Privacy Policy

1. Who we are

This Privacy Policy explains how Jan Vitez, a sole trader (OSVČ) registered in the Czech Republic and operator of eventio.me, collects and processes your personal data as data controller within the meaning of the GDPR (Regulation (EU) 2016/679).

• Registered office: Korunní 2569/108, 101 00 Praha - Vinohrady, Czech Republic
• IČO: 07681062 · DIČ: CZ9001199130
• Contact: info@eventio.me

2. What data we collect

• Account & order data: name, email address, and (for registered accounts) a hashed password.
• Order details: purchased products, prices, discount codes used, and order status.
• Payment data: processed directly by Stripe — we never see or store your card number.
• Communications: emails you send us and the delivery/order emails we send you.
• Technical data: functional cookies used to keep you logged in and remember your cart and favorites (see Section 6).

3. Why we process your data and on what legal basis

• To fulfil your order (create your account, process payment, deliver your digital template) — performance of a contract (Art. 6(1)(b) GDPR).
• To issue invoices and keep accounting records — compliance with a legal obligation (Art. 6(1)(c) GDPR).
• To respond to your enquiries and provide customer support — legitimate interest (Art. 6(1)(f) GDPR).

We do not use your data for marketing without your separate consent, and we do not sell your personal data.

4. Who we share your data with

We share the minimum data necessary with the following processors, each acting under its own data processing terms:

• Stripe — processes your payment and billing details to complete checkout.
• Supabase — hosts our database and handles account authentication.
• Resend — sends transactional emails (order confirmations, template delivery links).

We do not share your data with any other third party, and we do not transfer it outside these processors' infrastructure for any other purpose.

5. How long we keep your data

Order and invoicing data is kept for as long as required by Czech tax and accounting law (generally up to 10 years). Account data is kept for as long as your account is active; you may request deletion at any time, subject to our legal obligation to retain invoicing records.

6. Cookies

We use only strictly necessary, functional cookies: one to keep you signed in (authentication) and one to remember the contents of your cart and favorites between visits. These cookies do not track you across other websites and are not used for advertising. Because they are strictly necessary for the service you request, no opt-in consent banner is required under Czech and EU law — you can still block cookies in your browser settings, though parts of the site (login, cart) will then stop working correctly.

If we ever introduce analytics or marketing cookies, we will update this policy and ask for your consent first.

7. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data, where we are not legally required to keep it;
• object to or restrict certain processing;
• request a copy of your data in a portable format;
• lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.cz).

To exercise any of these rights, contact us at info@eventio.me.

8. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision.