Privacy Policy

Last updated: July 31, 2026

This Privacy Policy describes how galvvale collects and uses your personal information when you visit our website and shop for traditional Easter egg wreaths and autumn harvest door decorations. We are committed to protecting your privacy and handling your data responsibly.

Who We Are

We are the data controller responsible for your personal information. Our business focuses on crafting and selling beautiful handmade Easter and harvest wreaths from Kutná Hora, a region known for its traditional egg decoration artistry. When you interact with us through our website, contact us, or make a purchase, we process your data according to applicable data protection laws.

Information We Collect

We collect information in several ways:

• Contact form submissions: name, email address, phone number, and message content
• Order information: shipping address, billing details, and payment information
• Account data: login credentials and profile information if you create an account
• Website usage data: IP address, browser type, pages visited, and time spent on our site through cookies and analytics
• Communication records: emails and correspondence between us and you

Legal Basis for Processing

We process your personal information based on the following legal grounds: consent when you voluntarily provide information through forms or create an account; contract fulfillment when processing orders and delivering products; legitimate business interests to improve our services, prevent fraud, and maintain website security; and legal obligations to comply with tax laws and consumer protection regulations. Each piece of data we collect has a clear purpose and legal foundation.

How We Use Your Information

We use your data to process and fulfill orders, send shipping confirmations and updates, respond to your inquiries and customer service requests, personalize your shopping experience, send marketing communications when you opt in, analyze website traffic and user behavior to improve our site, prevent fraudulent activity and maintain security, and comply with legal requirements. We never sell your personal information to third parties.

Data Retention

We retain your personal information for specific periods based on the type of data:

• Contact form messages: retained for up to 24 months after your last interaction
• Order and transaction data: retained for up to 7 years for accounting and tax purposes
• Account information: retained as long as your account remains active, deleted upon request
• Website analytics and cookie data: retained for up to 14 months
• Server logs: retained for up to 12 months for security purposes
• Email communications: retained for up to 3 years or as required by law

Your Privacy Rights

You have several rights regarding your personal information. You can request access to your data and receive a copy of what we hold about you. You may request correction of inaccurate or incomplete information. You can request deletion of your data, subject to legal obligations we must fulfill. You have the right to restrict how we process your information. You can withdraw consent at any time without affecting the lawfulness of prior processing. You also have the right to data portability, receiving your information in a structured format. To exercise any of these rights, please contact us using the information provided below.

Cookies and Tracking Technologies

We use cookies to enhance your browsing experience, remember your preferences, and analyze website traffic. Cookies are small files stored on your device that help us understand how you use our site. Essential cookies are necessary for website functionality. Analytics cookies help us improve our services by tracking user behavior. Marketing cookies may be used to show you relevant content. You can control cookie settings through your browser, though disabling essential cookies may affect site functionality. For detailed information about cookies, please see our Cookie Policy.

Data Security

We implement industry-standard security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These include SSL encryption for data transmission, secure server infrastructure, restricted access to personal data, and regular security assessments. However, no method of transmission over the internet is completely secure. While we strive to protect your information, we cannot guarantee absolute security. If you have concerns about a data breach, please contact us immediately.

Third-Party Services

We may share your information with trusted third-party service providers who assist us in operating our website, processing payments, fulfilling orders, and sending marketing communications. These providers are contractually obligated to use your information only as necessary to provide services to us and are required to maintain the confidentiality and security of your data. We do not authorize third parties to use your information for their own purposes.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by updating the "Last updated" date at the top of this page and, if necessary, by sending you a notification email. Your continued use of our website following the posting of revised Privacy Policy means you accept and agree to the changes.

Supervisory Authority

If you believe we have violated your privacy rights or data protection laws, you have the right to lodge a complaint with the data protection authority in the Czech Republic. The competent authority is the Office for Personal Data Protection (ÚOOÚ), which oversees compliance with data protection regulations. You can file a complaint directly with them if you feel your rights have been infringed.