Privacy Policy

1. WHO IS THE CONTROLLER OF YOUR DATA?

The controller of personal data within the meaning of Art. 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) is:

H2O nanotec s.r.o.
Company ID (IČO): 04281128, VAT ID: CZ04281128
registered office: Liberecká 1471/20, 405 02 Děčín, Czech Republic
entered in the Commercial Register kept by the Regional Court in Ústí nad Labem, file no. C 46800

Premises for personal collection and complaints: Liberecká 1471/20, 405 02 Děčín, Czech Republic

Contact (including data protection matters): info@h2onanotec.cz, phone: +420 602 320 980

2. WHAT DATA DO WE PROCESS AND WHY?

We process your personal data only for the purposes below and on the corresponding legal bases:

1. Processing orders and performing the purchase contract
   • Data: first name, surname, delivery and billing address, e-mail, phone number, purchased goods, payment details.
   • Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
2. Managing your customer account
   • Data: login e-mail, encrypted password, contact and delivery details, order history.
   • Legal basis: performance of the account contract (Art. 6(1)(b) GDPR).
3. Complaints, withdrawal from the contract and filter cartridge take-back
   • Data: identification and contact details, order number, description of the defect, photos, bank account number for refunds, details of the discount coupon issued. Requests are handled through our Customer Portal.
   • Legal basis: performance of a contract and compliance with a legal obligation (Art. 6(1)(b) and (c) GDPR).
4. Accounting and tax obligations
   • Data: billing details, transaction history.
   • Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
5. Answering your enquiries
   • Data: name, e-mail, phone and the content of your message sent via the contact form, by e-mail or by phone.
   • Legal basis: our legitimate interest in communicating with customers, or steps taken prior to entering into a contract (Art. 6(1)(b) and (f) GDPR).
6. Verifying customer reviews
   • Data: e-mail address, order number, review text.
   • Legal basis: compliance with a legal obligation under consumer protection law (verifying that a review comes from a real customer) and legitimate interest (Art. 6(1)(c) and (f) GDPR).
7. Sending news and marketing communications (newsletter)
   • Data: e-mail address and, where applicable, name.
   • Legal basis: your consent (Art. 6(1)(a) GDPR); for existing customers, our legitimate interest in sending communications about similar goods. You can unsubscribe at any time using the link in every e-mail.
8. Cookies
   • Data: device data and on-site behaviour.
   • Legal basis: strictly necessary cookies based on our legitimate interest in running the website; analytics and marketing cookies only with your consent given in the cookie banner (Art. 6(1)(a) and (f) GDPR). You can change your consent at any time in the cookie settings.

3. WHO HAS ACCESS TO THE DATA (RECIPIENTS)?

We share your data only to the extent necessary with trusted processors and recipients:

• carriers (PPL, TOPTRANS, Zásilkovna/Packeta) – for delivering your parcel,
• payment gateway providers and banks – for processing payments,
• the e-shop platform provider Shoptet and other providers of IT infrastructure and server services,
• the Customer Portal provider Retino – for handling complaints, returns and cartridge take-back,
• the e-mailing provider Ecomail – for sending the newsletter,
• external accountants and tax advisers.

Where a processor handles data outside the European Economic Area, this takes place only on the basis of a European Commission adequacy decision or standard contractual clauses.

4. HOW LONG DO WE KEEP THE DATA?

1. Order data for the duration of the purchase contract and any claims for defects, and thereafter for the limitation period.
2. Accounting and tax documents for 10 years from the end of the tax period in which the transaction took place.
3. Customer account data for as long as the account exists, i.e. until you close it.
4. Newsletter data until you withdraw your consent or unsubscribe.
5. Enquiries for as long as necessary to deal with them.

5. YOUR RIGHTS UNDER THE GDPR

As a data subject, you have the following rights:

1. Right of access to your personal data.
2. Right to rectification of inaccurate or incomplete data.
3. Right to erasure (“right to be forgotten”) where the data are no longer needed for the stated purposes.
4. Right to restriction of processing.
5. Right to data portability.
6. Right to object to processing based on legitimate interest, including direct marketing.
7. Right to withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal.
8. Right to lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.gov.cz) or with the supervisory authority in your country of residence.

You can exercise your rights by e-mail at info@h2onanotec.cz or in writing at our registered office. We will respond without undue delay and at the latest within one month.

6. SECURITY OF PERSONAL DATA

The controller declares that it has taken all appropriate technical and organisational measures to protect personal data (encryption of data transfers, password protection and two-factor authentication, access restricted to authorised persons only). No automated decision-making or profiling with legal effects takes place.

7. FINAL PROVISIONS AND EFFECTIVE DATE

1. By placing an order or registering a customer account, you confirm that you have read this Privacy Policy.
2. The controller may amend this Privacy Policy where necessary or when legislation changes. The new version will be published on our website.
3. All legal relationships arising from the processing of personal data are governed by the laws of the Czech Republic. This is a translation; in case of discrepancy, the Czech version prevails.

Go to TERMS AND CONDITIONS

This Privacy Policy comes into force and effect on1 September 2026.