# Privacy Policy > How Švabín Brewery handles the personal data of its online shop customers: which data, why, for how long, and your rights. - Address: https://svabin.com/en/privacy/ - Language: en Legal What we know about you, why we need it, who we pass it to and how long we keep it. Under Regulation (EU) 2016/679 (GDPR). ## 1. Who the data controller is The controller of personal data is Švabín s.r.o., company ID (IČO) 26927462, VAT ID (DIČ) CZ26927462, registered office at Jičínská 226/17, Žižkov, 130 00 Praha 3, Czech Republic, entered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 107307. For anything concerning personal data, write to us at info@svabin.cz. We are not required to appoint a data protection officer and have not appointed one. Your requests are handled directly at the e-mail address above. ## 2. What data we process - Identification and contact data: first and last name, e-mail, phone, delivery address or the pickup point or Z-BOX you selected. - Order data: order contents, price, currency, order number, delivery and payment method, payment status and history, and for subscriptions the history of recurring payments. - Payment data: payment is processed by the payment gateway. Only the payment type, the amount and a payment identifier reach us — we neither see nor store your card number. - Content of communication: what you write in a form on the site or by e-mail, and for wholesale enquiries the name of the venue or company. - Technical data: IP address, browser and device type, language, and data stored in cookies and in browser storage. - Data of applicants: CV, answers to the application questions (sales experience, field, availability, driving licence, home-working equipment, language, business registration), postcode and town of residence, willingness to travel and any comment you add. Details in section 10. [Cookie policy](https://svabin.com/en/cookies/) ## 3. Why we process the data and on what legal basis Processing your order, delivery, payment, complaints Performance of a contract — Article 6(1)(b) GDPR. Without this data we cannot fulfil the order. Bookkeeping and issuing tax documents Compliance with a legal obligation — Article 6(1)(c) GDPR. Verifying that the buyer is 18 or older Compliance with a legal obligation — Article 6(1)(c) GDPR. Replying to a form enquiry and sending the newsletter Consent — Article 6(1)(a) GDPR. You can withdraw consent at any time. Selection of business partners (sales agency, call centre) Steps taken at your request before entering into a contract — Article 6(1)(b) GDPR. Keeping an application for further cooperation offers (applicant database) Consent — Article 6(1)(a) GDPR, given in the application. You can withdraw it at any time. Analytical and marketing cookies Consent — Article 6(1)(a) GDPR, given in the cookie consent bar. Site security, prevention of misuse and fraud, establishing and defending legal claims Legitimate interest — Article 6(1)(f) GDPR. Where we process on the basis of consent, you can withdraw it at any time — by e-mail, via the unsubscribe link in the newsletter, or for cookies via the Cookie settings button at the bottom left of every page. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. We do not carry out automated decision-making that would produce legal effects for you or similarly significantly affect you. Applications are pre-sorted by an automated assessment, but a person always decides — see section 10. ## 4. Who we pass the data to We pass data only to those who need it to get your order to you, and only to the extent necessary. We do not sell personal data. Stripe Processing card, Apple Pay and Google Pay payments and managing recurring payments for subscriptions. Packeta (Zásilkovna) Parcel delivery, pickup points and Z-BOXes, parcel tracking. We pass on the name, contact and delivery details. Google Records of orders, enquiries and applications for cooperation in Google Sheets, plus the Google maps embedded on the contact and pub pages. OpenStreetMap The map of shops and the town search on the “Where to buy” page. The map loads only once you do something on the page; its server then receives your IP address and the town you type in. Cloudflare Hosting and running the site, protection against attacks and abuse. Telegram Internal notification to the brewery about a new order so it can be dispatched quickly, and about a new application for cooperation including the CV. Providers of application assessment tools Pre-sorting applications for cooperation against the requirements of the cooperation, under a data processing agreement. Accounting, tax and legal advisors To the extent needed for bookkeeping and for protecting our rights. Public authorities Only where the law requires it. ## 5. Transfers outside the EU and EEA Some of the providers listed above may process data outside the European Union and the European Economic Area, in particular in the United States. In such cases the transfer is safeguarded by a European Commission adequacy decision (the EU–US Data Privacy Framework) or by standard contractual clauses approved by the European Commission. ## 6. How long we keep the data Orders and related communication For the duration of the contract and then for the limitation period, typically 3 years from fulfilment of the order. Tax documents 10 years from the end of the tax period in which the supply took place (the Czech VAT Act). Accounting records 5 years from the end of the accounting period they relate to (Act No. 563/1991 Coll., on Accounting). Form enquiries and newsletter sign-ups Until consent is withdrawn, at most 3 years from the last contact. Cookie consent and the 18+ confirmation 12 months from being given, after which we ask you again. Applications of unsuccessful applicants 6 months from the end of the selection. Applications in the applicant database (with consent) 12 months from the last contact, or until consent is withdrawn. Once these periods expire we delete or anonymise the data. ## 7. Your rights - The right of access — to confirmation of whether we process your data, and to a copy of it. - The right to rectification of inaccurate data and completion of incomplete data. - The right to erasure, where the reason for processing has ceased and no legal obligation stands in the way. - The right to restriction of processing, for example while the accuracy of the data is being verified. - The right to data portability for data obtained on the basis of consent or a contract, in a machine-readable format. - The right to object to processing based on legitimate interest; you may object to direct marketing at any time and we will stop it immediately. - The right to withdraw consent at any time where processing is based on consent. - The right to lodge a complaint with the supervisory authority. Exercise your rights by e-mail at info@svabin.cz. We handle them without undue delay and no later than one month; in complex cases we may extend that by a further two months and will tell you if we do. So that we do not hand your data to a stranger, we may ask you to verify your identity. ## 8. Complaint to the supervisory authority If you believe we are handling your data badly, you can turn to the supervisory authority. We would be glad of the chance to put it right first, but the right to complain is always yours. Supervisory authority Úřad pro ochranu osobních údajů (Czech Data Protection Authority) Address Pplk. Sochora 27, 170 00 Praha 7, Czech Republic Web https://uoou.gov.cz ## 9. Data security The site runs exclusively over an encrypted HTTPS connection. Access to order data is limited to authorised people at the brewery and to our processors, with whom we have data processing agreements in place. Payment details stay with the payment gateway — they never reach us. ## 10. Selection of business partners (careers) When you apply for a cooperation offer through the form on the Careers page, we process your contact details, CV, answers to the application questions and your postcode and town. We need the postcode because a sales agent operates in the region where they live. Applications are pre-assessed and sorted with the help of an automated tool, including a tool using artificial intelligence. The final decision on whether we invite you to an interview and whether we enter into cooperation is, however, always made by a person. You have the right to: - ask for your application to be reviewed by a person, - express your point of view on the assessment, - contest the assessment. We do not carry out emotion recognition or psychological profiling of applicants (Article 5(1)(f) of Regulation (EU) 2024/1689, the AI Act). We do not ask for or process special categories of personal data under Article 9 GDPR (health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation) or criminal record data. Please do not include them in your CV or in the comment to your application. If you choose in the application to receive further cooperation offers, we keep your application in the applicant database for the period stated in section 6. You can withdraw this consent at any time by e-mail to info@svabin.cz. ## 11. Changes to this policy We may update this policy, for example when a new service or processor is added. The current wording is always on this page. This policy takes effect on 7 October 2026. --- Sold by Pivovar Švabín (Švabín s.r.o.), Plískov 8, 338 08 Zbiroh, CZ · info@svabin.cz · +420 725 836 414 Everything on sale with prices: https://svabin.com/catalog.json · how to buy here: https://svabin.com/llms.txt