Privacy Policy, Cookies and Your Data

Postboxy, s.r.o., with its registered office at Kumpoštova 123/8, Sadová, 612 00, Brno, Czech Republic, identification number 09322841, registered in the Commercial Register maintained by the Regional Court in Brno under file number C 118449 (the Company or we), which in the course of its activities as a controller processes personal data of its customers (including potential ones) and website visitors (You), in accordance with Regulation (EU) No. 2016/679 of the European Parliament and of the Council (GDPR), hereby, in accordance with Article 13 of the GDPR and § 89(3) of Act No. 127/2005 Coll., on Electronic Communications (the Electronic Communications Act), provides the following information about this processing (the Policy):

1. What is the purpose of this Policy?

If you cooperate with us, whether you are our customer, or if we are considering establishing any form of cooperation with you, or if you have visited our website, we process some of your personal data that you have provided to us or that we have obtained by other lawful means.

In this document, you will find summary information about what personal data, to what extent, in what manner, for what purpose, for how long we process it, and what your individual rights are in connection with this processing of personal data.

2. How can you contact us?

If anything is unclear to you regarding how we handle personal data, please contact us at the email address: hello@monokoatelier.com or at the correspondence address of our Company: Postboxy, s.r.o., Kumpoštova 123/8, Sadová, 612 00, Brno, Czech Republic.

3. From what sources do we obtain personal data?

We obtain your personal data either by you providing it to us directly, e.g., in the course of negotiations about possible future cooperation through our website or other communication channels, or during the cooperation itself (identification, contact data, billing or transaction data), or we collect it automatically through our IT systems whenever you access our website (web browsing data and marketing cookies).

4. What personal data do we process and for what purpose?

We only process the data we need to fulfill our contractual obligations, or to carry out measures taken on the basis of your order, to comply with our legal obligations (e.g., to maintain proper accounting records), to pursue our legitimate interests (e.g., to offer you our products or assess the suitability of possible mutual cooperation), or data for which you give us your consent. We process your personal data only to the extent necessary and proportionate to the stated purpose of processing.

For your convenience, we have prepared the following table showing what data we process, for what purpose, and on what legal basis:

Category of personal data	What data is involved?	Why do we process the data?	What is our legal basis?
Identification data	name, surname, permanent address, title	For your identification when processing your order, accounting, and sending offers of our products and services.	Performance of contract (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c) GDPR), legitimate interest (Art. 6(1)(f) GDPR).
Contact data	email, phone, product delivery address	For communication and processing your order, accounting, and sending offers of our products and services.	Performance of contract (Art. 6(1)(b) GDPR), legitimate interest (Art. 6(1)(f) GDPR), consent to receive offers (Art. 6(1)(b) GDPR in conjunction with § 7(2) of Act No. 480/2004 Coll.).
Billing and transaction data	information on invoices, credit notes, billing terms, payment data, billing address	For proper accounting and fulfillment of our obligations under the contract concluded with you and for compliance with our legal obligations.	Performance of contract (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c) GDPR).
Mutual communication data	notes from phone and personal conversations, written, email and other communication	To ensure customer care and strengthen our reputation.	Legitimate interest (Art. 6(1)(f) GDPR).
Web browsing data	IP address, device and operating system type, pages visited, source of the visit, essential and technical cookies, and one traffic-measurement identifier valid for at most 13 months	To keep the site and the online store working, and to measure traffic and your progress through the configurator. This data stays in our database and is not passed to third parties.	Legitimate interest (Art. 6(1)(f) GDPR), performance of contract and pre-contractual measures (Art. 6(1)(b) GDPR).
Marketing cookies	marketing cookies and social network plugins; and, if we start advertising, advertising click identifiers (gclid, fbclid) and the record of a completed order which, together with hashed contact details, we report to Google Ads and Meta	To customize the content of our website and to display advertising on social networks and third-party websites.	Your consent to the use of marketing cookies (Art. 6(1)(a) GDPR).
Photographs and engraving source files	the photographs you upload to the configurator, their technical copies (a reduced-resolution working copy and the crop matching the placement you chose), and the relief height maps created from them	So that we can show you a preview of the piece, create a relief from the photograph, and give the manufacturer the source file for engraving. A photograph may also show other people or pets; by uploading it you confirm that you are entitled to provide it to us for this purpose.	Performance of contract and pre-contractual measures (Art. 6(1)(b) GDPR).

All the above categories of personal data may be processed to the extent necessary for the establishment, exercise, or defense of our legal claims, based on our legitimate interest in the protection of our rights (Art. 6(1)(f) GDPR).

5. What data do we process about you on our website?

On our website we use cookies and similar tools (such as your browser's storage). Cookies are small text files saved to your browser when you visit our pages. Below we describe three groups, which differ in what they are for and in whether we need your consent for them.
Essential and technical — the site does not work without them: they hold the contents of your basket, your chosen language and currency, the progress of your order, and the administration login. We always use them, and under the Electronic Communications Act we do not need your consent for them.
Traffic measurement — we record which pages you view, how you move through the configurator, and how many orders result, so that we can improve the store. This measurement is strictly limited: the data stays in our database or with Vercel, our hosting provider, which measures page traffic and speed for us as our processor and stores nothing in your browser; we pass it to no advertiser, we do not link it to your behaviour on other sites or across devices, and visits are told apart by a single identifier valid for at most 13 months. We therefore do not need your consent for it (legitimate interest under Art. 6(1)(f) GDPR). You can switch all of it off at any time using the button below.
Marketing — we run these only with your consent, given with the button at the end of this section; without it, none of the below runs. This group is empty today: we do not advertise on Google, Facebook or Instagram. If we start, we will add Google Tag Manager with Google Analytics, Google Ads and the Meta Conversions API, and report a completed order to them including a hashed email, phone number and name so it can be matched to your account with those services — again, only with your consent.
You can withdraw or grant your marketing consent at any time with the button below. Traffic measurement is switched off with the button next to it. Your browser settings also let you block cookies entirely; blocking the essential ones, however, will make it impossible to complete an order.

6. What happens if you refuse to provide personal data?

As long as you have not concluded any contract with us, you may decide not to provide us with any of the above categories of personal data and not to enter into a contract with us.

However, if we have already established a business relationship or you are interested in establishing one, we will need at least your identification, contact, billing, and transaction data to fulfill our obligations (in the case of subcontractors, also some profile data such as education and work experience), otherwise we cannot establish cooperation with you or provide you with our services.

For personal data that we process based on your consent, you have the right to withdraw your consent at any time. If you do so, you will not question the legality of the processing of personal data before its withdrawal, but we will no longer be able to process this data in the future.

7. How long will we retain your personal data?

We retain your personal data only for the time necessary to fulfill the purpose for which we process it, after which we irreversibly delete it. The retention period for individual categories of data varies according to the purpose of their processing:

data processed for the performance of a contract, i.e., identification, contact, billing, and transaction data, are retained for the entire duration of the contractual relationship and until the expiration of the longest limitation period relating to the obligations and rights governed by this contract (generally 10 years of limitation period and 1 year after its expiration for claims made at its end, unless a longer limitation period was agreed or extended);
data processed for compliance with the legal obligation to maintain proper accounting records, i.e., billing and transaction data, are retained for a maximum of 10 years from the end of the tax period in which the last document related to your order was issued or the last transaction was made;
data processed on the basis of our legitimate interest in offering our products and services, i.e., identification and contact data, are retained for 3 years following the termination of the contractual relationship or from our last contact (if no business relationship was established);
data processed on the basis of your consent to receive offers of our products and services, i.e., identification and contact data, are processed only for the period to which you have consented, i.e., no longer than 3 years, unless you withdraw your consent earlier;
data processed on the basis of our legitimate interest in ensuring customer care and strengthening our reputation, i.e., mutual communication data, are retained for the duration of mutual communication and until the end of the calendar year following our last contact;
web browsing data processed on the basis of our legitimate interest in ensuring the smooth operation of our website are retained for the duration of their validity, but no longer than 13 months, unless you remove technical and analytical cookies from your device earlier;
data processed on the basis of your consent to display our advertising on social networks and third-party websites are processed only for the duration of their validity to which you have consented, i.e., no longer than 13 months, unless you withdraw your consent earlier;
photographs and engraving source files: a photograph that does not result in an order is deleted automatically within 90 days of upload; for completed orders we delete the photograph within 90 days of the piece being dispatched and retain only the height map used for engraving, so that we can handle any warranty claim without having to ask you for a new photograph.

EXIF metadata — including the location where the photograph was taken and the device that took it — is removed immediately after upload and is not processed further. To have the piece made, we give the manufacturer your photograph, the height map for engraving and the order parameters. You may ask us to delete a photograph before the periods above expire, using the contact details in section 2.

8. To whom do we transfer personal data for processing? With whom do we share personal data?

Since we use external suppliers for some of our business services, we transfer your personal data to them to the extent necessary so that they can provide these services to us. These are suppliers of:

software services and marketing services (e.g., Google, Facebook, Instagram);
tax and legal services;
payment services (Stripe);
email services for sending transactional and marketing emails (Resend);
hosting and analytics services (Vercel);
database services for storing and processing orders and customer data (Neon);
web security and abuse prevention services (Upstash);
manufacturing and engraving services — the partner jewellery workshop, to which we give your photograph, the height map for engraving and the order parameters;
automated image-processing services that create the relief and the height map from your photograph (Replicate, OpenAI, Google);

When transferring personal data to these suppliers, we ensure that as processors they use the transferred personal data only to achieve the purposes set out above.

Since we also use services of processors based in the USA (Google, Stripe, Resend, Vercel, Neon, Upstash, Replicate, OpenAI), we also transfer personal data outside the EU.

We do not transfer personal data to international organizations.

9. Do we use automated decision-making, including profiling?

In the processing of your personal data, there is no automated decision-making or profiling, i.e., a situation where personal data would be processed automatically, without human intervention, and the result of this automated processing would have legal effects on the data subject or similarly significantly affect them. A human is always present in any handling of your data on our part. If we wanted to proceed with the use of an automated decision-making process in the future, we would inform you of such intention.

10. What rights do you have in relation to personal data and how can you exercise them?

It is our obligation and priority to ensure that the processing of all personal data by our Company is carried out properly and securely. Only authorized persons have access to personal data through secured access, and when the data is no longer needed, we will delete it. We also guarantee you the rights listed below, which you can exercise with us in writing, by phone, or by email at the contacts listed above. We provide all information and statements regarding your exercised rights free of charge. Only if we find your request to be manifestly unfounded or excessive may we charge a reasonable fee reflecting the administrative costs associated with providing the requested information. If you ask us for a statement or information about measures taken, we will provide them to you as soon as possible, but no later than within one month.

Right to information about the processing of your personal data and access to personal data
You have the right to be informed whether we process your personal data, what data is involved, for what purpose we process it, to whom we transfer your data, what rights you have in connection with our processing, that you can contact the Office for Personal Data Protection, what are the sources of processed personal data, and whether automated decision-making and profiling occurs. Upon your request, we will also provide you with a copy of the processed personal data, provided that this does not adversely affect the rights and freedoms of other persons.
Right to rectification
If any of your personal data that we process has changed, for example you have changed your address or phone number, you have the right to request that we correct this data. In addition, you have the right to have incomplete personal data completed, including by providing a supplementary statement.
Right to erasure (right to be forgotten)
You have the right to request that we erase your personal data. Your request is then subject to individual assessment; despite your right to erasure, we may have an obligation or legitimate interest to retain your personal data, for example if it concerns invoices that we need to keep for tax purposes. In any case, you will be informed in detail about the resolution of your request.
Right to restriction of processing
You have the right to request that we restrict the processing of your personal data in the following cases: you have contested the accuracy of the personal data; the processing is unlawful and you do not wish to have the data erased; we no longer need your personal data for processing purposes, but you require it for the establishment, exercise, or defense of your legal claims; you have objected to processing and verification is underway as to whether our legitimate grounds for processing override yours.
Right to data portability
If you ask us to provide your personal data to another controller or another company, we will transfer your personal data in an appropriate format to the entity you designate, provided that no legal or other significant obstacles prevent us from doing so.
Right to object and automated individual decision-making
If you believe that we are processing personal data in violation of the protection of your private and personal life or in violation of legal regulations, you may contact us and ask us for an explanation or to remedy the situation.
Right to lodge a complaint with the Office for Personal Data Protection
If you feel that we are handling your personal data in violation of our obligations, please contact our contact person listed in the header of this document. If you are not satisfied with our response, you always have the right to file a complaint or petition regarding the processing of personal data with the supervisory authority, namely the Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7.