This page explains which personal data we process when running the greenbase.cz shop, why, for how long, and what rights you have. We follow Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on the Processing of Personal Data. Effective from 1 October 2026. If the Czech and English versions differ, the Czech version prevails.

1. Data controller

The controller is Greenbase, s.r.o., registered office Bezručova 337, 252 63 Roztoky, Czech Republic, company ID 069 71 695, registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 291318. For anything related to personal data, write to info@greenbase.cz or call +420 724 218 529. We have not appointed a data protection officer because the law does not require us to.

2. What data we process, why and on what legal basis

Orders

First and last name, e-mail, phone, delivery address, for company purchases the company name, company ID and VAT ID, the contents of the order, the chosen shipping and payment, your order note, payment status and tracking number. We need these to conclude and perform the purchase contract: to prepare and deliver the order and keep you informed about its status. The legal basis is performance of a contract (Article 6(1)(b) GDPR). Without this data we cannot process your order.

Accounting and tax

We keep order data and documents because accounting and tax law requires us to. The legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR).

Complaints, withdrawals and legal claims

We use order data and our communication with you to handle complaints and withdrawals from the contract (legal obligation) and to protect our legal claims in the event of a dispute. This is our legitimate interest (Article 6(1)(f) GDPR).

If you withdraw from the contract using the form on the website, we process the name, order number, e-mail address for the acknowledgement and any note you enter in it, together with the date and time of submission. We need them to receive your withdrawal, acknowledge it and refund your payment. The legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR). We send the acknowledgement of receipt to the e-mail address from the form and, if it is different, also to the e-mail address given in the order, so that the person who placed the order learns about the withdrawal too.

Contact form and e-mail communication

Name, e-mail, optionally phone and the text of your message. We process these in order to reply. The legal basis is our legitimate interest in handling your enquiry, or steps taken at your request before entering into a contract (Article 6(1)(f) and (b) GDPR).

Operation and security of the website

When you use the cart and checkout, we store session data on the server: the contents of the cart, your IP address and browser identification. This is needed for shopping to work and to protect against abuse. The legal basis is our legitimate interest in running the shop securely (Article 6(1)(f) GDPR).

When an error occurs on the website, for example an e-mail cannot be sent, the server writes a technical description of it to the application log. It may contain an e-mail address or an order number. The log is used only to fix errors and to protect against abuse, on the same legal basis. We delete the application log after 30 days.

Traffic statistics

To know which pages people read and where they come from, we count page views on our own server. We store daily totals only: how many times each page was viewed, in which language, and from which domain visits arrived (for example a search engine). These totals contain no IP address, no browser identification and no other identifier, we use no cookies for this and we do not distinguish or track individual visitors. The totals are therefore not personal data. If your browser sends the Global Privacy Control or Do Not Track signal, we do not count your visit at all.

The shop does not require registration and does not create customer accounts. We do not send marketing messages, we do not use your data for profiling or automated decision-making, and we do not obtain data from any source other than you.

3. How long we keep the data

Orders and documents: 10 years from the end of the year in which the order was placed, as required by accounting and tax rules.
Withdrawals submitted with the form on the website: together with the order they concern, for the same period.
Complaints and related communication: while the complaint is being handled and for a further 3 years in case legal claims are made.
Contact form messages: while your enquiry and any follow-up communication are being handled. We regularly delete messages we no longer need.
Application log: 30 days.
Session data (cart, IP address, browser): no longer than 3 days after your last visit.

4. Who we share the data with

We share data only to the extent necessary:

the carrier that delivers your parcel: name, address, phone, e-mail and, for cash on delivery, the amount due,
our web hosting and e-mail provider WEDOS Internet, a.s., whose servers in the Czech Republic run the shop; it acts as our processor,
the bank when receiving your payment and when making refunds,
public authorities where the law requires it.

We do not sell data and we do not transfer it outside the European Union.

5. Cookies

The website uses only strictly necessary cookies, without which the cart and checkout would not work. Under Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications, these do not require consent, which is why there is no cookie banner.

greenbase-session: keeps your session, that is the contents of your cart and the order in progress. Valid for 3 days after your last visit.
XSRF-TOKEN: protects forms against cross-site request forgery. Valid for 3 days after your last visit.

We do not use analytics, advertising or other tracking cookies and we do not embed third-party tracking code, fonts or other third-party content. We count traffic only as totals on our own server and without cookies, as described in section 2. You can delete or block cookies in your browser settings, but you will not be able to shop without them.

6. How we protect the data

The website runs over an encrypted connection (HTTPS). Only authorised persons can access orders, through a secured administration. The status of an order is available only through an unguessable link sent to you by e-mail, so please do not forward that link to anyone.

7. Your rights

You have the right:

of access to your data and to a copy of it,
to rectification of inaccurate data,
to erasure where we no longer need the data and the law does not require us to keep it,
to restriction of processing,
to portability of data we process on the basis of a contract,
to object to processing based on legitimate interest,
to lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.

To exercise your rights, write to info@greenbase.cz. We will reply without undue delay and within one month at the latest. Exercising your rights is free of charge. To avoid disclosing data to the wrong person, we may ask you to verify your identity.

8. Changes

If the way we process data changes, we will update this text and state the new effective date.