Privacy policy

1. Data controller

The data controller is Michaela Prokůpková, with its registered office at Alejní 2, 415 01 Teplice, Česká republika, registration number: 72648791, VAT number: CZ7756022835 (the “controller”).

Contact for privacy questions: info@hpmsport.cz

2. Data we process

• — Identification details: first and last name, email, phone and delivery address
• — Billing details: business registration number, VAT number and company name, where relevant
• — Order details: product, price, delivery method and payment status
• —Payment details: payment method, transaction identifier and result; for bank transfers, the number and name of the account the payment was sent from and any account provided for refunds; for online payments, also data made available to us by the payment provider (such as card type and the last four digits of the card number). We do not receive the full card number or security code.
• — Technical details: IP address, browser type and access time, for security

3. Purposes and legal bases

• — Performance of a contract — processing orders and payments, delivering goods and invoicing
• — Legal obligation — accounting and tax documents, retained for 10 years
• — Legitimate interest — fraud prevention, service improvement and traffic analysis
• — Consent — sending commercial communications; consent can be withdrawn at any time

4. Retention

We retain personal data for as long as necessary for its processing purpose. Accounting documents are retained for 10 years as required by law. Marketing consent can be withdrawn at any time.

5. Recipients

Your data may be shared with the following categories of recipients:

• — Carriers, for delivery
• —Payment service and payment infrastructure providers — the seller’s bank and, for online payments, Stripe Payments Europe, Limited (Ireland) and, where applicable, PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg)
• — Hosting and IT service providers
• — Public authorities, where required by law

Processors that process personal data on our behalf (such as hosting and IT service providers) are bound by a data processing agreement. Some recipients, in particular payment service providers and public authorities, process the data they receive partly or entirely as independent controllers under their own privacy rules.

Online payments

If you choose online payment, we share the data needed to process it with the Stripe payment gateway provider (email address, amount, currency and order number). You enter your card details directly on Stripe’s secure payment page; we do not receive the full card number or security code. Our contractual partner is Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland. Stripe processes payment data as our processor; for its own purposes, in particular detecting and preventing fraud and complying with legal obligations (for example anti-money laundering rules), Stripe group companies process the data as independent controllers. Stripe Privacy Policy.

If you pay with PayPal, your data is also processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, as an independent controller under its own privacy rules. PayPal Privacy Statement.

Payment service providers may transfer data outside the European Economic Area, in particular to the USA. Stripe relies on the EU-U.S. Data Privacy Framework, under which its parent company Stripe, LLC is certified, and on standard contractual clauses approved by the European Commission; PayPal relies on its binding corporate rules within its group and otherwise in particular on standard contractual clauses.

6. Your rights

As a data subject, you have the right to:

• — Access your personal data
• — Correct inaccurate data
• — Erasure of data (the right to be forgotten)
• — Restrict processing
• — Data portability
• — Object to processing
• — Lodge a complaint with the supervisory authority (ÚOOÚ, www.uoou.cz)

7. Security

All communications use an encrypted connection (HTTPS/TLS). Access to personal data is restricted to authorised persons. We carry out regular security audits.

8. Cookies

The website uses technical cookies necessary for the service. Analytics cookies are used only with your consent.

This policy is effective from 13 October 2026. The current version is always available on this page.