Privacy Policy

for the online store www.nonchalant.cz

This Policy explains how Nonchalant s.r.o. processes personal data in connection with the online store, customer accounts, customer support, atelier bookings, marketing, analytics and the virtual try-on feature.

1. Personal data controller

Controller: Nonchalant s.r.o.

Registered office: Kukelska 922/8, Hloubetin, 198 00 Prague 9, Czech Republic

Company ID No.: 298 97 599

Commercial Register: file No. C 454140 maintained by the Municipal Court in Prague

Contact person:

Email: lukas.prokop@nonchalant.cz

Telephone: +420 777 178 819

The Controller has not appointed a data protection officer. Requests concerning personal data may be sent to the email address above.

2. Personal data we process and why

Orders, payments and performance of the contract

We process, in particular, your first and last name, delivery and billing address, email address, telephone number, order details, payment and delivery method, and data required to issue accounting or tax documents.

Purpose: accepting and processing the order, entering into and performing the purchase contract, delivery, communication and payment processing.
Legal basis: performance of a contract and steps taken prior to entering into a contract under Article 6(1)(b) GDPR; compliance with legal obligations under Article 6(1)(c) GDPR.

Customer account and sign-in

When you register, we process identification and contact details, a login identifier, account settings and order history. If you sign in through Google or Seznam, we may receive data made available by that service according to your settings.

Purpose: maintaining the customer account, facilitating purchases and providing access to order history.
Legal basis: performance of a contract under Article 6(1)(b) GDPR and our legitimate interest in the secure and convenient operation of the account under Article 6(1)(f) GDPR.

Communications, complaints, returns and legal claims

We process the content of communications, information about purchased goods and, where necessary, photographs or other materials relating to a complaint, return or other request.

Purpose: handling the request, complying with legal and contractual obligations and protecting legal claims.
Legal basis: Article 6(1)(b), (c) and (f) GDPR.

Atelier bookings and assistance with selection

For a booking, we process your name, contact details, appointment time and information you voluntarily provide, such as requested products, size or preferences.

Purpose and legal basis: arranging the visit and providing the requested service under Article 6(1)(b) GDPR.

Newsletter and commercial communications

We process your email address, records of consent or withdrawal and, depending on the mailing tool settings, information about delivery, opens and clicks.

Legal basis: consent under Article 6(1)(a) GDPR; for our own similar products offered to existing customers, our legitimate interest under Article 6(1)(f) GDPR in conjunction with Section 7(3) of Czech Act No. 480/2004 Coll.
You may unsubscribe at any time by using the link in each email or by objecting to the Controller.

Cookies, analytics and advertising

When you visit the website, we may process your IP address, cookie or device identifiers, pages visited, traffic source and information about website behaviour and conversions.

We use necessary cookies to operate the website, basket, sign-in and privacy preferences.
Analytics, personalisation and advertising cookies are used only according to your choice in the cookie banner, based on consent under Article 6(1)(a) GDPR. You may change your consent at any time in the cookie settings.

Virtual try-on

If you voluntarily use this feature, we process the photograph you upload, the selected product, technical request data and the generated preview. The photograph is not used for biometric identification or decision-making producing legal effects.

Purpose: one-time creation of a visual preview of the product using your photograph.
Legal basis: your consent under Article 6(1)(a) GDPR, given by actively uploading a photograph after the processing information is displayed.
Nonchalant s.r.o. does not permanently store the photograph or result in its own database; the data is processed for the time needed to generate the result. The technical provider may retain limited security and operational logs under its contractual documentation.

Buy-back and pre-owned services

If you offer goods for buy-back or another pre-owned service, we may process your contact details, description and photographs of the goods, information about the original purchase and data needed for settlement.

Legal basis: steps taken at your request before entering into a contract and performance of a contract under Article 6(1)(b) GDPR, legal obligations under point (c), and protection of claims under point (f).

3. Sources of data and whether you must provide it

We obtain data primarily from you, from payment, delivery and sign-in providers, and automatically when you use the website according to your cookie settings.

Data marked as mandatory during checkout is required to enter into and perform the contract. Without it, we cannot process the order. You are not required to provide data for newsletters, optional cookies or virtual try-on; refusing these does not affect your ability to make an ordinary purchase.

4. Recipients of personal data

We disclose data only to the extent necessary to the following categories of recipients:

Upgates and other providers of hosting, e-commerce platform, security and IT support;
Comgate, banks and the provider of the payment method selected for the order; the Controller does not normally receive full payment-card details;
the carrier selected for the order, for example GLS, PPL, DPD, Packeta, Czech Post or FedEx;
Ecomail and other commercial-email distribution providers;
Matomo Cloud (InnoCraft), Google and Meta to the extent corresponding to your consent to analytics or advertising technologies;
Google Cloud / Vertex AI when the virtual try-on feature is used;
accounting, tax, legal and other professional advisers and public authorities where required by law.

5. Transfers outside the European Economic Area

Some technology providers may process data outside the European Economic Area. In that case, the transfer is based on an appropriate mechanism under Chapter V GDPR, in particular an adequacy decision, the European Commission Standard Contractual Clauses or another valid mechanism, together with supplementary safeguards where necessary.

6. Retention periods

order, complaint, return and legal-claim data for the duration of the relationship and generally for 3 years thereafter; longer where a dispute is pending or this is necessary to protect rights;
accounting and tax documents for the period required by law, generally 5 to 10 years;
customer account data for the life of the account and afterwards only to the extent required for legal obligations and protection of claims;
newsletter data until consent is withdrawn or an objection is made; proof of consent or unsubscription may be kept for the period necessary to demonstrate compliance;
cookie data for the period stated in the cookie settings or until consent is withdrawn;
a virtual try-on photograph only while the specific request is being processed;
communications and booking data generally for 3 years after the request is handled or the visit takes place, unless a longer period is necessary.

7. Your rights

Subject to the conditions laid down in the GDPR, you have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interests.

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. You may object to direct marketing at any time; after your objection, we will no longer send commercial communications on that basis.

Send requests to lukas.prokop@nonchalant.cz. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz.

8. Automated decision-making and profiling

We do not carry out automated individual decision-making that produces legal or similarly significant effects. Virtual try-on is an indicative visualisation only. Analytics and advertising tools may create pseudonymous profiles based on your website behaviour only if you consent to the relevant cookies.

9. Security

We implement appropriate technical and organisational measures to protect personal data, including access controls, secure transmission, backups and restricting access to persons and suppliers who need the data for their work.