Privacy Policy

I. Basic provisions

1. The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data ("GDPR") is:

iWAX – Oriental Beauty a.s.
Company ID (IČO): 19141416
VAT ID (DIČ): CZ19141416
Registered office: Školská 689/20, 110 00 Praha 1, Czech Republic
Email: sale@olevseurope.com
Phone: +420 735 511 811
Website: www.olevseurope.com

(the "Controller")

2. Personal data means any information relating to an identified or identifiable natural person, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

3. The Controller has not appointed a data protection officer.

II. Sources and categories of personal data processed

1. The Controller processes personal data that you have provided to the Controller, or that the Controller has obtained on the basis of fulfilling your order.

2. The Controller processes your identification and contact data (name, surname, delivery and billing address, email, phone number) and the data necessary for the performance of the contract (ordered goods, order history, payment and delivery details).

3. When you visit the website, technical data (IP address, browser and device type, pages visited) and cookies are processed as described in Section VII.

III. Legal basis and purpose of processing

1. The legal basis for processing personal data is:

  • performance of the contract between you and the Controller pursuant to Article 6(1)(b) GDPR,
  • compliance with legal obligations of the Controller (accounting and tax law) pursuant to Article 6(1)(c) GDPR,
  • the Controller's legitimate interest in direct marketing to existing customers (sending commercial communications and newsletters) pursuant to Article 6(1)(f) GDPR,
  • your consent to processing for the purpose of direct marketing pursuant to Article 6(1)(a) GDPR in conjunction with Section 7(2) of Act No. 480/2004 Coll., on certain information society services, where no goods have been ordered.

2. The purpose of processing personal data is:

  • processing your order and exercising the rights and obligations arising from the contractual relationship between you and the Controller; when placing an order, personal data necessary for successful processing of the order (name, address, contact details) is required and without it the contract cannot be concluded or performed,
  • handling warranty claims and returns,
  • sending commercial communications and other marketing activities.

3. No automated individual decision-making within the meaning of Article 22 GDPR takes place on the part of the Controller.

IV. Data retention period

1. The Controller stores personal data:

  • for the period necessary to exercise the rights and obligations arising from the contractual relationship and to assert claims arising from it (10 years from the end of the contractual relationship, in accordance with accounting and tax regulations),
  • until consent to processing for marketing purposes is withdrawn, for a maximum of 5 years where personal data is processed on the basis of consent.

2. After the retention period expires, the Controller deletes the personal data.

V. Recipients of personal data (processors)

1. Recipients of personal data are persons:

  • involved in the delivery of goods and payments under the contract (carriers: Zásilkovna/Packeta, PPL, GLS, Česká pošta; payment providers: Shopify Payments),
  • providing e-shop operation services (Shopify International Ltd.) and other services connected with the operation of the e-shop,
  • providing accounting, legal and marketing services.

2. The e-shop platform Shopify may process personal data on servers outside the EU. Such transfers are governed by the European Commission's Standard Contractual Clauses and Shopify's own data protection commitments.

VI. Your rights

1. Under the GDPR you have:

  • the right of access to your personal data (Article 15),
  • the right to rectification (Article 16) or restriction of processing (Article 18),
  • the right to erasure (Article 17),
  • the right to object to processing (Article 21),
  • the right to data portability (Article 20),
  • the right to withdraw consent to processing in writing or electronically at the address or email of the Controller stated in Section I.

2. You also have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz) if you believe your right to personal data protection has been violated.

VII. Cookies

The website uses cookies necessary for its operation (shopping cart, login, checkout) and, with your consent, analytical and marketing cookies. You can change your cookie preferences at any time in the cookie settings on the website or in your browser.

VIII. Security of personal data

1. The Controller declares that it has taken all appropriate technical and organisational measures to secure personal data, including secure data storage on the Shopify platform, encrypted transmission (HTTPS) and access restricted to authorised persons.

2. Only persons authorised by the Controller have access to personal data.

IX. Final provisions

1. By submitting an order from the online order form, you confirm that you have read this Privacy Policy and accept it in its entirety.

2. The Controller is entitled to change this Privacy Policy. The new version will be published on the website.

This Privacy Policy is effective from 1 November 2026.