Privacy policy

Effective from 20 October 2026

This page explains what personal data we process when you shop at shop.oxodrink.eu, why, who we share it with and what your rights are. We follow the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Czech Act No. 110/2019 Coll.

1. Controller

Bubble Point s.r.o., Company ID 08852448, Švábova 772/18, Hlubočepy, 152 00 Prague 5, Czech Republic.
For any question about your personal data, email us at shop@oxodrink.eu.

2. What data we process

  • Contact and delivery details: name, email, phone (if you enter it), delivery address or the Packeta pickup point you chose.
  • Billing details: billing address and, for business purchases, company name, company ID and VAT number.
  • Order details: what you bought, prices, delivery, payment method and order status.
  • Payment details: for card payments you enter your card details directly with Stripe; we never see the card number. For bank transfers we see the account number and account holder's name the payment came from.
  • Account details: if you create an account, your email, password (stored only as a hash that cannot be read back) and order history.
  • Website usage data: with cookies only with your consent, otherwise only an anonymous visit count without cookies (see point 7).

3. Why we process data and on what legal basis

  • Handling your order (receiving it, payment, delivery, order status emails, complaints and withdrawals): performance of a contract, Art. 6(1)(b) GDPR.
  • Invoices and accounting: legal obligation under the Czech Accounting Act and VAT Act, Art. 6(1)(c) GDPR.
  • Protecting our rights (for example in a dispute about an order): legitimate interest, Art. 6(1)(f) GDPR.
  • Customer account: performance of the account contract, Art. 6(1)(b) GDPR.
  • Marketing emails: only if you consent, either by subscribing on the website or at checkout (you confirm through a link in an e-mail; we store the date, time and IP address of that confirmation) or by ticking the box when you register, Art. 6(1)(a) GDPR. You can withdraw consent at any time through the "Unsubscribe" link in every e-mail or by emailing shop@oxodrink.eu.
  • Website analytics (PostHog): cookies and visit recordings only with your consent in the cookie bar, Art. 6(1)(a) GDPR. Anonymous visit counting without cookies based on legitimate interest, Art. 6(1)(f) GDPR.

We need the details marked as required at checkout to conclude and perform the contract. Without them we cannot handle the order.

4. How long we keep data

  • Order data: [doba uchování údajů o objednávce – doplní Pavel].
  • Invoices (tax documents): 10 years from the end of the tax period in which the supply took place (section 35 of the Czech VAT Act No. 235/2004 Coll.).
  • Account: until you close it. Just email us.
  • Marketing: until you withdraw consent.
  • Analytics data: [doba uchování v PostHogu – doplní Pavel].

5. Who we share data with

The following processors and recipients handle data, each only as far as they need to:

  • Zásilkovna s.r.o. (Packeta): delivering the parcel (name, contact, address or pickup point).
  • Stripe Payments Europe, Ltd.: card, Apple Pay and Google Pay payments.
  • Fio banka, a.s.: keeps our account that receives bank transfers.
  • Mail server: sending order emails from shop@oxodrink.eu. Operator: [mail server operator – doplní Pavel].
  • GIPS, Vožická 2604, Tábor, Czech Republic [obchodní firma a IČO GIPS – doplní Pavel]: our warehouse, which packs and ships orders. For every paid order it receives the order sheet and the Packeta label with your name and address or pickup point.
  • PostHog: website analytics with data stored in the EU.
  • Shop hosting: [poskytovatel serverů – doplní Pavel].

Sometimes we have to pass data to authorities when the law requires it. We do not sell data.

6. Transfers outside the EU

Stripe may also process data in the USA. These transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses.

7. Cookies and analytics

We use necessary cookies and browser storage for the cart, login, language and payment. If you came through a partner's link, the oxo_ref cookie keeps their code for 30 days so their discount applies in your cart. We set PostHog's analytics cookies only if you click "Accept all" in the cookie bar. If you choose "Necessary only", we count anonymous visits without cookies. The data goes through our domain shop.oxodrink.eu to PostHog's servers in the EU, and IP addresses are not stored. The choice also applies on oxodrink.eu. The list of cookies and how to change your consent is on the Cookies page.

8. Your rights

You have the right:

  • to access your data and get a copy,
  • to have inaccurate data corrected,
  • to have data erased if we no longer need it or process it unlawfully,
  • to restrict processing,
  • to data portability for data we process based on a contract or consent,
  • to object to processing based on legitimate interest,
  • to withdraw consent at any time (cookies through "Cookie settings" in the site footer, marketing through the link in an e-mail or by emailing shop@oxodrink.eu). Withdrawal does not affect processing before it.

Just email shop@oxodrink.eu. We reply without undue delay and within one month at the latest (Art. 12(3) GDPR).

If you think we handle your data wrongly, you can complain to the Czech Office for Personal Data Protection (https://uoou.gov.cz) or to the data protection authority in your country.

We do not use automated decision-making or profiling with legal effects.