Privacy Policy

This document provides a clear overview of how Inniko s.r.o., Company ID: 23035218, registered office at Kotlářská 258/19, 602 00 Brno (hereinafter the “Controller”), processes the personal data of visitors to www.inniko.com and customers of our e-shop. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and related legislation.

Data Controller

The Controller of your personal data is Inniko s.r.o., Company ID: 23035218, with its registered office at Kotlářská 258/19, 602 00 Brno. Any questions or requests concerning personal data processing can be addressed to the Controller using the contact details below.

Purposes of processing personal data

We process your personal data for clearly defined purposes, specifically:

• Order fulfilment – we use data to handle and deliver your order, including communication about its status and resolving any complaints.

• Sending newsletters – if you give us consent, we use your e-mail to send news, promotions, and marketing offers in the form of a newsletter.

• Marketing – based on our legitimate interests, we may use your contact details (e.g., e-mail) to send commercial communications regarding products and services similar to those you have already purchased from us (direct marketing to existing customers).

• Website analytics – to improve our services and website, we analyse traffic and user behaviour using Google Analytics. This tool provides statistical data (e.g., number of visitors, popular pages), which we use to optimise content and functionality.

• Ad targeting – we use Facebook Pixel to display personalised ads to users on social networks (Facebook/Instagram) and to assess campaign performance. This enables us to offer relevant content and offers.

Scope of personal data processed

We process only the personal data necessary to achieve the above purposes. In particular:

• Identification data: first and last name.

• Contact details: e-mail address and phone number.

• Address: delivery and billing address (if you place an order with us).

• Marketing data: e-mail address (if you subscribe to the newsletter).

• Technical data: IP address, cookies, and other online identifiers collected when you visit our website (see the Cookies section). We use these data for analytics and ad targeting as described above.

Legal bases for processing

We process personal data only on the legal bases required by GDPR (Article 6 GDPR). In practice, this means processing occurs only if one of the following conditions is met:

• Contract performance – processing is necessary to conclude or perform a contract with you, typically when we handle your order and deliver goods (without these data, we could not perform the contract).

• Consent of the data subject – for purposes not covered by another legal basis, we will request your consent. Based on consent, we process, for example, your e-mail for newsletters or use marketing cookies. Consent is voluntary and can be withdrawn at any time.

• Legitimate interests – some data are processed based on our legitimate interests, especially for statistical purposes (website analytics) and direct marketing to our customers. When relying on legitimate interests, we always carefully assess whether processing would unduly interfere with your rights. Please note that you have the right to object to processing based on legitimate interests—in such a case, we will stop that processing (see the right to object below).

• Compliance with legal obligations – in certain cases, we must process your data to meet statutory obligations. This primarily concerns accounting and tax regulations (e.g., retaining invoices and accounting records for the statutory period) or obligations towards public authorities.

Data retention period

We retain your personal data only for as long as necessary for the given purpose. The retention period varies by purpose and legal basis:

• Order data (customer account): Retained for the duration of the contractual relationship (order fulfilment and warranty period) and subsequently for 3 years after it ends. This allows us to provide follow-up services and address potential claims (e.g., complaints) after completion of the order.

• Newsletter data: Processed until you withdraw your consent. Once you unsubscribe (withdraw consent), your e-mail address will be promptly removed from the mailing list.

• Data processed on the basis of legitimate interests: Retained while the legitimate interest persists. For statistical and marketing data, this is typically no longer than 3 years from collection, unless you object earlier.

• Data processed due to legal obligations: Where the law requires a longer retention period, we comply with those requirements. For example, accounting documents must be stored for 10 years.

After the retention period expires, we will either securely delete or anonymise personal data so that they can no longer be linked to an identifiable individual.

Recipients and processors of personal data

Access to your personal data is primarily limited to the Controller and its employees, and only to the extent necessary. We do not disclose your personal data to third parties for their own marketing purposes. In some cases, however, we use trusted external service providers who help operate our e-shop and perform contracts—these processors may be granted access to your data to the extent required for their services. These include, in particular:

• Ecomail.cz – e-mail newsletter platform provider (e-mail marketing).

• GoPay s.r.o. – secure online payment gateway provider (processing payments for orders).

• General Logistics Systems Czech Republic s.r.o. (GLS) – courier service delivering goods to your address.

• Packeta s.r.o. (Zásilkovna) – logistics intermediary enabling delivery to pick-up points and lockers.

• Web hosting provider – ensures the technical operation of our website and databases (data storage on servers).

• IT system administrator – external partner administering our e-shop system and IT support.

All of the above processors contractually guarantee the protection of your personal data and process them only under our instructions and for specified purposes. We share with each processor only the data necessary to provide their service (e.g., carriers receive your address and phone number for delivery).

In addition to the processors listed, providers of analytics and marketing tools such as Google and Facebook may access some data—see the following section on transfers to third countries. We may also disclose your data to public authorities where required by law (e.g., for tax inspections or criminal proceedings).

Transfers outside the EU

When using certain tools, data may be transferred to third countries, i.e., outside the European Union. Specifically:

• Google Analytics (Google LLC) – analytics data may be stored or processed on servers in the United States.

• Facebook Pixel (Meta Platforms) – user data for advertising purposes may be transferred to Meta’s servers in the USA.

These providers (Google, Meta) are based in countries that may not ensure the same level of data protection as the EU. In such cases, we ensure all transfers comply with GDPR requirements. We transfer data only with appropriate safeguards—in particular, the Standard Contractual Clauses approved by the European Commission, and/or other GDPR-compliant guarantees providing adequate protection for transferred data. We require our service providers to ensure data security and confidentiality even when processing in third countries.

We do not currently transfer your personal data to any other recipients outside the EU. Should such a transfer occur, you will be informed in advance, including the safeguards applied.

Your rights as a data subject

In connection with our processing of your personal data, you have several rights guaranteed by law as a data subject. You have the right in particular to:

• Access – request confirmation of whether we process your personal data and information about the purpose, categories of data, recipients, retention period, etc. Under this right, you may also obtain a copy of your personal data being processed.

• Rectification – if we hold incorrect or outdated data about you, you may request correction or completion.

• Erasure (“right to be forgotten”) – in certain cases, you may request deletion of your personal data. We will erase the data if they are no longer needed for the stated purposes or if the legal basis no longer applies.

• Restriction of processing – in some situations, you may ask us to temporarily restrict processing of your data (e.g., while we handle your objection or a rectification request).

• Data portability – you may obtain the personal data you have provided to us in a structured, commonly used, machine-readable format and transmit them to another controller. This applies to data processed by automated means based on your consent or for contract performance.

• Objection – for reasons related to your particular situation, you may object at any time to processing carried out on the basis of our legitimate interests. If you object to processing for direct marketing purposes, we will immediately stop processing your data for those purposes.

• Withdrawal of consent – where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal, but we will no longer process the data for the relevant purpose.

• Complaint – if you believe your personal data are being processed in violation of the law, you may lodge a complaint with the supervisory authority. In the Czech Republic, this is the Office for Personal Data Protection (www.uoou.cz). However, we recommend contacting us first so we can address your concerns.

You may exercise your rights by contacting the Controller or our data protection officer (see contact details below). We respond to requests without undue delay, and no later than one month, as required by GDPR (in exceptional cases, this period may be extended by two months).

Contact for questions and rights requests

If you have any questions about this policy or how we process your personal data, or if you wish to exercise any of your rights, please contact our data protection officer:

Nick Ollender (Data Protection Officer)
Tel.: +420 724 768 488
E-mail: ahoj@inniko.cz

Cookies and your consent

We use cookies and similar technologies on our website. Some cookies are necessary for the technical operation of the site and are stored automatically (e.g., language settings, cart contents). Other cookies (analytics and marketing) are used only with your consent. On your first visit you will be asked to set cookie preferences via our cookie banner—there you can grant or refuse consent for each cookie category.

• Analytics cookies: Help us understand how visitors use our site. For example, we learn which pages are most visited and can improve content and performance. These cookies are set by Google Analytics and data may be transferred to the USA (see the section on transfers outside the EU above).

• Marketing cookies: Used to personalise advertising content and offers for you. We set them via Facebook Pixel to show our ads to likely-interested users and to measure campaign effectiveness.

Giving consent to analytics and marketing cookies is voluntary. You can withdraw or adjust your consent at any time—either via our cookie banner (you can reopen cookie settings via a link on the site) or in your browser (by deleting or blocking cookies). More details about specific cookies and their use are provided in our separate Cookie Policy. If you refuse cookies, you can still use our website, but some cookie-dependent features may not function properly.

Effective date: This Privacy Policy is valid and effective from 1 January 2025. If we update it, we will publish the new version on this page.