1. Who is the Controller of Personal Data?
The controller of personal data is Azu design s.r.o., Company ID (IČO) 26898764, with its registered office at Bayerova 806/40, 602 00 Brno – Veveří, registered in the Commercial Register maintained by the Regional Court in Brno, Section C, File 43084. This entity operates the VOXELL website and e-shop.

For matters concerning personal data protection or the exercise of your rights, you may contact us at obchod@voxell.cz or via our mailing address: VOXELL, Hněvkovského 30/65 (VÚSH a.s. complex), 617 00 Brno; telephone: +420 702 193 828.

This policy explains how we process data belonging to e-shop visitors, customers, user account holders, corporate contact persons, and newsletter subscribers. We operate in compliance with the General Data Protection Regulation (GDPR), Act No. 110/2019 Coll. on the Processing of Personal Data, and other applicable regulations.

​

2. What Data We Collect and Where We Obtain It

We process data that you provide to us when making a purchase, registering, signing up for our newsletter, or communicating with us. This includes, in particular, your first and last name, billing and registration addresses, email address, and telephone number. For business customers, this may also include your Company ID (IČO), VAT ID (DIČ), and business contact details.

In the context of managing customer accounts, we also process registration and login credentials, saved addresses, and order history. In the course of communication, product returns, and the handling of complaints, we process the content of messages and related documentation to the extent necessary for resolution.

We receive information from PayU required to reconcile payments—such as transaction identifiers, payment status, or refund details. From the carrier, we obtain data regarding the delivery process and its outcome. You do not enter full payment card details into our order forms; instead, these are entered via a secure payment interface.

During your visit, technical data may be generated—including your IP address, the time of the request, details regarding the web address, your device, the session, and any errors. This data is processed to the extent necessary for the operation and security of the e-shop. For newsletter subscriptions, we store your email address along with the data required to verify your sign-up, consent, and any subsequent opt-out.

If another person acts on behalf of the customer, or if a different recipient is designated for a shipment, the necessary contact and delivery details for that individual are provided by the customer. The customer is responsible for informing these individuals that their data has been shared and for making them aware of this policy; this does not, however, affect our own obligations to provide information.

3. Why We Process Data and the Legal Basis

Orders and Order Fulfillment: We use data to accept and fulfill orders, process payments, manage deliveries, communicate regarding purchases, handle refunds, and perform related tasks. The legal basis for this is the performance of a contract (or taking steps prior to entering into a contract at your request) pursuant to Article 6(1)(b) of the GDPR. In cases involving statutory obligations—such as the handling of complaints—processing is also based on compliance with legal obligations, pursuant to Article 6(1)(c) of the GDPR. Customer Account: We process registration data for the purpose of creating, maintaining, and securing the account and providing access to its features, based on the performance of the account provision agreement pursuant to Article 6(1)(b) of the GDPR. Registration does not constitute consent to receive the newsletter.

Accounting and Taxes: We process data contained in relevant documents to fulfill statutory accounting and tax obligations pursuant to Article 6(1)(c) of the GDPR. Accounting tasks are handled by our in-house accountant using an internal accounting system.

Inquiries and Communication: We handle inquiries regarding a potential purchase based on steps taken prior to entering into a contract. Other routine communication is processed based on our legitimate interest in properly addressing inquiries, pursuant to Article 6(1)(f) of the GDPR.

Protection of Rights and Security: We retain necessary documentation to demonstrate compliance, resolve disputes, protect legal claims, prevent fraud, and ensure website security, based on our legitimate interests pursuant to Article 6(1)(f) of the GDPR. On this same basis, we also process the professional contact details of individuals acting on behalf of a corporate customer (where those individuals are not themselves a party to the contract).

Newsletter: We send news and offers only to individuals who have signed up and provided their consent, in accordance with Article 6(1)(a) of the GDPR and the rules governing commercial communications. Making a purchase does not automatically result in a subscription. Consent is voluntary and is not a condition for making a purchase. You may withdraw your consent at any time by sending an email to obchod@voxell.cz or by using the unsubscribe method provided in every newsletter. Withdrawing your consent does not affect the lawfulness of any processing that took place prior to the withdrawal.

4. Mandatory and Optional Data

Data marked as mandatory is required for the conclusion and performance of a contract or for compliance with legal obligations. Without this necessary data, we cannot complete or deliver your order. Registration details are required to create an account. Providing optional data or signing up for the newsletter is entirely voluntary.

We do not request data that is not necessary for the intended purpose. Please refrain from including sensitive information—such as details regarding your health status—in notes or messages, unless it is strictly necessary for a specific request.

​

5. Who may have access to the data

¨Our authorized personnel, including our in-house accountant, have access to the data to the extent necessary. Furthermore, we grant access to the data to service providers necessary for the operation of the e-shop and the fulfillment of orders:

• Wix, its group companies, and its contractual sub-processors: website operation and hosting, order management, customer accounts, and technical security. With respect to our customers' data processed on our behalf, Wix acts as a "processor" in accordance with its Data Processing Addendum.

• PayU and other providers involved in payment transactions: online payments and refunds. For the purposes of their own legal obligations, security, and regulated payment services, these entities may act as independent "controllers" in accordance with their own respective policies.

• Carriers (TOPTRANS and Geis) and their delivery partners: recipient name, address, contact details, and shipment information, to the extent necessary for transport. The specific carrier is determined by the shipping method selected.

• IT and email service providers: essential technical administration and communication. We maintain our own corporate email account and use Microsoft Outlook for email management and newsletter distribution. The operator of the email infrastructure may have access to the content of communications to the extent necessary to provide and secure the service; however, the use of Outlook does not in itself imply that the mailbox is hosted by Microsoft.

To the extent necessary, we may also share data with legal advisors for the purpose of protecting our rights, as well as with public authorities, where required by law. Processors acting on our behalf are bound by an appropriate contract and instructions. We do not sell personal data.

6. Transfers outside the European Economic Area

The use of the Wix platform may involve data processing outside the European Economic Area (EEA). According to Wix, processing may take place in locations such as Israel and the USA, as well as in other countries—via Wix’s service providers—as detailed in their current list of sub-processors. The specific location and scope depend on the service in question. Processing may also occur abroad when using cloud-based email services or when delivering data to countries outside the EEA.

Data transfers are conducted solely in compliance with Chapter V of the GDPR—specifically, based on an adequacy decision by the European Commission or through standard contractual clauses (SCCs) supplemented by necessary additional safeguards. Regarding recipients in the USA, the EU–US Data Privacy Framework may apply, provided the specific recipient holds a valid certification for the relevant processing activities. In the case of data transfers outside the EEA, we also consider the legal basis for transfers necessary for the performance of a contract; however, this is not used as a general substitute for the safeguards required for routine cloud-based processing.

For information regarding specific recipients, countries, and the safeguards applied—or to obtain a copy of the relevant safeguards—please contact us at obchod@voxell.cz. Wix’s documentation is available at https://support.wix.com/en/article/wixs-data-processing-agreement-for-wix-users, and their list of sub-processors can be found at https://support.wix.com/en/article/list-of-wixs-sub-processors. Microsoft’s information is available at https://privacy.microsoft.com/cs-cz/privacystatement; its applicability depends on the specific service being used.

​

7. How long we retain data

We retain data only for as long as is necessary for the specific purpose. A single piece of data may serve multiple purposes; therefore, deleting an account or unsubscribing from a newsletter does not result in the deletion of documents that we are legally required to retain.

Orders and related communication: for the duration of the contract and the handling of any potential claims. Subsequently, the necessary documentation is generally retained for three years following the end of the contractual relationship to protect legal claims. If a dispute is ongoing, or if a statutory limitation period is extended or suspended, we will retain the necessary data until the reason for its retention no longer exists.

Accounting and tax documents: for the period prescribed by law. VAT-related tax documents are generally retained for ten years from the end of the tax period in which the transaction took place; accounting documents not subject to a longer statutory retention period are generally retained for five years from the end of the relevant accounting period. We will only retain data for a longer period if required by law or by an ongoing legal proceeding.

Customer account: for as long as the account exists. We will delete the account upon request; however, data required for accounting purposes or legal claims will be retained separately for those specific purposes, rather than for the operation of the deleted account.

Inquiries without a subsequent order: generally for a maximum of one year from the end of the communication, unless retention is necessary for a specific legal claim.

Newsletter: we use the email address until consent is withdrawn or the distribution of the newsletter is discontinued. We generally retain the necessary documentation regarding consent—and any withdrawal thereof—for three years following the termination of a subscription, in order to verify the legitimacy of our communications. We may retain a minimal record of an unsubscribe request for as long as the communication service remains active, to ensure that the unsubscribed address is not re-added; this data is not used for any other promotional offers.

Technical and security logs, as well as cookies, are retained for a duration corresponding to their specific function, platform settings, and the need to address security incidents. Session cookies expire at the end of the session, while persistent cookies expire after a set period or upon deletion. Specific retention periods for the cookies used are detailed in the cookie overview available on our website. Once the original purpose for processing has been fulfilled, we either delete or anonymize the data. Backup copies are rotated as part of our standard backup cycle and are not used for any new, unrelated purposes.

​

8. Cookies and Similar Technologies

Essential cookies and similar technologies may be used to ensure the proper functioning of the e-shop—specifically for user login, the shopping cart, security, and the preservation of necessary settings. Consent is not required for their use, provided they are strictly necessary for the service you have requested. Any associated processing of personal data is based on a specific legal ground, such as the performance of a contract or our legitimate interest in maintaining security.

The Wix platform enables the measurement of website traffic and e-shop usage. If analytical tracking—utilizing cookies or similar technologies—is enabled on our website, it will only be activated following your prior consent, provided via the cookie settings. The processing of personal data for these analytics is based on Article 6(1)(a) of the GDPR. An overview of the tools currently in use and their specific purposes can be found in the cookie settings. We do not currently use standalone advertising tools, such as Google Ads or the Meta Pixel. Any future implementation would require us to update the provided information and obtain the necessary consent. Neither simply visiting the website nor agreeing to the Terms and Conditions constitutes consent for analytics.

You may decline non-essential cookies just as easily as you may accept them. You can change or withdraw your consent at any time via the cookie settings available on the website; such a withdrawal does not affect the lawfulness of any processing that took place prior to the withdrawal. Without your consent, non-essential analytical cookies—or similar tracking mechanisms—will not be activated.

Details regarding the names, providers, purposes, and duration of the cookies used are available in the cookie overview on the website. You may also delete or block cookies directly through your web browser; however, please note that blocking essential cookies may limit the functionality of your account or the ordering process.

​

9. Your Rights

Under the GDPR, you have the right to obtain confirmation as to whether your data is being processed and to access such data, including receiving a copy; to request the correction of inaccurate data, the erasure of data, or the restriction of processing; and to receive data processed by automated means—based on your consent or a contract—in a structured, commonly used, and machine-readable format. You may also request the transfer of such data to another controller, provided it is technically feasible.

You may object to processing based on a legitimate interest on grounds relating to your particular situation. You may object to direct marketing at any time; in such cases, we will cease processing your data for this purpose. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

These rights are not absolute. For example, documents that we are legally required to retain cannot be deleted immediately. If we are unable to fulfill your request, we will inform you of the reason and your options for further action.

Please send your request to obchod@voxell.cz or to our mailing address. We will respond without undue delay, and no later than one month. In complex cases or where a large number of requests are received, this period may be extended by an additional two months; we will notify you of any such extension and the reasons for it within the first month. If we have reasonable doubts regarding your identity, we may request appropriate additional verification. As a general rule, we process requests free of charge, subject to exceptions stipulated by the GDPR for requests that are manifestly unfounded or excessive. You have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, https://uoou.gov.cz, or with the relevant supervisory authority in another Member State. This does not affect your right to judicial remedy.

10. Automation, Security, and Changes

Automated order confirmation and payment processing are carried out to fulfill your purchase request. We do not engage in profiling or exclusively automated decision-making that produces legal effects or similarly significant effects on individuals, within the meaning of Article 22 of the GDPR. Separate processing by a payment provider is governed by that provider’s own policies.

We ensure data protection through appropriate technical and organizational measures, taking into account the nature of the data and the associated risks. Access is restricted to individuals who require it for the performance of their duties. We do not request that passwords or full payment card details be sent via standard email.

We update these policies whenever there are changes to our services, processing methods, or legal requirements. A new version does not, in itself, extend the scope of any consent originally granted. The current version and its effective date are published on our website.

​

 

Prepared on behalf of Azu design s.r.o. by:

​

 

Marek Sušil