Privacy policy
What data we collect when you shop at gramino.com, why, who else sees it and how long we keep it.
Gramino s.r.o., registered office Frýdecká 424, Kanada, 739 61 Třinec, Czech Republic, company ID 05769884, is the controller of your personal data under Article 4(7) GDPR.
For anything on this page write to gdpr@gramino.com or to Gramino s.r.o., Frýdecká 424, 739 61 Třinec, Czech Republic. We have not appointed a data protection officer, so your request reaches us directly.
This page covers gramino.com. Our Czech, Slovak and Polish stores have their own privacy policies.
What we process and why
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Processing and delivering your order | Name, e-mail, phone, billing and delivery address, order contents | Contract — Art. 6(1)(b) | The contract and 3 years after the last performance |
| Payment | Transaction identifiers and status. Card details never reach us — they stay with Stripe | Contract — Art. 6(1)(b) | 3 years |
| Invoices and accounting | Billing details, order contents, amounts | Legal obligation — Art. 6(1)(c) | Tax documents 10 years, accounting records 5 years |
| Returns, claims and refunds | Order data, bank account number (IBAN) for the refund | Contract and legal obligation — Art. 6(1)(b), (c) | 3 years from settlement |
| Defending our rights in a dispute | Order and communication history | Legitimate interest — Art. 6(1)(f) | Until the claim is time-barred |
| Your user account | E-mail, password (stored hashed), addresses, order history | Contract — Art. 6(1)(b) | Until you delete it, or after 365 days of inactivity |
| Newsletter, including a reminder of items left in your cart | E-mail, name, what you open and click, and the items left in your cart. We save the e-mail you enter at checkout as soon as you type it, before you place the order | Your consent — Art. 6(1)(a) | Until you unsubscribe |
| Product reviews you write | The name shown with the review, the text, the purchase it relates to | Your consent — Art. 6(1)(a) | While the review is published |
| Customer support by e-mail | Whatever you write to us | Legitimate interest — Art. 6(1)(f) | 3 years |
| Running and protecting the site | IP address, browser and device data, request logs | Legitimate interest — Art. 6(1)(f) | Short-term, per our providers' log retention |
| Cookies | See the cookie declaration | Necessary cookies: legitimate interest. All others: your consent | See the cookie declaration |
Who else sees your data
We share your data only with the parties we need to run the shop:
- Packeta (Zásilkovna), Czech Republic — delivering your order
- Stripe — payment processing. Stripe contracts with customers in the EEA through Stripe Payments Europe Ltd in Ireland, and also acts as an independent controller for fraud prevention and its own legal obligations
- Railway — running the shop application and its database
- Cloudflare — content delivery, site security and storage
- Twilio SendGrid — order confirmations and other transactional e-mails
- Ecomail, Czech Republic — our newsletter, if you subscribed
- our external accountant, using ABRA Flexi — invoicing and bookkeeping
They process your data on our instructions under a data processing agreement, except where stated otherwise above.
Transfers outside the EU. Stripe, Railway, Cloudflare and Twilio SendGrid are US companies and your data may be transferred to the United States. These transfers are covered by the European Commission's standard contractual clauses and the EU–US Data Privacy Framework. We do not transfer your data outside the EU for any other purpose.
Cookies
We use cookies to run the shop and, with your consent, for other purposes. Only cookies strictly necessary for the shop to work are set without asking you.
The full, always-current list — who sets each cookie, what for and how long it lasts — is in the cookie declaration in our cookie settings, where you can change or withdraw your consent at any time.
Your rights
- Access your data (Art. 15), have it corrected (Art. 16) or erased (Art. 17), restrict how we process it (Art. 18) and take it elsewhere (Art. 20).
- Object to processing based on our legitimate interest (Art. 21). You can object to direct marketing at any time and we stop, no reasons needed.
- Withdraw any consent you gave us, at any time. That does not affect what we did lawfully before.
- Complain to a supervisory authority. Ours is the Czech Office for Personal Data Protection (uoou.gov.cz), and you can also complain to the authority in the EU country where you live or work.
Write to gdpr@gramino.com and we answer within one month.
A few more things
We do not make decisions about you by automated means that have legal effects for you. Stripe runs automated fraud checks on transactions, which can result in a payment being declined.
We protect your data with appropriate technical and organisational measures, and only people who need access have it.
We may update this policy. The current version is always on this page, with the date below.
Effective from 11 September 2026.