The controller responsible for processing your personal data is:
Design Depot s.r.o.
Registered office: U Lipy 10/5, 155 21 Praha-Zličín
Identification number (IČO): CZ28950071
Registration details: C 155259/MSPH Městský soud v Praze
Website: www.bankovprintspace.com
Email: info@bankovprintspace.com
In this policy, “we”, “us” and “our” refer to this controller.
You can contact us using the details above with any questions about your personal data or to exercise your rights.

Personal data means information relating to an identified or identifiable individual. It includes names and contact details, as well as online identifiers and other information that can be linked to a person.
Depending on how you interact with us, we may process:

• Identification and contact details: your name, email address, telephone number, billing address and delivery address.
• Business details: company name, identification number, VAT number and business contact details, where relevant.
• Order and transaction details: products or services ordered, order history, payment status, transaction references, delivery information, returns and complaints.
• Correspondence and enquiry details: messages, requests, project specifications, artwork files and other information you provide when communicating with us.
• Technical and usage data: IP address, browser and device information, access times, security logs and information about your interactions with the website.
• Marketing preferences and consent records: subscription details, communication preferences, consent choices and records of withdrawals or objections.

Please provide only the information necessary for your enquiry or order. If you supply personal data relating to another person, such as a delivery recipient, please ensure that you are entitled to provide it and inform that person about this policy.

We generally obtain personal data directly from you when you place an order, submit a form, contact us or subscribe to communications.
Some information is collected automatically through the operation of the website, security logs, cookies and similar technologies.
Where necessary to fulfil your order, we may also receive payment confirmations, delivery updates or related information from payment providers and carriers.

We use different legal bases depending on the purpose of the processing. Consent is not required for every use of personal data.

Enquiries, quotations and contracts
We process relevant contact details, correspondence and project information to answer enquiries, prepare quotations and take steps at your request before entering into a contract.

Legal basis: Article 6(1)(b) GDPR, where the processing concerns a potential contract with you.
For general enquiries or communications on behalf of a company, we may rely on our legitimate interest in responding to correspondence and managing business relationships under Article 6(1)(f) GDPR.

Orders, payments and delivery
We process the information needed to accept and fulfil orders, provide printing or other services, arrange delivery, communicate about purchases and administer contractual returns or complaints.

Legal basis: Article 6(1)(b) GDPR — performance of a contract.
Where you act as a contact person for a business customer, we process your business contact details on the basis of our legitimate interest in managing that business relationship under Article 6(1)(f) GDPR.

Accounting, taxation and other legal obligations
We process and retain relevant transaction records to comply with accounting, tax, consumer protection and other legal requirements.

Legal basis: Article 6(1)(c) GDPR — compliance with a legal obligation.

Website security and protection of legal rights
We may process technical logs and relevant transaction or correspondence records to maintain website security, prevent fraud and misuse, and establish, exercise or defend legal claims.

Legal basis: Article 6(1)(f) GDPR — our legitimate interests in protecting our systems, business, customers and legal rights.
We assess these interests against your rights and freedoms and limit processing to what is necessary.

Newsletters and marketing
Where you subscribe to our newsletter, we use your contact details to send the communications you have requested.

Legal basis: Article 6(1)(a) GDPR — your consent.
Where permitted by Section 7(3) of Czech Act No. 480/2004 Coll., we may also use an email address obtained from a customer in connection with a sale to promote our own similar products or services. This applies only if the customer was given a clear, simple opportunity to refuse this use when the address was collected and in every subsequent message.

Legal basis for this customer marketing: Article 6(1)(f) GDPR — our legitimate interest in promoting our own similar products or services, subject to the requirements of Czech law.

You may object to direct marketing at any time. We will then stop processing your personal data for that purpose.
You can unsubscribe using the link in our emails or by contacting info@bankovprintspace.com. Marketing consent is voluntary and is not a condition of purchasing from us.

Cookies and website analytics
We use strictly necessary cookies to support essential website functions.
Optional analytics, personalisation or advertising cookies are used only with your consent where required by law. Where personal data is processed on the basis of that consent, the legal basis is Article 6(1)(a) GDPR.
Further details are provided in our Cookie Policy and cookie settings.

Where online payments are available, payment information is processed by the payment provider selected at checkout.
We receive the information needed to confirm and administer your payment, such as payment status and transaction references. Full payment card details are handled by the relevant payment provider rather than included in our order records.
Payment providers may act as independent controllers for certain processing activities, including fraud prevention and compliance with financial regulations. Their privacy notices explain these activities.

Payment provider(s): Československá obchodní banka, a. s. (ČSOB).

We use Google Analytics through Google Tag Manager to understand website usage and improve the website, subject to your cookie preferences.
Analytics information may include online identifiers, device and browser details, pages viewed and interactions with the website. Such information may constitute personal data.
Google Tag Manager manages website tags; the processing carried out through those tags depends on the services configured on the website.
You can manage optional cookies through the website’s cookie settings. Merely visiting the website or continuing to browse does not constitute consent to optional cookies.
For information about Google’s data practices, see:

• Google Business Data Responsibility
• Google Privacy Policy

Please also read our Cookie Policy.

We disclose personal data only where necessary for the purposes described in this policy and where there is an appropriate legal basis.
Recipients may include:

• Website hosting, platform, IT support and security providers.
• Order management and customer communication providers.
• Payment providers, banks and delivery companies.
• Email newsletter providers, where we use their services.
• Analytics providers, subject to the applicable consent requirements.
• Accountants, legal advisers and other professional advisers.
• Public authorities, courts and other bodies where disclosure is legally required or necessary to protect legal rights.

Service providers acting as processors handle personal data on our instructions under appropriate data processing agreements. Some recipients, such as banks, carriers and public authorities, may act as independent controllers.
We do not sell your personal data. We do not share customer contact details with artists or commercial partners for their independent marketing without a separate valid legal basis and the required information being provided to you.
If our business is reorganised, sold or transferred, relevant personal data may be disclosed to advisers or a successor where legally permitted and subject to appropriate safeguards and transparency requirements.

Some service providers may process personal data outside the European Economic Area (“EEA”), including through remote access or their subcontractors.
Where this occurs, we ensure that the transfer is covered by an appropriate mechanism under Chapter V GDPR. Depending on the recipient, this may include:

• A European Commission adequacy decision.
• The EU–US Data Privacy Framework, where the US recipient is certified and the relevant processing is covered.
• European Commission Standard Contractual Clauses, together with supplementary safeguards where necessary.

Relevant providers, destination countries and applicable transfer safeguards:

• Tilda to operate our online store. You can view their privacy policy here: https://tilda.cc/privacy/
• DPD: Direct Parcel Distribution CZ s. r. o. / Modletice 135, 251 01 Říčany u Prahy / IČ: 61329266

You can contact us for further information about the safeguards applicable to your data and, where appropriate, a copy of them.

We retain personal data only for as long as necessary for the relevant purpose, including applicable legal obligations and the protection of legal rights.
Our retention periods are determined as follows:

• Enquiries that do not result in an order: for the time needed to resolve the enquiry and any reasonably anticipated follow-up, normally 10 years after the last substantive communication.
• Orders and contract records: for the duration of the contractual relationship and subsequently for applicable limitation periods, taking account of any complaint, dispute or legal proceedings.
• Accounting and tax records: for the statutory retention period applicable to the particular document.
• Consent-based marketing: until you withdraw consent or the subscription is otherwise ended under our retention policy, normally 10 years.
• Customer marketing: until you object or we cease to have a justified basis for retaining the contact for this purpose, subject to periodic review.
• Security and technical logs: normally 10 years, unless longer retention is necessary to investigate a specific incident or protect legal claims.
• Cookie and analytics data: for the periods stated in our cookie settings and the relevant service configuration.

We may retain limited evidence of consent, withdrawal or objection where necessary to demonstrate compliance. We may also retain a minimal suppression record to ensure that people who have opted out are not added to marketing lists again.
When retention is no longer justified, we delete or anonymise the data.

We implement appropriate technical and organisational measures proportionate to the nature of the data and the risks involved.
These measures include access controls, appropriate confidentiality obligations and safeguards for the systems and services used to process personal data.

Subject to the conditions and exceptions set out in the GDPR, you have the right to:

• Access: obtain confirmation of whether we process your personal data and receive a copy, together with relevant information about the processing.
• Rectification: have inaccurate data corrected and incomplete data completed.
• Erasure: request deletion where the conditions of Article 17 GDPR are met.
• Restriction: request that we limit processing in the circumstances specified by Article 18 GDPR.
• Data portability: receive data you have provided in a structured, commonly used and machine-readable format, and request its transfer where technically feasible, where processing is automated and based on consent or a contract.
• Object: object on grounds relating to your particular situation to processing based on legitimate interests.
• Object to direct marketing: object at any time, without having to give a reason, to processing for direct marketing, including related profiling.
• Withdraw consent: withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before it.
• Complain: lodge a complaint with a competent supervisory authority.

These rights are not absolute. For example, we may need to retain certain records to comply with legal obligations or defend legal claims.
To exercise your rights, contact info@bankovprintspace.com.
We respond without undue delay and normally within one month of receiving your request. Where permitted by the GDPR, this period may be extended by up to two further months because of the complexity or number of requests. If an extension is needed, we will inform you within the initial month and explain why.
We may request additional information reasonably necessary to verify your identity. Requests are normally handled free of charge. For manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act, as permitted by the GDPR.

You may lodge a complaint with the Czech supervisory authority:
Úřad pro ochranu osobních údajů (ÚOOÚ)
Office for Personal Data Protection
Pplk. Sochora 27
170 00 Praha 7
Czech Republic
Website: https://uoou.gov.cz
You may also complain to the supervisory authority in the EU Member State of your habitual residence, place of work or the alleged infringement.
You are welcome to contact us about any concern, but you do not have to contact us before lodging a complaint.

Providing personal data for marketing is voluntary.
Certain information is necessary to prepare a quotation, fulfil an order, deliver goods or meet legal obligations. If you do not provide this information, we may be unable to provide the requested service or complete your order.
Where appropriate, we identify required fields when collecting the data.

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR.

Our website may contain links to third-party websites. Those operators are responsible for their own processing of personal data.
Please read their privacy notices before providing personal data to them.

We may update this Privacy Policy to reflect changes in our activities, service providers or legal obligations. The current version will be published on this page with its revision date.
Where required, we will provide additional notice of significant changes and request fresh consent before beginning any processing that requires it.
This policy is an information notice. Using the website does not, by itself, constitute consent to processing that requires your consent.