Privacy policy (GDPR)

This is an English translation for your convenience. The Czech version is legally binding. If the versions differ, the Czech version prevails.

 

PERSONAL DATA PROCESSING POLICY

DMP Group s.r.o.

 

Who are we? We are DMP Group s.r.o., with its registered office at Radiová 1122/1, Hostivař, 102 00 Praha 10, Company ID (IČO): 097 72 618, registered in the Commercial Register maintained by the Municipal Court in Prague under file number C 342302 (“we”), and we operate the website of the Dej mi pokojovku online store, available at www.dmp.cz (the “Website”). Through the Website, you can buy from us a wide variety of plants (mainly houseplants), merchandise or our workshops, and more.

Personal data processing policy. Protecting your privacy is very important to us, so we guard your personal data carefully. We have prepared this personal data processing policy for you (the “Policy”), in which you will find all the information about what personal data of yours we process, why and how we work with it, and how long we will keep it. Please read the Policy carefully. The Policy complies with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (GDPR). It applies both to our customers and to all other users of the Website.

Do you have any questions? Write to us at any time at info@dmp.cz or call us at +420 776 060 464.

Do we really need your personal data? We are minimalists, so we always try to process your personal data to the smallest possible extent. Sometimes, however, processing it is unavoidable: for example, when you want to order our goods or services, we need your data simply so that we can deliver them to you. We will not process your personal data using automated individual processing that would have legal effects on you as a data subject or would similarly significantly affect you. So there is nothing to worry about.

How do we process your personal data?

That depends mainly on what relationship we have with each other, meaning the legal relationship. So it depends on whether you have entered into a contract with us as our customer (or intend to) or whether you are only browsing our Website without any relationship between us.

A) If you have entered into a contract with us, we process the following personal data of yours:

  • Identification data. We use it to identify you, for example when we enter into a contract with you. This mainly includes your first name, last name, address or Company ID (IČO).
  • Contact data. We use it to contact you if necessary. This includes your phone number and email address.
  • Billing and bank data. We process it in connection with identifying and making payments. This includes, for example, information appearing on invoices, bank details and information about payments received or sent.
  • Information contained in the contract. These are details of the goods and services we provide to you, as well as other information related to the contract, warranty claims, withdrawal from the contract, etc.
  • Information from our communication. In this case, this mainly means information in emails or the content of our communication.
  • Contact person data. If our customer is a company, we process the name, work email and phone number of the persons who act on its behalf or are named in the contract as contact persons. A contract cannot be performed without a contact for a specific person. The legal basis is the performance of the contract and our legitimate interest in its proper performance; consent is neither required nor given for this processing.

    • We then process this data for the following purposes and periods:

     

    What is the legal basis for processing under the GDPR?

    Why do we process your data?

    How long will we process it?

    What specific data do we process for this purpose?

    CONTRACT


    performance of obligations under the contract or as part of pre-contractual negotiations

    Article 6(1)(b) GDPR

     

     

    So that we can enter into a contract with you and perform our obligations under it

     

    For the duration of the contract or until all rights and obligations under the contract have ceased to exist

     

    Identification data

    Contact data

    Billing and bank data

    Information contained in the contract

    Information from our communication

     

     

    LAWS

    compliance with legal obligations imposed on us by law

    Article 6(1)(c) GDPR

    So that we comply with all legal obligations that apply to us

    For the period set by the specific legal regulation under which we fulfill our obligations

    For example, we keep personal data related to tax matters for 10 years from the end of the relevant tax period

     

    Identification data

    Contact data

    Billing and bank data

    Information contained in the contract

     

      

    LEGITIMATE INTEREST

    it is in our legitimate interest

    Article 6(1)(f) GDPR

    So that we can protect and enforce our claims

    For up to 15 years. This corresponds to the longest possible limitation period set by law



    Identification data

    Contact data

    Billing and bank data

    Information contained in the contract

    Information from our communication

     So that we can improve our services and survey your satisfaction with our services

    For 1 year after the contract ends 

     

    Contact data Information contained in the contract Information from our communication

     

    So that we can send you newsletters

    For 3 years from the conclusion of the last contract between us, or until you object to this processing, e.g., by unsubscribing from our newsletters

    Contact data

     

    B) If you are a participant in our events (mainly workshops), we process the following personal data of yours:
      • Identification data. We use it to identify you when you enter the event. This mainly includes your first name and last name
      • Contact data. We use it to contact you with updates about the event. This includes your phone number and email address.
      • Information about the event. These are details of the event you attend, such as its date or venue.
      • Information from our communication. In this case, this mainly means information in emails or the content of our communication.

      We then process this data for the following purposes and periods:

      What is the legal basis for processing under the GDPR?

      Why do we process your data?

      How long will we process it?

      What specific data do we process for this purpose?

      CONTRACT

      performance of obligations under the contract or as part of pre-contractual negotiations

      Article 6(1)(b) GDPR

      So that we can enable you to take part in the workshop

      For the duration of the contract or until all rights and obligations under the contract have ceased to exist

      Identification data

      Contact data

      Information about the event

      Information from our communication

      LEGITIMATE INTEREST

      it is in our legitimate interest

      Article 6(1)(f) GDPR

      So that we can protect and enforce our claims

      For up to 15 years from the event, which corresponds to the longest possible limitation period set by law

      Identification data

      Contact data

      Information about the event

      Information from our communication

       

      So that we can send you newsletters

      For 3 years from the conclusion of the last contract between us or from the last workshop, or until you object to this processing, e.g., by unsubscribing from our newsletters

      Contact data

       

      CONSENT

      we process the data based on your consent

      Article 6(1)(a) GDPR

      So that we can process your data whose processing does not fall under any of the legal grounds for data processing described above

      For the period for which consent is given.

      You can withdraw your consent at any time, for example by email. However, even if you withdraw your consent or its term expires, this does not mean that we have to delete all of your data that we processed on its basis. We may continue to work with the data for which another legal ground allows us to do so. If you withdraw your consent, this does not affect the lawfulness of the processing of personal data before its withdrawal.

      The data specified in the consent to the processing of personal data, for example when publishing testimonials with your first and last name

      C) If you browse our Website, we process the following personal data of yours:
        • Contact data. We need it so that we can contact you if necessary. This includes your phone number and email address if you provide them when communicating with us.
        • Information from our communication. In this case, this mainly means information provided in the contact form and in our further communication. If you contact us about our services, we store this information in our internal system for managing inquiries and orders, which is operated for us by the companies listed below in the section “Who will we pass your personal data to?”
        • Cookies. We use cookies to run and operate the Website.
           

        We then process this data for the following purposes and periods:

        What is the legal basis for processing under the GDPR?

        Why do we process your data?

        How long will we process it?

        What specific data do we process for this purpose?

        CONTRACT

        as part of pre-contractual negotiations

        Article 6(1)(b) GDPR

        So that you can contact us through the contact form on our Website and we can respond to you

        For 3 years, unless we start working together

        Contact data

        Information from our communication

        So that you can communicate with us through our chatbot on the Website

        For 3 years, unless we start working together

        Contact data

        Information from our communication

         





        CONSENT

        we process personal data based on your consent

        Article 6(1)(a) GDPR

        So that we can send you newsletters if you are not our customer but actively express interest in them

        For 3 years from the date you give consent, or until you object to this processing, e.g., by unsubscribing from our newsletters

        Contact data

        So that we can also process your data whose processing does not fall under any of the legal grounds for data processing described above



        For the period for which consent is given.

        You can withdraw your consent at any time (e.g., by email). Even if you withdraw your consent or its term expires, this does not mean that we have to delete all of your data that we processed on its basis. We may keep the data for which another legal ground allows us to do so. If you withdraw your consent, this does not affect the lawfulness of the processing of personal data before its withdrawal.

        The data specified in the consent to the processing of personal data

        OTHER

        You will find more information in the part of this Policy that concerns cookies.

        So that we have an overview of how you use our Website, where you come from when you visit it and which of our products or services interest you most

        You will find more information in the part of this Policy that concerns cookies.

         

         

        Who will we pass your personal data to?

        We may also pass your data to other entities. We do this mainly to ensure that we operate efficiently.

        Our service providers thus become processors of your personal data. However, they are entitled to process your personal data only to the extent we agree with them.

        Specifically, we pass your personal data to the following entities:

         

        • Seznam.cz a.s., which operates the Sklik marketing tool. You can find information on how Seznam processes your personal data here.
        • Google Ireland Ltd, which operates the Google Analytics and Google Ads marketing tools. You can find information on how Google processes your personal data here.
        • ECOMAIL.CZ, s.r.o., which operates the Ecomail mailing tool.
        • Render Services, Inc., which runs the servers of our internal system for managing inquiries and orders for us. The data is stored in a data center in Frankfurt am Main. You can find information on how Render processes your personal data here.
        • Cloudflare, Inc., which provides us with document storage and secures access to our internal system. You can find information on how Cloudflare processes your personal data here.
        • Celonis SE, which operates the Make tool. Make transfers inquiries from the Website to our internal system for us. You can find information on how Make processes your personal data here.
        • Shopify Inc., which operates the platform on which our online store runs. You can find information on how Shopify processes your personal data here.
        • Fakturoid s.r.o., which operates the Fakturoid invoicing tool. You can find information on how Fakturoid processes your personal data here.
        • Microsoft Corporation, which operates the Microsoft Clarity analytics tool. You can find information on how Microsoft processes your personal data here.
        • Judge.me Ltd, which operates the Judge.me marketing tools. You can find information on how Judge.me processes your personal data here.
        • Meta Platforms Inc., which operates the Facebook Pixel marketing tool. You can find information on how Meta Platforms processes your personal data here.
        • Petr Kosejk, who is our accountant.
        • Where applicable, our other suppliers who are involved in our operations or in working with customers. We will always provide an up-to-date list of suppliers on request.

        We may also pass your personal data to public authorities if it is in our interest or if they ask us to do so.

        Where will we transfer your personal data?

        Because we use some advanced tools to improve our services, some of your personal data may be transferred to third countries outside the European Union. However, we always transfer such data in compliance with all standards of due care for personal data and provided that the recipient of your personal data has given a sufficient guarantee of personal data protection that meets European standards.

        Specifically, these are the companies based in the United States of America and in Canada that are listed above: Render, Cloudflare, Shopify, Microsoft, Google, Meta Platforms and Judge.me. The transfer is based either on a European Commission adequacy decision (the EU-U.S. Data Privacy Framework, and for Canada an adequacy decision) or on standard contractual clauses approved by the European Commission.

        The database of our internal system itself and the document storage are located in data centers in the European Union (Frankfurt am Main).

        What rights do you have in connection with the processing of personal data?

        • You have the right to object if we process your personal data on the basis of our legitimate interest. You can raise this objection by sending it to our contact address or to the email address info@dmp.cz. We will then assess it within one month of receipt at the latest.
        • You have the right to obtain confirmation from us as to whether we process your personal data. If we do, you have the right to access this personal data and to information about what personal data is involved.
        • You can ask us to correct inaccurate data or complete incomplete data.
        • Under certain conditions, we are also obliged to erase your personal data or restrict its processing if you ask us to do so. Under certain conditions, you also have the right to have your personal data transferred to another controller.
        • If you suspect that your personal data is being processed unlawfully, you can lodge a complaint with the Office for Personal Data Protection, uoou.cz, address Pplk. Sochora 27, 170 00 Praha 7.

         

        What about cookies?

        For the Website to work properly, we use cookies, which are small files that our Website stores on your device through your browser. Cookies are not used for, nor do they enable, your personal identification as a user of the Website. We divide cookies into necessary, functional, analytics and marketing cookies.

        Necessary cookies are needed for the Website to run correctly. We do not require your consent to use these cookies. We have a legitimate interest in the Website running properly.

        Functional cookies are necessary to ensure the correct operation of the Website. We do not require your consent to use these cookies. We have a legitimate interest in the Website running properly (e.g., displaying correctly on your device).

        Analytics cookies help us compile statistics and reports. We use them to track traffic to the Website and where you came to the Website from.

        Marketing cookies allow us, for example, to offer our products through targeted advertising.

         

        Which cookie is it?

        What is it for?

        When is it deleted?

        Who else has access to it besides us?

        keep_alive

        Other.

        1 hour

        secure_customer_sig

        Necessary. Used by Shopify in connection with customer login.

        1 year

        Shopify

        localization

        Functional. Used by Flickr to track the use of photo galleries embedded from Flickr.

        1 year

        cart_currency

        Necessary. Used by Shopify to display prices in the currency of the customer’s location.

        1 year

        Shopify

        _cmp_a

        Other.

        1 day

        _tracking_consent

        Other.

        1 year

        _shopify_y

        Analytics. Used by Shopify to manage the customer’s privacy settings.

        1 year

        Shopify

        _shopify_s

        Analytics. Used by Shopify to manage the customer’s privacy settings.

        1 year

        Shopify

        _orig_referrer

        Necessary. Used by Shopify in the shopping cart.

        14 days

        Shopify

        _landing_page

        Analytics. Used by Shopify to track the website’s landing pages.

        14 days

        Shopify

        sid

        Analytics. Stores encrypted data about the user’s Google account and the time of the last login.

        1 month

        Google Ads

        CLID

        Analytics. Collects data about interaction with the website.

        1 year

        Google

        _gcl_au

        Analytics. Used by Google Tag Manager to test the effectiveness of advertising messages during a website visit.

        3 months

        Google Adsense

        test_cookie

        Marketing. Used by Doubleclick.net to check whether the user’s browser supports cookies.

        15 minutes

        doubleclick.net

        _ga_*

        Analytics. Used by Google Analytics to determine the number of visits to the website.

        1 year, one month and 4 days

        Google Analytics

        _ga

        Analytics. Used by Google Analytics to collect data about visitors, sessions and campaigns and to track site usage for the site’s analytics report.

        1 year, one month and 4 days

        Google Analytics

        _shopify_sa_t

        Analytics. For Shopify marketing and recommendations.

        1 hour

        Shopify

        _shopify_sa_p

        Analytics. For Shopify marketing and recommendations.

        1 hour

        Shopify

        _gid

        Analytics. Used by Google Analytics to store information about how visitors use the website while also creating an analytics report on the website’s performance.

        1 day

        Google Analytics

        _gat

        Functional. Used by Google Analytics to limit the number of requests and thus limit data collection on high-traffic sites.

        1 minute

        Google Analytics

        ecvisits1-43c2cd496486bcc27217c3e790fb4088

        Other.

        1 day

        ecsession1-43c2cd496486bcc27217c3e790fb4088

        Other.

        1 day

        _clck

        Analytics. Used by Microsoft Clarity to store the browser’s Clarity user ID and settings exclusive to that website.

        1 year

        Microsoft Clarity

        _clsk

        Analytics. Used by Microsoft Clarity to store and consolidate a user’s page views into a single session recording.

        1 day.

        Microsoft Clarity

        _fbp

        Analytics. Displaying ads on Facebook or on a digital platform powered by Facebook advertising after visiting the website.

        3 months

        Meta Platforms

        SM

        Analytics. Used by Microsoft Clarity to synchronize the MUID identifier across Microsoft domains.

        For the duration of the session.

        Microsoft Clarity

        MUID

        Marketing. Used by Bing to identify unique web browsers visiting Microsoft sites. This cookie is used for advertising, site analytics and other operations.

        1 year and 24 days.

        Microsoft

        MUID

        Marketing. Used by Bing to identify unique web browsers visiting Microsoft sites. This cookie is used for advertising, site analytics and other operations.

        1 year and 24 days.

        Microsoft

        MR

        Analytics. Used by Bing to collect information about the user for analytics purposes.

        7 days.

        Microsoft

        SRM_B

        Functional. Used by Microsoft Clarity for a unique visitor ID.

        1 year and 24 days.

        Microsoft Clarity

        MR

        Analytics. Collects information about users for analytics purposes, set by Bing.

        7 days.

        Microsoft

        ANONCHK

        Marketing. Set by Bing, it is used to store the user’s session ID and to verify ad clicks on the Bing search engine. This cookie also helps with reporting and personalization.

        10 minutes.

        Microsoft

        notifications

        Other.

        1 day.

        AWSALBCORS

        Necessary. Amazon Web Services set this cookie for load balancing.

        7 days

        Amazon

        1-3c2cd496486bcc27217c3e790fb4088dmp.czecwshown

        Other.

        1 year

        bugsnag-anonymous-id

        Analytics. Set by BugSnag/Juicer for error reporting and other analytics purposes.

        Never.

        cart

        Necessary. Shopify sets this cookie to maintain the connection to the shopping cart.

        Never.

         Shopify

        key

        Other.

        Never.

         

         

        This Policy is effective as of August 17, 2026