Privacy Policy

Effective date: [Insert date]
Website: bullshitgifts.eu
Brand: ShitGift
Contact email: support@shitgift.eu

This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website, place an order, contact us, or otherwise use our services.

We process personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), and applicable Czech data protection laws, including Act No. 110/2019 Coll., on Personal Data Processing.

1. Data Controller

The data controller responsible for the processing of your personal data is:

[Legal company name]
[Company registration number / IČO]
[Registered address]
Czech Republic
Email: support@shitgift.eu

Please replace the information above with the correct legal entity details before publishing this Privacy Policy.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

2.1. Customer data

When you place an order, we may collect:

• full name;
• email address;
• billing address;
• shipping address;
• phone number, if required for delivery;
• order details;
• payment status;
• communication with customer support.

2.2. Recipient data

Because our service allows customers to send a gift to another person, we may process personal data of the recipient, including:

• recipient's name;
• delivery address;
• phone number, if required by the delivery provider;
• custom message or note provided by the customer.

The customer is responsible for ensuring that the recipient data they provide is accurate and lawful.

2.3. Payment data

Payments are processed by external payment providers. We do not store full card numbers or full payment credentials on our servers. We may receive limited payment-related information, such as payment status, transaction ID, payment method type and fraud-prevention signals.

2.4. Website and technical data

When you use our website, we may process technical data such as:

• IP address;
• browser type and version;
• device type;
• operating system;
• pages visited;
• date and time of access;
• cookies and similar technologies;
• log files required for website security and functionality.

2.5. Customer support data

If you contact us, we may process:

• your email address;
• your name, if provided;
• the content of your message;
• attachments or screenshots you send to us;
• our replies and communication history.

3. Purposes and Legal Bases for Processing

We process personal data for the following purposes:

Purpose	Personal data	Legal basis under GDPR
Processing and delivering orders	Customer data, recipient data, order data	Performance of a contract, Art. 6(1)(b) GDPR
Payment processing	Payment status, transaction data	Performance of a contract, Art. 6(1)(b) GDPR
Customer support	Contact details, communication history	Performance of a contract or legitimate interest, Art. 6(1)(b) and Art. 6(1)(f) GDPR
Delivery and logistics	Name, address, phone number if needed	Performance of a contract, Art. 6(1)(b) GDPR
Fraud prevention and abuse prevention	Order data, technical data, payment signals	Legitimate interest, Art. 6(1)(f) GDPR
Website security	IP address, logs, technical data	Legitimate interest, Art. 6(1)(f) GDPR
Compliance with tax and accounting duties	Invoices, order records, payment records	Legal obligation, Art. 6(1)(c) GDPR
Marketing emails, if used	Email address, consent record	Consent, Art. 6(1)(a) GDPR
Analytics and marketing cookies, if used	Cookie identifiers, usage data	Consent, Art. 6(1)(a) GDPR

4. Anonymous Gift Service

Our service is designed to allow customers to send a gift without revealing their identity to the recipient.

We may keep the customer's identity confidential from the recipient, except where disclosure is required by law, court order, competent authority, payment dispute, fraud investigation, abuse prevention, or protection of our legal rights.

Customers must not use our service for harassment, threats, unlawful conduct, discrimination, stalking, defamation or any other abusive purpose. We reserve the right to cancel orders that appear unlawful, abusive or harmful.

5. Cookies

Our website may use cookies and similar technologies.

5.1. Strictly necessary cookies

These cookies are required for the website to function properly, for example:

• cart functionality;
• checkout process;
• security;
• session management;
• fraud prevention.

These cookies do not require consent because they are necessary for the operation of the website.

5.2. Analytics and marketing cookies

If we use analytics, advertising, retargeting, social media pixels or similar technologies, we will request your consent before placing such cookies on your device, where required by law.

You can manage or withdraw your cookie consent through the cookie banner or cookie settings available on the website.

6. Recipients of Personal Data

We may share personal data with the following categories of recipients:

• payment processors;
• delivery and logistics providers;
• hosting providers;
• website and IT service providers;
• email service providers;
• accounting and tax advisors;
• legal advisors;
• fraud prevention and security service providers;
• public authorities, courts or regulators where required by law.

All processors acting on our behalf are required to process personal data only according to our instructions and to protect the data appropriately.

7. International Data Transfers

Some of our service providers may process personal data outside the European Economic Area.

Where personal data is transferred outside the EEA, we will ensure that appropriate safeguards are in place, such as:

• an adequacy decision by the European Commission;
• Standard Contractual Clauses approved by the European Commission;
• other lawful transfer mechanisms under GDPR.

8. Data Retention

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy.

Typical retention periods are:

Data category	Retention period
Order data	For the duration of the contract and then as required for tax, accounting and legal purposes
Accounting and invoice data	Usually up to 10 years, where required by applicable Czech accounting and tax laws
Customer support communication	Up to 3 years after the last communication, unless longer retention is necessary
Website logs	Usually up to 12 months, unless longer retention is needed for security or legal reasons
Marketing consent records	Until consent is withdrawn or no longer needed
Cookie consent records	For the duration required to prove valid consent

We may retain data for a longer period where necessary to establish, exercise or defend legal claims.

9. Your Rights Under GDPR

You have the following rights under GDPR:

• right of access to your personal data;
• right to rectification of inaccurate data;
• right to erasure of personal data;
• right to restriction of processing;
• right to data portability;
• right to object to processing based on legitimate interest;
• right to withdraw consent at any time, where processing is based on consent;
• right to lodge a complaint with a supervisory authority.

To exercise your rights, contact us at: support@shitgift.eu

We may need to verify your identity before responding to your request.

10. Right to Lodge a Complaint

If you believe that we process your personal data unlawfully, you may contact the Czech supervisory authority:

Úřad pro ochranu osobních údajů
Pplk. Sochora 27
170 00 Praha 7
Czech Republic

You may also contact the supervisory authority in your EU country of residence.

11. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include:

• secure hosting;
• access controls;
• encryption where appropriate;
• secure payment processing through external payment providers;
• regular monitoring of website security;
• limited access to personal data by authorised persons only.

However, no online service can guarantee absolute security.

12. Children's Data

Our website and services are not intended for children. We do not knowingly collect personal data from children.

If you believe that a child has provided us with personal data, please contact us and we will take appropriate steps to delete such data.

13. Automated Decision-Making

We do not use personal data for automated decision-making that produces legal or similarly significant effects.

We may use automated tools for fraud detection, payment security, spam prevention or website protection, but such tools are used only to protect our service and customers.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

The latest version will always be available on our website. If we make significant changes, we may notify users by email or by displaying a notice on the website.

15. Contact

For any questions about this Privacy Policy or personal data processing, please contact us:

Email: support@shitgift.eu