Privacy Policy

1. What personal data we process

We process the following personal data that you provide to us when ordering or registering:

• first and last name;
• delivery and billing address;
• e-mail address;
• telephone number;
• the photograph you upload for the manufacture of your product;
• order and payment history.

2. Why we process your data and on what legal basis

• Performance of the contract (Art. 6(1)(b) GDPR): to process and deliver your order, manufacture your custom product, handle payments, complaints and communication about your order. Provision of this data is a necessary requirement for concluding and performing the contract.
• Legal obligation (Art. 6(1)(c) GDPR): to issue tax documents and keep accounting records.
• Legitimate interest (Art. 6(1)(f) GDPR): to protect our rights and for basic analytics of the operation of the shop.
• Consent (Art. 6(1)(a) GDPR): for non-essential analytical and advertising cookies. Consent can be withdrawn at any time.

3. Recipients and processors

To operate the shop we use the following processors, who process your data only to the extent necessary and under a data-processing agreement:

• shipping carriers — GLS (General Logistics Systems) and Spring GDS (Spring Global Delivery Solutions), for delivery of your order;
• payment providers — GoPay and PayPal, for processing payments;
• hosting — Railway Corporation (548 Market St PMB 68956, San Francisco, CA 94104, USA), for running the shop and its database; the servers are located in the USA (California);
• cloud storage — Cloudflare, Inc. (USA), Cloudflare R2 for uploaded photographs and CDN for static files;
• e-mail delivery provider — Brevo (Sendinblue SAS), Paris, France (processing in the EU), for sending order and service e-mails;
• business mailboxes — Seznam.cz, a.s., Company ID 26168685, Radlická 3294/10, 150 00 Prague 5, Czech Republic (Email Profi service), for the business mailboxes holding correspondence with customers;
• analytics and advertising — Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for Google Analytics 4 and Google Ads; analytical and advertising cookies only with your consent;
• usage analytics — PostHog, Inc., for analysing the use of the Website, data stored in the EU (Frankfurt); only with your consent;
• accounting and invoicing — Trivi a.s., Company ID 28378440, Jankovcova 1566/2b, 170 00 Prague 7, Czech Republic, registered with the Municipal Court in Prague, file no. B 23166 (invoice data).

Railway Corporation and Cloudflare, Inc. are based in the USA and also process data there; Google may transfer data to Google LLC in the USA. Transfers to the USA are safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, for Cloudflare and Google, additionally by certification under the EU-US Data Privacy Framework (Art. 45 GDPR).

The uploaded photograph and order data are processed for production directly by the Controller, Honkee s.r.o., in its own production facility in the Czech Republic. Production is therefore neither a recipient nor a processor.

4. How long we keep your data

We keep personal data for the time necessary to fulfil the contract and for the period required by legal regulations (in particular accounting and tax obligations). The uploaded photograph is kept only for as long as necessary to manufacture and deliver your product, and is then deleted within a reasonable period.

5. Your rights

Under the GDPR you have the right to: access your personal data; rectification; erasure („right to be forgotten"); restriction of processing; data portability; and to object to processing. You may withdraw consent to processing based on consent at any time. You also have the right to lodge a complaint with the supervisory authority — in the Czech Republic, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), or with the supervisory authority in your country of residence.

To exercise any of these rights, contact us at info@paintingo.com.

6. Cookies

The Website uses cookies. Essential cookies are necessary for the functioning of the shop. Analytical and marketing cookies are used only with your consent, which you can manage via the cookie settings in the Website interface.

This Privacy Policy is effective as of the date of publication on www.paintingo.com. Last updated: 21 October 2026.