processing of personal data based on the Controller’s legitimate interest;

  • lodge a complaint with the supervisory authority (Office for Personal Data Protection).

VI.a Exercise of Data Subject Rights and Access to Personal Data

The Controller does not operate customer accounts with online access to personal data on its website.

Data subjects may exercise their rights under the GDPR at any time by submitting a request via e-mail to hello@nayavita.com.

The Controller shall provide information on processed personal data, perform rectification, erasure, restriction of processing, or ensure data portability without undue delay, no later than within the period stipulated by applicable legal regulations.

The Controller is entitled to verify the identity of the applicant for the purpose of protecting personal data.

VII. RECIPIENTS OF PERSONAL DATA

Personal data are disclosed only to the extent necessary and exclusively to recipients required to ensure proper website operation, fulfillment of contractual obligations, or compliance with legal obligations.

Personal data processors may include in particular:

a) Providers of technical and analytical services

  • Google Ireland Limited – analytical tools (Google Analytics), cloud and advertising services

  • Meta Platforms Ireland Limited – marketing and advertising services (Facebook, Instagram)

b) E-mail communication and marketing service providers

  • The Rocket Science Group LLC (Mailchimp) – newsletter distribution and e-mail communication management

c) Logistics and warehousing service providers

  • external fulfillment and logistics partners providing storage, packaging, and delivery of orders

d) Payment and shipping service providers

  • payment gateways, banking institutions, and carriers, to the extent necessary for payment processing and order delivery

Personal data may also be transferred to public authorities where required by law.

Some recipients may be located outside the European Union or the European Economic Area. In such cases, personal data are transferred only in compliance with GDPR requirements, in particular on the basis of standard contractual clauses or other appropriate safeguards.

VIII. COMMERCIAL COMMUNICATIONS (NEWSLETTER)

The Controller sends commercial communications (newsletters) solely on the basis of the data subject’s free and voluntary consent.

For this purpose, the Controller processes in particular the following personal data: first name, e-mail address, and, where applicable, information about interactions with newsletter content (e.g. opening e-mails, clicking links).

Personal data processing is carried out via the Mailchimp platform, operated by The Rocket Science Group LLC, acting as a personal data processor.

Consent to receive commercial communications may be withdrawn at any time by:

  • clicking the unsubscribe link included in the footer of each newsletter, or

  • contacting the Controller via e-mail at hello@nayavita.com.

Personal data are processed for this purpose for the duration of the consent, but no longer than until its withdrawal.

IX. COMMENTS

If visitors leave a comment on the website, the Controller collects personal data provided in the comment form, as well as the visitor’s IP address and browser user agent information, for the purposes of:

  • publishing and managing comments,

  • protecting the website,

  • preventing spam and misuse.

The legal basis for processing personal data in connection with comments is the Controller’s legitimate interest in ensuring website functionality and content protection.

Comments and related personal data are stored for the duration of the comment’s existence. The Controller reserves the right to moderate, remove, or anonymize comments, particularly if they violate legal regulations or good morals.

Data subjects may request removal or anonymization of their comment at any time by contacting hello@nayavita.com, unless another legal reason for retention exists.

Once approved, the comment content and, where applicable, the user’s profile image may be publicly displayed.

X. COOKIES

The Controller’s website uses cookies and similar technologies to ensure proper website functionality, improve user experience, and evaluate website traffic.

Technical (necessary) cookies are required for proper website operation and security. These cookies are processed based on the Controller’s legitimate interest and do not require user consent.

Analytical and marketing cookies are used to evaluate website traffic, optimize content, and display relevant advertising. These cookies are processed only on the basis of user consent, granted via the cookie banner upon the first visit to the website.

Users may at any time:

  • withdraw their cookie consent,

  • change cookie settings, or

  • reject cookies entirely,
    via the cookie banner or their web browser settings.

Detailed information about individual cookies, their purpose, and retention period is available through the cookie banner on the Controller’s website.

In České Budějovice on 20 January 2026

Privacy policy overview

This website uses cookies.

Essential cookies are required for the proper functioning of the website and cannot be disabled.
With your consent, we also use analytical and marketing cookies to help us understand how the website is used and to improve our services.

You can manage or withdraw your consent at any time in the cookie settings.