Privacy policy
This English translation is provided for information only. In the event of any discrepancy, the Czech version prevails.
This policy is effective from 3 September 2026. This document fulfils the controller's information obligation under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (the “GDPR”) and Act No. 110/2019 Coll., on the Processing of Personal Data. This policy replaces the previous wording published on this page.
1. Who the controller is and how to contact us
The controller of your personal data is JZT Ferments s.r.o., company ID 08924287, VAT ID CZ08924287, registered office Bor 120, 360 01 Sadov, Czech Republic, registered in the Commercial Register kept by the Regional Court in Plzeň, Section C, Insert 38918 (hereinafter “we”). We operate the online shop at https://jztferments.cz and make kombucha at our premises at Zdibsko 615, 250 67 Klecany, P3 park, hall 4.
For personal data matters you can contact us by e-mail at info@jztferments.cz or by post at the registered office address. We have not appointed a data protection officer, because we are not legally required to do so.
2. What data we process, why, on what basis and for how long
| Purpose | What data | Legal basis | Retention period |
|---|---|---|---|
| Processing the order and performing the purchase contract (accepting the order, payment, shipping, communication about the order, tax invoice) | first name and surname, billing and delivery address, e-mail, phone, contents of the order, payment details (never the full card number – only the payment gateway sees that), IP address and device details at the time of ordering (fraud prevention) | performance of the contract – Article 6(1)(b) GDPR; fraud prevention – legitimate interest, Article 6(1)(f) GDPR | for the duration of the contract and then 3 years from delivery in case of complaints and disputes (the general limitation period, Section 629 of the Civil Code); the IP address and device details are part of the order record and we keep them for the same period as the order; separate security and access logs are kept for 12 months |
| Accounting and tax obligations (invoices, VAT records) | billing details, contents of the invoice | compliance with a legal obligation – Article 6(1)(c) GDPR; Section 35 of Act No. 235/2004 Coll., on Value Added Tax; Act No. 563/1991 Coll., on Accounting | tax invoices for 10 years from the end of the tax period in which the supply took place; accounting records for 5 years |
| User account in the e-shop | login details, addresses, order history, saved payment methods (at Shopify only in the form of a token; we do not see them) | performance of the contract – Article 6(1)(b) GDPR | for as long as the account exists; we delete the account at your request. We are entitled to delete an account you have not used for more than 3 years (Article 2.2 of the Terms and Conditions). After deletion of the account we keep only the data required for another purpose listed in this table (in particular tax invoices) |
| Subscription (recurring deliveries of the Pick & mix box) | order data, chosen interval and flavours, payment token, delivery and payment history | performance of the contract – Article 6(1)(b) GDPR | for the duration of the subscription and 3 years after it ends |
| Newsletter (news, promotions, invitations; a discount code for 10% off the price of goods – valid until revoked, one use per customer, one-off purchases only, cannot be combined with other discounts and does not apply to shipping) | e-mail, date and manner of giving consent or a record that we obtained the e-mail at purchase, open and click statistics, website visit data measured by the mailing tool (see the row Traffic and advertising measurement) | consent – Article 6(1)(a) GDPR and Section 7(2) of Act No. 480/2004 Coll.; for existing customers legitimate interest – Article 6(1)(f) GDPR and Section 7(3) of Act No. 480/2004 Coll. (offering our own similar products with the option to object at any time) | until consent is withdrawn, until you unsubscribe or until you object to direct marketing (for mailings based on legitimate interest); we keep the record of consent, of unsubscribing and of the objection for a further 4 years on the basis of our legitimate interest in proving that we had consent and that we respected the unsubscription – Article 6(1)(f) GDPR in conjunction with Articles 5(2) and 7(1) GDPR |
| Contact form and e-mail enquiries | name, e-mail, order number, contents of the message and, if you provide it, phone | steps prior to entering into a contract – Article 6(1)(b) GDPR; legitimate interest in answering the enquiry – Article 6(1)(f) GDPR | until resolved and 12 months thereafter |
| Cooperation with businesses (B2B) – enquiries from cafés, restaurants, offices, company events and weddings, sending the free discovery pack (12 bottles to try), wholesale offers, business contact records in the CRM | first name and surname of the contact person, work e-mail and phone, name and address of the business, company ID, contents of the communication, history of offers and orders | steps prior to entering into a contract and performance of the contract – Article 6(1)(b) GDPR; legitimate interest in developing business relationships – Article 6(1)(f) GDPR | where no cooperation is concluded, 12 months from handling the enquiry or from the last contact, whichever is later; where cooperation is concluded, for its duration and 3 years thereafter |
| Food traceability (records of whom we supplied goods to – for customers who do business as natural persons this is personal data) | name or business name, address, company ID, goods supplied, batch, delivery date | compliance with a legal obligation – Article 6(1)(c) GDPR (Article 18 of Regulation (EC) No 178/2002, Section 11 of Act No. 110/1997 Coll., on Foodstuffs) | at least 6 months from delivery; in practice for the retention period of documents under the row Accounting and tax obligations |
| Complaints, grievances, withdrawal from the contract | order data, description of the defect, photographs, communication | compliance with a legal obligation – Article 6(1)(c) GDPR (Section 19 of Act No. 634/1992 Coll., on Consumer Protection – confirmation of the complaint and of its resolution; Section 2173 of the Civil Code); legitimate interest in defending claims – Article 6(1)(f) GDPR | 4 years from resolution |
| Gift cards | e-mail and name of the recipient, if entered by the buyer; card code; balance | performance of the contract – Article 6(1)(b) GDPR; in relation to the recipient our legitimate interest in delivering the gift and keeping records of the card's redemption – Article 6(1)(f) GDPR | for the validity of the card, i.e. 3 years from its purchase, and 3 years thereafter |
| Traffic and advertising measurement (Shopify Analytics; Google Ads – conversion measurement and remarketing, Google tag and Consent Mode; website behaviour measurement in the Ecomail tool) | cookies and online identifiers, device and browser details, pages visited, visit source; in Google Ads conversion measurement the e-mail may also be passed on in the form of an irreversible hash – the hash is still personal data | consent – Article 6(1)(a) GDPR and Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications (cookie banner) | cookies depending on type from the end of the session up to 2 years (the overview is in the Cookie Policy); we keep measurement data in Shopify Analytics and in the Ecomail tool for the duration of our account and in Google Ads for the duration of membership in advertising lists, at most 540 days; we keep the record of the choice given or refused in the cookie banner for 4 years on the basis of our legitimate interest in proving how you decided – Article 6(1)(f) GDPR in conjunction with Articles 5(2) and 7(1) GDPR |
| Social networks and embedded Instagram content (Instagram, Facebook – messages, comments, competitions; the gallery of our Instagram posts embedded on the website home page) | public profile, contents of the communication; for the embedded gallery the IP address, device and browser details and the fact that you viewed the page with the gallery | our legitimate interest in communicating with customers and promoting our own brand – Article 6(1)(f) GDPR; for competitions performance of the contract (competition rules) – Article 6(1)(b) GDPR; for the gallery embedded on the website consent given in the cookie banner – Article 6(1)(a) GDPR | for as long as the post or thread exists; messages 12 months; for embedded content according to the rules of its provider |
| E-shop security and fraud prevention | IP address, logs, device details, payment risk assessment (Shopify Payments, Klarna, PayPal), necessary cookies | our legitimate interest in operating and securing the e-shop and in protection against fraud – Article 6(1)(f) GDPR; for the cookies necessary for the cart, checkout, login, choice of language and currency and saving your choice in the cookie banner, their storage is permitted by Section 89(3) of Act No. 127/2005 Coll., and we base the subsequent processing on the performance of the contract (Article 6(1)(b) GDPR) and on the stated legitimate interest | security and access logs 12 months; the payment risk assessment, which is part of the order record, for the same period as the order; necessary cookies depending on the cookie type, the overview is in the Cookie Policy |
| Establishment, exercise and defence of legal claims | data from the purposes above | legitimate interest – Article 6(1)(f) GDPR | for the limitation periods and the duration of any proceedings |
We need the data marked as mandatory at checkout to conclude and perform the contract – without it we cannot process the order. Providing an e-mail for the newsletter and consenting to analytics and advertising cookies are voluntary and have no effect on the purchase.
3. Where we get the data from
Primarily from you – from the order, user account, website forms, e-mails and messages on social networks. Further from payment providers (payment status, verification result), from the carrier (delivery status) and from your browser (cookies – other than necessary ones only with your consent). For business customers we may also obtain the work contact of the responsible person from public sources (the Commercial Register, the business's website) – we occasionally e-mail businesses we think would be interested in our kombucha with an offer of cooperation, even if they have not contacted us themselves. We do this on the basis of our legitimate interest in developing business relationships (Article 6(1)(f) GDPR); you can object to such contact at any time at info@jztferments.cz and we will no longer contact you. The recipient's details for a gift card (name, e-mail and any message) are provided to us by the buyer of the card; for the recipient we use them only to deliver the card and keep records of its redemption.
If we did not obtain the data directly from you – this concerns the recipient of a gift card and a business contact person found in public sources – you will receive this policy at the first contact, no later than one month after obtaining the data (Article 14(3) GDPR): for a gift card there is a link to it in the e-mail with the card code, for business contacts in the first e-mail we send you.
4. Who we pass data to (recipients and processors)
We pass on data only to the extent necessary for the given purpose. Processors work with the data according to our instructions on the basis of a data processing agreement (Article 28 GDPR); independent controllers process data under their own privacy policies: Google at https://policies.google.com/privacy, Meta at https://www.facebook.com/privacy/policy, Klarna and PayPal on their websites and in the terms shown to you at checkout before you complete the payment.
E-shop operation and payments - Shopify International Limited, registration number 560279, registered office The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland (address for data protection matters: c/o Intertrust Ireland, 2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland), and its parent company Shopify Inc., 151 O'Connor Street, Ground Floor, Ottawa, Ontario K2P 2L8, Canada – e-shop platform, hosting, user accounts, order e-mails, Shopify Analytics; processor. Data may be stored in Canada and the USA (see Section 5). - Shopify Payments – card, Apple Pay and Google Pay payments; the service is provided by the Shopify group companies listed in the Shopify Payments terms and the payment processing providers they engage. When fulfilling obligations under payment regulations and preventing fraud they act as independent controllers. - Klarna Bank AB (publ), registration number 556737-0431, registered office Sveavägen 46, 111 34 Stockholm, Sweden – pay within 30 days or in instalments; independent controller (Klarna carries out its own assessment under its privacy policy; for data protection matters it can be contacted at ochranadat@klarna.cz). - PayPal (Europe) S.à r.l. et Cie, S.C.A., registered office 22–24 Boulevard Royal, L-2449 Luxembourg, Luxembourg, registered in the R.C.S. Luxembourg commercial register under no. B 118 349 – PayPal payments; independent controller.
Subscriptions, e-shop pages and embedded content - The operator of the Seal Subscriptions application, registered office Podutiška cesta 94, 1000 Ljubljana, Slovenia (EU) – subscription management (interval, flavours, recurring payments); processor. - GemCommerce Co., Ltd (the GemPages application), 5th Floor, Artemis Tower, 3 Le Trong Tan Str., Thanh Xuan, Hanoi, Vietnam – the tool in which parts of the e-shop pages are built; it processes technical data about page display and, where applicable, data you submit through a form created in this tool; processor. Data may be transferred to Vietnam (see Section 5). - Omni Themes (the OT Section Builder application), Viwaseen Tower, 48 To Huu Str., Trung Van, Nam Tu Liem, Hanoi, Vietnam – sections used in the e-shop theme; it processes technical data about page display; processor. Data may be transferred to Vietnam (see Section 5). - The operator of the Section Store application – theme sections of the e-shop and the newsletter sign-up window; it processes technical data about page display; processor. We will provide the provider's business name and registered office on request at info@jztferments.cz. - The operator of the Instafeed application – the gallery of posts from our Instagram account @jztferments embedded on the home page. When the gallery is displayed, your browser connects to the servers of this application, and possibly to Instagram's servers, which may process your IP address and device and browser details; in relation to us it is a processor, while Instagram (Meta) processes the data obtained in this way as an independent controller under its own policy. We will provide the application provider's business name and registered office on request at info@jztferments.cz.
Delivery
We deliver across the whole Czech Republic; we do not ship abroad.
- Prague – JZT's own delivery: shipments are delivered by our driver on working days between 1 pm and 5 pm; we do not pass delivery details (name, address, phone) to any carrier – only our driver and the systems listed above work with them. For delivery purposes we may contact you by e-mail or phone using the contact details in the order.
- Rest of the Czech Republic – chilled transport via the Cool balík service: the shipment is delivered by COOL Balík, s.r.o., company ID 14180138, registered office Zahradní 359, 252 61 Jeneč, or by the courier company that arranges this service for us; we pass on the name, address, phone and e-mail for the delivery notification; independent controller.
Measurement and advertising (only with your consent) - Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – Google Ads (conversion measurement, remarketing), Google tag and Consent Mode; processor for conversion measurement, independent controller for personalised advertising. Data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA (see Section 5).
Newsletter and website behaviour measurement - ECOMAIL.CZ, s.r.o., company ID 027 62 943, registered office Na příkopě 388/1, Staré Město, 110 00 Prague 1 – the Ecomail tool, in which we send commercial communications and keep records of consents, unsubscriptions and open statistics; the same tool also measures visitor behaviour on our website using its own cookies (ecsession1-…, ecvisits1-…, …ecwshown) and we run it only with your consent given in the cookie banner; processor.
Invoicing, accounting and business records - Fakturoid s.r.o., company ID 04656679, registered office Na Perštýně 342/1, Staré Město, 110 00 Prague 1 – issuing and keeping invoices; processor. - RAYNET s.r.o., Ostrava, Czech Republic – CRM system for records of business contacts, enquiries and communication with businesses (B2B); processor. - An external accounting firm that keeps our accounts and tax records – it processes billing details and the contents of accounting documents; processor. We will provide its business name and registered office on request at info@jztferments.cz.
Internal systems and communication - Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – Google Workspace services (the info@jztferments.cz mailbox, Drive, Sheets) and our internal warehouse and production system built on the Google Apps Script platform; e-mail communication with you and documents relating to orders, complaints and invoicing are processed in them; processor. Data may be transferred to Google LLC, USA (see Section 5).
Social networks - Meta Platforms Ireland Ltd., Dublin, Ireland (Instagram, Facebook) – when communicating on our profiles and when the gallery of our Instagram posts is displayed on the website, it processes your data under its own policy (https://www.facebook.com/privacy/policy). For the statistics of our pages and profiles we are joint controllers with Meta under Article 26 GDPR: Meta is responsible for the processing of the statistics itself, for its security and for handling your rights regarding this data; we are responsible for which statistics we follow and how we use them. Meta publishes the essence of this arrangement in the Page Insights Controller Addendum (https://www.facebook.com/legal/terms/page_controller_addendum). You can exercise your rights with Meta as well as with us at info@jztferments.cz.
Public authorities - The tax office, the Czech Trade Inspection Authority, the Czech Agriculture and Food Inspection Authority, courts and other authorities – only where required by law or by a decision of an authority.
We do not sell or provide data to any other third parties.
5. Transfers to third countries (outside the EU and EEA)
- Canada (Shopify Inc.): transfer on the basis of the European Commission's adequacy decision (Decision 2002/2/EC for entities subject to the Canadian PIPEDA Act, confirmed by the Commission's review in 2024) – Article 45 GDPR.
- USA (Google LLC; possibly Shopify Inc. when hosting in the USA): transfer on the basis of the Commission's adequacy decision for the EU–US Data Privacy Framework (Decision (EU) 2023/1795) for recipients certified under this framework – Article 45 GDPR; otherwise on the basis of the Commission's standard contractual clauses (Decision (EU) 2021/914) – Article 46(2)(c) GDPR.
- Vietnam (GemCommerce Co., Ltd – the GemPages application; Omni Themes – the OT Section Builder application): Vietnam has no European Commission adequacy decision, so the transfer is based on the Commission's standard contractual clauses (Decision (EU) 2021/914) agreed in the data processing agreement with the application provider – Article 46(2)(c) GDPR.
- Other e-shop applications: if the provider of any of the applications listed in Section 4 processes data outside the EU and EEA and its country has no Commission adequacy decision, the transfer is based on the Commission's standard contractual clauses (Decision (EU) 2021/914) – Article 46(2)(c) GDPR.
Klarna and PayPal may transfer data to third countries as part of their own processing; the conditions are set out in their privacy policies. We will provide a copy of the safeguards used on request.
6. Retention period
We keep data only for the period stated in the table in Section 2; after that we delete or anonymise it. Statutory periods (in particular 10 years for tax invoices) take precedence over a request for erasure – in such a case we restrict processing to the extent required by law.
7. Your rights
In connection with the processing of personal data you have the right:
- of access to your data and to a copy of it (Article 15 GDPR),
- to rectification of inaccurate or completion of incomplete data (Article 16 GDPR),
- to erasure (“the right to be forgotten”), where there is no legal ground for retention (Article 17 GDPR),
- to restriction of processing (Article 18 GDPR),
- to portability of data we obtained from you and process by automated means on the basis of a contract or consent (Article 20 GDPR),
- to object to processing based on legitimate interest (Article 21(1) GDPR); you can object to processing for direct marketing at any time and we will immediately stop processing for that purpose (Article 21(2) GDPR),
- to withdraw consent (newsletter, cookies) at any time – via the unsubscribe link in every e-mail, the “Cookie preferences” link in the website footer or by e-mail; withdrawal does not affect the lawfulness of processing before the withdrawal (Article 7(3) GDPR),
- to lodge a complaint with the supervisory authority: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, https://uoou.gov.cz.
We accept requests at info@jztferments.cz and handle them without undue delay, no later than one month after receipt; in complex cases the period may be extended by a further two months, of which we will inform you. To protect your data we may ask you to verify your identity (for example by writing to us from the e-mail address stated in the order). Handling a request is free of charge; only for manifestly unfounded or excessive requests may we charge a reasonable fee or refuse the request.
8. Automated decision-making and profiling
We do not make decisions with legal or similarly significant effects based solely on automated processing (Article 22 GDPR). Payment providers (Shopify Payments, Klarna, PayPal) may automatically assess the risk of fraud under their own rules; Klarna additionally assesses your ability to repay. We may tailor the content of the newsletter according to your order history and the pages you visited on the website (basic segmentation, for example by favourite flavours) – only if you are subscribed to it.
9. Security
The e-shop runs on Shopify infrastructure (encrypted HTTPS connection, PCI DSS certification for payments). Only authorised persons with their own login details have access to the e-shop administration and other systems. We never see or store payment card data – it is processed exclusively by the payment gateway. We keep paper documents (delivery notes, invoices) at our premises out of the reach of unauthorised persons and shred them after the retention period. Our co-workers and drivers are bound by confidentiality.
10. Cookies
The use of cookies and similar technologies (Shopify, Google Ads, Ecomail) is described in the separate Cookie Policy at https://jztferments.cz/en/pages/cookies. Without your consent we use only the cookies necessary for the cart, checkout, login, choice of language and currency and saving your choice in the cookie banner; their storage is permitted by Section 89(3) of Act No. 127/2005 Coll., and we base the subsequent processing on the performance of the contract (Article 6(1)(b) GDPR) and on our legitimate interest in a functioning and secure e-shop (Article 6(1)(f) GDPR). Analytics and advertising cookies – i.e. Google Ads cookies and the cookies with which the Ecomail tool measures behaviour on the website – are used only with consent given in the cookie banner. The gallery of our Instagram posts embedded on the home page is also loaded with consent: it is third-party content, and when it is displayed your browser connects to the provider's servers, which may process your IP address and device details. You can change the settings at any time via the “Cookie preferences” link in the website footer.
11. Changes to this policy
We may update this policy, for example when suppliers or legislation change. The current version with its effective date is always on this page; we inform registered customers and newsletter subscribers of material changes by e-mail.
JZT Ferments s.r.o., Bor 120, 360 01 Sadov, Czech Republic, company ID 08924287, info@jztferments.cz