Privacy policy

Effective from 20 October 2026

This page explains what personal data we process when you shop at shop.oxodrink.com, why, who we share it with and what your rights are. We follow the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Czech Act No. 110/2019 Coll.

1. Controller

Bubble Point s.r.o., Company ID 08852448, Švábova 772/18, Hlubočepy, 152 00 Prague 5, Czech Republic.
For any question about your personal data, email us at shop@oxodrink.eu.

2. What data we process

  • Contact and delivery details: name, email, phone (if you enter it), delivery address or the Packeta pickup point you chose.
  • Billing details: billing address and, for business purchases, company name, company ID and VAT number.
  • Order details: what you bought, prices, delivery, payment method and order status.
  • Payment details: for card payments you enter your card details directly with Stripe; we never see the card number. For bank transfers we see the account number and account holder's name the payment came from.
  • Account details: if you create an account, your email, password (stored only as a hash that cannot be read back) and order history.
  • Website usage data: only if you allow analytics cookies (see point 7).

3. Why we process data and on what legal basis

  • Handling your order (receiving it, payment, delivery, order status emails, complaints and withdrawals): performance of a contract, Art. 6(1)(b) GDPR.
  • Invoices and accounting: legal obligation under the Czech Accounting Act and VAT Act, Art. 6(1)(c) GDPR.
  • Protecting our rights (for example in a dispute about an order): legitimate interest, Art. 6(1)(f) GDPR.
  • Customer account: performance of the account contract, Art. 6(1)(b) GDPR.
  • Marketing emails: only if you consent when you register, Art. 6(1)(a) GDPR. You can withdraw consent at any time by emailing shop@oxodrink.eu.
  • Website analytics (PostHog): only with your consent in the cookie bar, Art. 6(1)(a) GDPR.

We need the details marked as required at checkout to conclude and perform the contract. Without them we cannot handle the order.

4. How long we keep data

  • Order data: [doba uchování údajů o objednávce – doplní Pavel].
  • Invoices (tax documents): 10 years from the end of the tax period in which the supply took place (section 35 of the Czech VAT Act No. 235/2004 Coll.).
  • Account: until you close it. Just email us.
  • Marketing: until you withdraw consent.
  • Analytics data: [doba uchování v PostHogu – doplní Pavel].

5. Who we share data with

The following processors and recipients handle data, each only as far as they need to:

  • Zásilkovna s.r.o. (Packeta): delivering the parcel (name, contact, address or pickup point).
  • Stripe Payments Europe, Ltd.: card, Apple Pay and Google Pay payments.
  • Fio banka, a.s.: keeps our account that receives bank transfers.
  • Resend, Inc.: sending order emails.
  • NextCRM: the system for order management and invoicing. Operator: [provozovatel NextCRM – doplní Pavel].
  • GIPS, Vožická 2604, Tábor, Czech Republic [obchodní firma a IČO GIPS – doplní Pavel]: our warehouse, which packs and ships orders. For every paid order it receives the order sheet and the Packeta label with your name and address or pickup point.
  • PostHog: website analytics with data stored in the EU, only with your consent.
  • Shop hosting: [poskytovatel serverů – doplní Pavel].

Sometimes we have to pass data to authorities when the law requires it. We do not sell data.

6. Transfers outside the EU

Stripe and Resend may also process data in the USA. These transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses.

7. Cookies and analytics

We use necessary cookies and browser storage for the cart, login, language and payment. Analytics (PostHog) starts only after you click "Accept all" in the cookie bar. The data goes through our domain shop.oxodrink.com to PostHog's servers in the EU. The list of cookies and how to change your consent is on the Cookies page.

8. Your rights

You have the right:

  • to access your data and get a copy,
  • to have inaccurate data corrected,
  • to have data erased if we no longer need it or process it unlawfully,
  • to restrict processing,
  • to data portability for data we process based on a contract or consent,
  • to object to processing based on legitimate interest,
  • to withdraw consent at any time (cookies through "Cookie settings" in the site footer, marketing by email). Withdrawal does not affect processing before it.

Just email shop@oxodrink.eu. We reply without undue delay and within one month at the latest (Art. 12(3) GDPR).

If you think we handle your data wrongly, you can complain to the Czech Office for Personal Data Protection (https://uoou.gov.cz) or to the data protection authority in your country.

We do not use automated decision-making or profiling with legal effects.