BonVulux · How BonVulux collects and uses personal information

Privacy Policy

How BonVulux collects, uses and protects personal information.

Legally binding version. The Czech version of this document is legally binding. This English translation is provided for convenience only. View the Czech version.

1. Data controller

The controller of your personal data is BonVulux s.r.o., Company ID (IČO) 06378811, VAT ID (DIČ) CZ06378811, with its registered office at Sídliště U Nového nádraží 686, 418 01 Bílina – Teplické Předměstí, Czech Republic. Email: info@bonvulux.com.

BonVulux s.r.o. is registered in the Commercial Register kept by the Regional Court in Ústí nad Labem, file no. C 52890/KSUL.

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 110/2019 Sb., on the Processing of Personal Data. We have not appointed a Data Protection Officer because our processing does not require one under Article 37 GDPR.

2. What data we collect

  • Identity and contact data: name, surname, delivery and billing address, email address and, if provided, telephone number.
  • Order and delivery data: products ordered, order value, delivery method, tracking information and delivery address.
  • Payment data: payment method, transaction reference and payment status. Full card details are processed by the payment provider and are not stored by us.
  • Communication data: messages, emails, complaint details and attachments you send to us.
  • Account data, if you create an account: login details, order history and saved addresses.
  • Technical data: IP address, browser and device information, server logs and website usage records.
  • Cookie and consent data: cookie identifiers, consent choices and preferences.

We obtain data mainly directly from you. We may also receive transaction or delivery information from payment providers and carriers. We do not intentionally collect special categories of personal data and do not sell personal data.

3. Purposes and legal bases

  • Performance of the contract (Article 6(1)(b) GDPR): processing orders, delivery, payment, customer support, withdrawals, returns and complaints.
  • Legal obligations (Article 6(1)(c) GDPR): accounting, tax, archiving and consumer-protection duties under Czech law.
  • Legitimate interests (Article 6(1)(f) GDPR): website security, fraud prevention, IT operation, service improvement and defending legal claims.
  • Consent (Article 6(1)(a) GDPR): marketing emails and optional analytics or advertising cookies. You may withdraw consent at any time without affecting lawful processing before withdrawal.

Service messages about an order, delivery or complaint are not marketing and may be sent without marketing consent.

4. Statutory or contractual requirement

Providing personal data is voluntary. However, the data marked as required at checkout is necessary to conclude and perform the contract; without it we cannot process your order. We also need certain data to comply with accounting, tax and consumer-protection obligations. You are not subject to a decision based solely on automated processing that would produce legal effects or similarly significantly affect you.

5. How long we keep data

  • Orders and accounting records: for 5 years after the end of the accounting period to which they relate, in accordance with Act No. 563/1991 Sb., on Accounting.
  • Tax records: for at least 3 years after the end of the tax period, or longer where required by Act No. 280/2009 Sb., the Tax Code.
  • Complaints and claims: for the duration of the complaint and the limitation period, generally 3 years under Act No. 89/2012 Sb., the Civil Code.
  • Marketing consent: until you withdraw consent, and in any event no longer than 3 years after your last interaction, unless a longer period is required by law.
  • Account data: until you delete your account, plus a short period for backup and legal obligations.
  • Server logs: generally up to 12 months.
  • Cookies: for the period stated in the cookie settings, generally no longer than 24 months for analytics and marketing cookies.

6. Who receives data

We share personal data only where necessary and with appropriate safeguards. Recipients may include:

  • hosting, IT and email service providers;
  • payment service providers and banks;
  • carriers and delivery partners;
  • accounting, tax and legal advisers;
  • marketing and analytics providers, where you have consented;
  • public authorities, where required by law.

Processors act on our instructions under Article 28 GDPR. We do not sell personal data.

7. Transfers outside the EU/EEA

We process data primarily within the EU/EEA. Where a transfer outside the EU/EEA is necessary, we rely on an adequacy decision or appropriate safeguards, in particular the Standard Contractual Clauses under Article 46 GDPR. You may request further information about the safeguards by emailing us.

8. Your rights

Subject to the conditions in the GDPR, you have the right to:

  • access your personal data and obtain a copy;
  • have inaccurate data rectified;
  • have data erased;
  • restrict processing;
  • receive data in a portable format;
  • object to processing based on legitimate interests;
  • object at any time to direct marketing;
  • withdraw consent at any time.

Send requests to info@bonvulux.com. We will respond within one month and may extend this by two further months for complex requests. You also have the right to lodge a complaint with the Czech supervisory authority.

9. Automated decision-making

We do not make solely automated decisions, including profiling, that produce legal effects or similarly significantly affect you. We may use analytics to understand website use, but this does not result in automated decisions about you.

10. Cookies and similar technologies

We use strictly necessary cookies to operate the website, remember your cart and store consent choices. These do not require consent. Analytics and marketing cookies are used only with your consent, in accordance with Act No. 480/2004 Sb., on Certain Services of the Information Society.

You can change or withdraw consent at any time in the cookie settings in the cookie banner or website footer. Blocking strictly necessary cookies may affect the function of the shop.

  • Strictly necessary: session, cart, security and consent storage.
  • Analytics: aggregated visit and behaviour statistics.
  • Marketing: measuring campaigns and showing relevant content.

11. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or misuse. These include access controls, secure connections, backups and staff confidentiality. No system is completely secure, but we review our measures regularly.

12. Children

Our services are not directed at children. We do not knowingly collect personal data from children without parental or guardian consent. If you believe a child has provided data to us, please contact us and we will delete it.

13. Complaints

The supervisory authority is the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic. Email: posta@uoou.cz. Telephone: +420 234 665 111. Website: uoou.gov.cz.

Please contact us first at info@bonvulux.com if you would like us to resolve the matter directly.

14. Changes to this policy

We may update this policy to reflect changes in our services or the law. The current version is always published on this page with its effective date. Where changes are material, we will provide reasonable notice.

Version 6.0, effective 29 October 2026.

15. Contact

BonVulux s.r.o., Sídliště U Nového nádraží 686, 418 01 Bílina – Teplické Předměstí, Czech Republic. Email: info@bonvulux.com. Company ID: 06378811. VAT ID: CZ06378811.

See also our Terms & Conditions and Contact page.