Privacy policy

Effective from 1 November 2026

We care about protecting your personal data. We only process what we need to handle your order and run the shop, and we never sell your data to anyone. We use data for measuring visits and for advertising only if you give us your consent. Below you’ll find what data we process, why, for how long, who we share it with, and what rights you have under Regulation (EU) 2016/679 (GDPR).

1. Who is the controller

FreshDeal s.r.o.

Prievidzská 2921/23, 787 01 Šumperk, Czech Republic

Company ID (IČO): 09697527, registered in the Commercial Register kept by the Regional Court in Ostrava, Section C, File 83916

Email: info@huggie.cz

The controller runs the Huggie online shop on the websites www.huggie.cz and www.huggie.eu. For any questions about data protection or to exercise your rights, please contact us at the email above. We have not appointed a Data Protection Officer, as we are not legally required to do so.

2. What data we process

Contact and delivery details – first and last name, email, phone number, delivery address or the chosen pickup point or parcel locker.
Order details – ordered products, price, currency, shipping and payment method, invoice, communication about the order, and any returns or complaints.
Payment details – payment status (paid / unpaid / refunded) and the payment identifier. You enter your card details directly into the Stripe payment gateway; we never see or store card numbers.
Contact form messages – name, email, topic and text of the message, the order number if provided, as well as the IP address and browser information (to protect against spam and misuse).
Technical data – IP address, date and time of access and browser information in server logs.
Email for “notify me when back in stock” – only if you ask for such a notification.
Data from cookies and similar technologies – see section 6; analytics and marketing cookies only with your consent.

You don’t create an account or register with our shop – you only provide your details for a specific order.

3. Why we process data and on what legal basis

Handling your order and performing the contract (Art. 6(1)(b) GDPR) – receiving and confirming your order, payment, delivery, communicating with you, returns and complaints. We cannot process your order without this data.
Compliance with legal obligations (Art. 6(1)(c) GDPR) – issuing and archiving invoices and other accounting documents under accounting and tax laws, and handling complaints under the Civil Code and consumer protection law.
Replying to enquiries sent via the contact form or by email (Art. 6(1)(f) GDPR – our legitimate interest in replying to you; for enquiries before a purchase or about an order, Art. 6(1)(b) GDPR).
Legitimate interest (Art. 6(1)(f) GDPR) – securing the website and server, protecting against spam, preventing fraud and misuse of payment methods, and protecting our legal claims.
Preselecting the delivery country and language (Art. 6(1)(f) GDPR) – based on your IP address, we estimate the country you are visiting from so that we can preselect your delivery country, currency and language. This lookup takes place directly on our server using the offline DB-IP database; your IP address is not sent anywhere for this purpose and the result is not stored against you. You can change the country and language at any time.
Consent (Art. 6(1)(a) GDPR) – sending you a notification when a product is back in stock, and analytics and marketing cookies (see section 6). You can withdraw your consent at any time – for notifications by emailing info@huggie.cz, for cookies via the “Cookie settings” link in the footer.

We do not currently send marketing communications (newsletters). No automated decision-making with legal or similarly significant effects on you takes place.

4. Who we share data with

We share data only to the extent necessary for the given purpose, with the following recipients and processors:

Zásilkovna s.r.o. (Packeta) and, depending on the destination country, its partner carriers abroad (e.g. Hermes, InPost, DPD, BOX NOW, PostNord) – delivery to a pickup point, parcel locker or your home; we share your name, phone, email, address or pickup point and, for cash on delivery, the amount to be collected.
Stripe Payments Europe Ltd. (Ireland) – processing of card, Apple Pay and Google Pay payments. See the Stripe Privacy Policy.
Google Ireland Ltd. (Ireland) – Google Analytics 4 and Google Ads, only with your cookie consent.
Meta Platforms Ireland Ltd. (Ireland) – Meta Pixel and the Conversions API, only with your consent to marketing cookies.
Váš Hosting s.r.o. – hosting of the website and the server where the data are stored.
Email service provider – sending order confirmations, invoices and other email communication.
Our accountant, where applicable our tax advisor, and public authorities where required by law.

We store data within the European Union. Google, Meta and Stripe may also process data outside the EU/EEA (especially in the USA); this happens only with appropriate safeguards under the GDPR, on the basis of an adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.

5. How long we keep data

Order data and related communication – for the time needed to handle the order and then for as long as contractual rights may be exercised (in particular rights arising from defective goods and statutory limitation periods), no longer than 4 years from delivery of the goods.
Invoices and other accounting documents – 10 years from the end of the year in which they were issued, as required by accounting and tax laws.
Contact form messages – until the enquiry has been dealt with and then no longer than 24 months; we delete the IP address and browser information after 90 days.
Server logs – usually no longer than 90 days, unless we need them longer to deal with a specific security incident.
Back-in-stock email – until the notification is sent or consent is withdrawn, no longer than 12 months.
Cookies – for the period stated in the table in section 6.

After these periods, we delete or anonymise the data.

6. Cookies and measurement

Necessary cookies are always used – the shop cannot work without them (cart, checkout, language choice and your cookie decision). Preference cookies remember your choice of currency and delivery country. These cookies do not require consent. When paying by card, Stripe and the Packeta pickup-point map may use their own cookies necessary for their operation.

Analytics and marketing cookies are used only if you consent in the cookie banner (legal basis: consent, Art. 6(1)(a) GDPR):

Analytics – Google Analytics 4 (Google Ireland Ltd.): visit and purchase statistics so we understand how the site is used.
Marketing – Meta Pixel (Meta Platforms Ireland Ltd.) and Google Ads (Google Ireland Ltd.): measuring ad performance and showing ads to people who visited our site. If you consent to marketing cookies, when you complete an order we also send Meta, from our server, information about the purchase (order value, products) together with hashed contact details (email, phone, name, postcode) via the Conversions API, so the purchase can be attributed to an ad. Without your consent to marketing cookies, this data is not sent to Meta.

Cookie	Purpose	Lifetime	Type
hgs	session – cart contents and checkout progress	30 days	necessary
lp	remembered website language	1 year	necessary / preference
cur	chosen currency	1 year	preference
cc	delivery country from an ad link	1 year	preference
hg_consent	your cookie choice	6 months	necessary
_ga, _ga_*	Google Analytics – distinguishing visitors and visits	up to 2 years	analytics (with consent)
_gcl_*	Google Ads – measuring ad conversions	90 days	marketing (with consent)
_fbp, _fbc	Meta – measuring and targeting ads	90 days	marketing (with consent)

Consent is valid for 6 months and you can change or withdraw it at any time via the “Cookie settings” link in the footer. You can also delete or block cookies in your browser settings.

7. Your rights

In connection with the processing of your personal data, you have the right to:

access your data and obtain a copy,
have inaccurate or incomplete data rectified,
erasure, if we no longer need the data or process it unlawfully (we cannot, however, erase data we are required to keep by law),
restriction of processing,
data portability of data you have provided to us, in a machine-readable format,
object to processing based on legitimate interest,
withdraw consent where processing is based on consent (this does not affect processing carried out before the withdrawal),
lodge a complaint with the supervisory authority – the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz, or with the supervisory authority in your country of residence.

You can exercise your rights by emailing info@huggie.cz. We will respond without undue delay and within one month at the latest. To make sure we don’t disclose your data to the wrong person, we may ask you to verify your identity (e.g. by writing from the email address used in your order).

8. Security and changes to this policy

We protect your data with appropriate technical and organisational measures – the website runs exclusively over an encrypted connection (HTTPS), only authorised persons have access to the data, and card payments are processed by a certified payment gateway.

We may update this policy from time to time, for example when we change providers or add new shop features. You will always find the current version on this page.