Last updated: 30 September 2026
The controller of personal data processed through interstory.cz is INTERSTORY S.R.O., Černokostelecká 1806/123, Strašnice, 100 00 Praha 10, VAT ID CZ29128030 (“we”, “us” or “INTERSTORY”). Questions and privacy requests may be sent to info@interstory.cz.
This policy explains how we handle personal data when you browse the store, place an order, contact us, subscribe to news and offers, or communicate with us about a purchase. Customers do not need to create an account to shop. The protected staff area is used only by authorised personnel.
Data: your name, email address, phone number, street, city, postal code, country, optional note, order identifier, selected products and variations, quantity, currency, CZK total, order status and timestamps.
Purpose and legal basis: to review your order, contact you, conclude and perform the purchase contract, arrange payment and delivery, provide customer service, handle returns or complaints, and establish or defend legal claims. Processing is necessary to take steps at your request and perform a contract (Article 6(1)(b) GDPR), comply with accounting, tax and consumer-law duties (Article 6(1)(c)), and protect legitimate business and legal interests (Article 6(1)(f)).
The website does not ask for or store payment-card or online banking details. Payment and delivery arrangements are confirmed separately by email. If a payment or delivery provider is agreed, that provider will process the information needed to provide its service under its own terms.
Data: your name, email address, message and submission time.
Purpose and legal basis: to answer enquiries, provide support and keep a reasonable record of our communication. The basis is steps related to a possible contract (Article 6(1)(b)) or our legitimate interest in responding and maintaining customer service records (Article 6(1)(f)).
Data: your email address and subscription time.
Purpose and legal basis: to send news, product arrivals and offers where you have requested them. Processing is based on your consent (Article 6(1)(a) GDPR). You may withdraw consent at any time by writing to info@interstory.cz. Withdrawal does not affect processing performed before it.
Checkout, contact and newsletter submissions use validation, hidden anti-bot fields and rate limits. For rate limiting, a short-lived technical identifier derived from request information, the type of action and its time are processed to prevent spam, abuse and disruption. The legal basis is our legitimate interest in securing the store and its users (Article 6(1)(f)). These rate-limit records are automatically removed after approximately one day.
The store keeps your cart, selected currency, comparison list and cookie preferences in your browser. This information is needed to remember choices you make and is not submitted as an order until you complete checkout. Staff authentication and sign-in protection use additional technical storage for authorised personnel. See our Cookies page for the current inventory and controls.
We receive most personal data directly from you. Product and order records are generated when you use the store. Technical security information is generated when a form request reaches the service.
Checkout fields marked as required are necessary for us to review and fulfil an order; without them, an order cannot be submitted. A checkout note is optional. Contact and newsletter forms are voluntary.
We do not sell personal data. Providers may use data only to supply their services or meet their own legal obligations.
Some technical providers may process data outside the European Economic Area. Where this occurs, we use a lawful transfer mechanism, such as an adequacy decision or approved standard contractual clauses, together with appropriate safeguards where required.
We use access controls, protected staff authentication, database permissions, server-side price verification, input validation, anti-spam controls and restricted administrative access. No online service can guarantee absolute security, but we take appropriate technical and organisational measures proportionate to the data and risk.
We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects. Anti-spam controls may automatically delay or reject excessive form submissions, but they do not decide whether we accept a purchase contract.
Subject to the GDPR and applicable exceptions, you may:
To exercise a right, email info@interstory.cz. We may need to verify your identity before acting. You may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, at uoou.gov.cz.
We may update this policy when the store, our providers or legal requirements change. The current version and update date will remain available on this page.