Privacy policy

Privacy Policy

Last updated: 11 September 2026

This Privacy Policy explains how Soňa Dubovská, operating the SonchCreates.Art online store, collects, uses, stores and shares personal information when you visit sonchcreates.art, place an order, submit an enquiry, request a custom project, subscribe to marketing or otherwise communicate with us.

1. Data controller

The controller responsible for your personal information is:

Soňa Dubovská
SonchCreates.Art
IČO: 14447541
Tehovská 70
100 00 Praha 10
Czechia

Email: info@sonchcreates.art
Telephone: +420 775 438 650

2. Personal information we collect

Depending on how you interact with the store, we may collect:

  • your name, email address, telephone number, billing address and delivery address;

  • order, payment-confirmation, delivery, return and refund information;

  • information connected with your customer account;

  • products you purchase or place in your basket;

  • messages, enquiries and customer-support communications;

  • custom-project information, including measurements, preferences, budget, deadlines, design ideas and requested materials;

  • photographs, drawings, reference files or other materials you upload or send in connection with a custom project;

  • information about customer-supplied materials or meaningful objects where relevant to a project;

  • newsletter subscription and marketing preferences;

  • device and technical information, including IP address, browser, device identifiers and information about how you use the website;

  • cookie, analytics and advertising information where you have consented or where otherwise permitted by law;

  • information needed to prevent fraud, protect the store and comply with legal obligations.

We do not ordinarily receive or store your complete payment-card details. These are handled by Shopify and the payment providers offered during checkout.

Please do not submit sensitive personal information, or personal information concerning another living person, unless it is genuinely necessary for your request and you are authorised to provide it.

3. Where personal information comes from

We collect personal information:

  • directly from you when you order, register, subscribe, complete a form or contact us;

  • automatically when you use the website, including through cookies and similar technologies;

  • from Shopify and service providers acting on our behalf;

  • from payment, delivery, fraud-prevention, analytics and marketing providers;

  • from an authorised person acting on your behalf.

4. Why we process personal information

Orders and requested services

We process personal information to:

  • provide product information and respond to enquiries;

  • prepare quotations and discuss requested custom work;

  • process payments and fulfil orders;

  • arrange delivery, collection, returns, repairs and refunds;

  • provide customer support;

  • communicate necessary information about an order or project.

The legal basis is the performance of a contract with you or taking steps at your request before entering into a contract.

Custom-project enquiries

Information and files submitted through custom-order forms are used to assess the request, communicate with you, prepare possible designs and quotations, and decide whether the project can be accepted.

Submitting an enquiry does not guarantee that a commission will be accepted.

The legal basis is taking steps at your request before entering into a contract. We do not require marketing consent to respond to your enquiry.

Legal and accounting obligations

We process and retain information where necessary to comply with accounting, tax, consumer-protection, product-safety, hallmarking and other legal obligations.

The legal basis is compliance with a legal obligation.

Security and legitimate business interests

We may process information to:

  • protect the store, customers and payment systems;

  • prevent and investigate fraud or misuse;

  • maintain records of communications and agreed designs;

  • establish, exercise or defend legal claims;

  • administer and improve our services;

  • understand general store performance using appropriately configured tools.

The legal basis is our legitimate interest in operating and protecting a secure and effective business, provided that this interest is not overridden by your rights and interests.

Marketing

We send newsletters and promotional emails only where you have subscribed or where another lawful basis permits the communication.

The legal basis is consent where consent is required. You can withdraw your consent at any time by using the unsubscribe link in an email or contacting us.

Withdrawing marketing consent does not affect necessary order, account, safety or customer-service messages.

Analytics and personalised advertising

Non-essential analytics and advertising technologies are used only after the required consent has been obtained or where otherwise permitted by applicable law.

Depending on the settings you accept, this may include measuring website activity, understanding the effectiveness of promotions and displaying more relevant advertising.

5. Custom-order files and photographs

Files supplied for a custom project are used only to assess or produce the requested work, communicate about it, retain evidence of approved designs and resolve related questions or claims.

Customer-supplied photographs, drawings and personal stories will not be published, used in advertising or used as portfolio content without a separate agreement or permission.

If a file contains information about another living person, you should ensure that you have permission to provide it.

6. Sharing personal information

We disclose personal information only where reasonably necessary. Recipients may include:

  • Shopify, which hosts the store, provides customer accounts, checkout, store administration, forms and related ecommerce services;

  • payment providers available through the checkout;

  • delivery providers, including Packeta/Zásilkovna;

  • Digismoothie, which provides the Packeta integration and pickup-point functionality;

  • email, hosting, cloud-storage, IT and customer-communication providers;

  • analytics, advertising and social-media providers, including Pinterest or Meta/Instagram, where their relevant features are active and consent requirements have been satisfied;

  • accountants, professional advisers, insurers or public authorities where necessary;

  • law-enforcement authorities, courts, regulators or other parties where disclosure is legally required.

  • authorised individuals and fulfilment partners who assist with preparing orders, local pickup, returns or customer support, but only to the extent necessary for those purposes;

    Anyone authorised to assist with fulfilment may access relevant order and customer information only where necessary to prepare, hand over or otherwise fulfil an order. Their access is restricted to the information required for that purpose.

We do not sell personal information for money. However, some privacy laws may classify certain advertising or analytics disclosures as a “sale,” “sharing” or targeted advertising. Where applicable, you can exercise the relevant opt-out rights through our data-sharing opt-out page or privacy controls.

7. Shopify and enhanced services

Our store is hosted by Shopify. Information submitted through the store is transmitted to and processed by Shopify and relevant service providers so that the store and its services can operate.

Shopify Network Intelligence is currently enabled. Certain Shopify enhanced services may use information about interactions with our store together with information from other Shopify merchants to support features such as fraud prevention, analytics, personalisation and advertising.

Where Shopify processes information for its own purposes in connection with these enhanced services, Shopify is responsible for that processing and for applicable requests relating to it.

More information is available in the Shopify Consumer Privacy Policy and through the Shopify Privacy Portal.

8. Cookies and similar technologies

The website uses necessary cookies required for functions such as security, navigation, checkout, payments and customer accounts.

With your permission, the website may also use non-essential cookies or similar technologies for analytics, personalisation and advertising.

Our consent banner is provided through Pandectes. You may accept or decline non-essential technologies through the banner. You can reopen the consent widget displayed on the website to review or change your decision.

Declining non-essential cookies should not prevent you from making a purchase, although some optional features may work differently.

Further details about individual cookies, their providers, purposes and durations may be displayed through the cookie banner or consent widget.

9. Marketing preferences

You may subscribe through the newsletter form, checkout or customer sign-in area. Marketing choices are optional and are not preselected.

You may unsubscribe at any time through the link included in each marketing email or by contacting us. We may retain a minimal suppression record after you unsubscribe so that we do not add you back to marketing communications accidentally.

10. Data retention

We keep personal information only for as long as necessary for the purpose for which it was collected and to meet applicable legal requirements.

Our general retention approach is:

  • unsuccessful, declined or abandoned custom-project enquiries and associated uploads are normally deleted within 12 months after the last communication;

  • files and communications connected with accepted custom projects are normally retained for the duration of the project and for up to three years after completion, unless a dispute, legal obligation or ongoing service requires longer retention;

  • order, invoice, payment and accounting records are retained for the period required by applicable Czech and EU law;

  • customer-account information is retained while the account remains active and afterward where required for orders, legal obligations or claims;

  • marketing information is retained until you unsubscribe or withdraw consent, subject to retaining a minimal suppression record;

  • cookie and analytics information is retained according to the periods shown in the relevant consent or provider settings;

  • records concerning privacy requests are retained for as long as reasonably necessary to demonstrate that the request was handled properly.

When information is no longer required, we delete it, anonymise it or securely restrict its further use.

11. International transfers

Shopify and some service providers may process personal information outside Czechia or the European Economic Area.

Where required, transfers outside the EEA are protected using a recognised legal mechanism, such as an adequacy decision, the European Commission’s Standard Contractual Clauses or another lawful safeguard.

Additional information about the safeguards used by an individual provider can be found in that provider’s privacy documentation or requested from us.

12. Your rights

Subject to the conditions and limitations of applicable law, you may have the right to:

  • receive information about how your data is processed;

  • request access to your personal information;

  • request correction of inaccurate or incomplete information;

  • request deletion of information;

  • request restriction of processing;

  • object to processing based on legitimate interests;

  • receive certain information in a portable format;

  • withdraw consent at any time;

  • object to or opt out of direct marketing;

  • lodge a complaint with a supervisory authority;

  • receive information about applicable automated decision-making.

To exercise your rights, contact info@sonchcreates.art.

We may request information reasonably necessary to verify your identity. We will normally respond within one month. Some information cannot be deleted immediately where it must be retained for accounting, legal, fraud-prevention or legal-claims purposes.

You also have the right to lodge a complaint with:

Úřad pro ochranu osobních údajů
Pplk. Sochora 27
170 00 Praha 7
Czechia
https://uoou.gov.cz

If you reside elsewhere in the EEA, you may also contact the supervisory authority in your country.

13. Automated processing

Shopify, payment providers and fraud-prevention providers may use automated systems to identify security or fraud risks. This may affect whether a transaction requires additional verification or can be processed.

SonchCreates.Art does not otherwise intentionally make decisions producing legal or similarly significant effects solely through automated processing.

14. Security

We use reasonable organisational and technical safeguards designed to protect personal information. Access is limited to people and providers who require the information for authorised purposes.

No electronic transmission or storage system can be guaranteed to be completely secure. Please avoid sending unnecessary confidential or sensitive information through ordinary email or forms.

15. Children

The Services are not directed to children under 16, and we do not knowingly collect their personal information. A parent or guardian who believes that a child has provided personal information may contact us to request its deletion.

16. External websites and social media

The website may contain links or widgets leading to third-party websites and social-media platforms. Those services operate under their own privacy policies. We are not responsible for how an independent third party processes information after you leave our website or choose to interact directly with its service.

17. Changes to this policy

We may update this Privacy Policy when our services, providers, legal obligations or data practices change. The updated version will be published on this website with a revised “Last updated” date.

Where a change materially affects how personal information is used, we will provide additional notice where required.

18. Contact

Questions, privacy requests and concerns may be sent to:

Soňa Dubovská – SonchCreates.Art
Email: info@sonchcreates.art
Telephone: +420 775 438 650
Address: Tehovská 70, 100 00 Praha 10, Czechia