Privacy policy
How Wawahi s.r.o. processes personal data in the online shop ropere.com
Version 2026-10-20
1. Controller
The controller of your personal data is Wawahi s.r.o., Loosova 990/24, 149 00 Praha, Česká republika, company ID 05623740, VAT ID CZ05623740, registered in C 267595.
You can contact us about anything related to your personal data by email at info@ropere.com or by post at the address above. We have not appointed a data protection officer because the law does not require one for our processing.
2. In brief
Analytics and marketing cookies are used only with your consent, which you can change at any time via the Cookie settings link at the bottom of every page.
In your customer account you can download your data and delete the account yourself.
We do not sell personal data and we do not pass it on to anyone for their own marketing.
We process personal data only for the purposes described in this policy and only to the extent they require.
3. What we process, why, on what legal basis and for how long
Legal bases refer to Article 6(1) of Regulation (EU) 2016/679 (GDPR). Where we rely on our legitimate interest, you have the right to object (section 7).
Orders, delivery, payment and invoicing
- Data
- Name, billing and delivery address, email, phone, company name, company ID and VAT ID if you buy for a company, ordered products and prices, delivery and payment method, payment status, your note to the order, the version of the terms and conditions you accepted and the order documents sent to you.
- Legal basis
- Performance of the contract (point b). Invoicing and bookkeeping: our legal obligation under Czech accounting and VAT law (point c).
- Retention
- For the duration of the contract and then until the limitation periods for claims from it expire. Invoices and other tax documents are kept for 10 years from the end of the tax year in which the sale took place, as required by Act No. 235/2004 Coll., on value added tax.
Customer account
- Data
- Email, name, saved addresses, order history, gift registries, login sessions and your email preferences.
- Legal basis
- Performance of the contract on the customer account (point b).
- Retention
- Until you delete the account. A login session expires after 30 days. Orders placed through the account are kept as described under Orders.
Newsletters and offers by email
- Data
- Email, name, language, the record of when and where you gave or withdrew your consent.
- Legal basis
- Your consent (point a). You can withdraw it at any time with the unsubscribe link in every email, which works with one click, or in your customer account.
- Retention
- Until you withdraw your consent. We keep the record of the consent and its withdrawal for as long as we may need to prove that we sent emails lawfully.
Review invitations and published reviews
- Data
- For the invitation: email, order and purchased products. For a published review: the name or nickname you enter, your rating, the review text, pros and cons, and the date.
- Legal basis
- Invitation: our legitimate interest in learning how satisfied customers are with their purchase (point f). You can refuse further invitations using the link in the email. Publication: your consent given by submitting the review (point a).
- Retention
- We send one invitation per order. A review stays published until you ask us to remove it or we stop showing reviews of the product.
Satisfaction surveys by Heureka and Google
- Data
- Heureka Ověřeno zákazníky: email and purchased products. Google Customer Reviews: order number, email, delivery country and estimated delivery date.
- Legal basis
- Your consent (point a). Heureka receives your data only if you tick the box in the order form. Google shows its survey dialog on the order confirmation page only if you allowed marketing cookies, and sends you the survey only if you agree in that dialog.
- Retention
- We pass the data once per order. Heureka and Google keep the survey and your answers under their own terms.
Withdrawals from the contract and complaints
- Data
- Name, contact details, order, products, the reason if you give one, the bank account for the refund, the description and photos of a defect and our correspondence.
- Legal basis
- Our legal obligations under the Civil Code and the Consumer Protection Act (point c) and performance of the contract (point b).
- Retention
- Until the case is closed and then for the general limitation period of 3 years. Documents that are part of the accounting are kept as described under Orders.
Chat on the website
- Data
- Your messages and our replies, the time, the visitor identifier and, if you are signed in, your account.
- Legal basis
- Our legitimate interest in answering your questions (point f) and, for questions about an order, performance of the contract (point b).
- Retention
- Kept with the visit records (see below) and handled the same way.
Gift registries and contributions
- Data
- Registry owner: name, event, date, the registry items and their status. Contributor: name, email, the message for the owner, the amount and the payment.
- Legal basis
- Performance of the contract with the registry owner and with the contributor (point b).
- Retention
- Until the owner deletes the registry. Payments and invoices are kept as described under Orders.
Back‑in‑stock alerts
- Data
- Email, the product, the language and the confirmation of the request.
- Legal basis
- Your consent (point a), which you confirm with the link we send you. You can cancel the alert with the link in every alert email.
- Retention
- Unconfirmed requests are deleted after 7 days. A confirmed request is kept until we send the alert, you cancel it or we stop selling the product.
Visit records, security and protection against bots
- Data
- IP address, the country derived from it, browser identification (user agent) and request headers, screen resolution, the pages you visit and their parameters, events such as product views and basket changes, and the visitor identifier stored in a necessary cookie.
- Legal basis
- Our legitimate interest in running the shop securely, detecting automated traffic and abuse, and knowing how the shop is used (point f).
- Retention
- 65 days in the shop database, 14 days for traffic identified as automated. After that the records are moved to an internal archive that is used only for security and aggregated statistics, and we delete archived records once they are no longer needed for these purposes.
Email open tracking
- Data
- Whether and when an email was opened, the IP address, browser identification, preferred language, country and the referring address.
- Legal basis
- Our legitimate interest in knowing whether our emails are delivered and read (point f).
- Retention
- The IP address, browser identification, preferred language, country and referring address are deleted after 12 months. The information that and when the email was opened stays with the email it concerns.
Checking email addresses
- Data
- The email address you enter.
- Legal basis
- Our legitimate interest in preventing typing errors, undelivered order emails and abuse (point f).
- Retention
- We check the format of the address, the domain records (MX and SPF) and whether the mail server accepts the mailbox, without sending a message. We do not check the address against external databases of leaked data. The result is kept only for a few minutes.
Finding delivery addresses on a map
- Data
- The delivery address without your name.
- Legal basis
- Performance of the contract (point b), when we prepare a shipment.
- Retention
- We do not keep the result. The OpenStreetMap Foundation processes the request under its own privacy policy.
AI product search
- Data
- The text of your search query and its language, without your name or contact details.
- Legal basis
- Our legitimate interest in showing relevant search results (point f).
- Retention
- We send the query text to OpenAI only to calculate its numerical representation (embedding). We keep the embedding in a cache for up to 30 days, without the text itself. Under its API terms, OpenAI does not use the inputs to train its models and keeps them for up to 30 days to detect abuse.
4. Who receives your data
We share personal data only to the extent needed for the purpose concerned:
Cloudflare, Inc. (content delivery, security and cookieless Cloudflare Web Analytics), as our processor;
Comgate Payments, a.s. (payments by card and bank transfer), as an independent controller;
Fakturoid s.r.o. (invoicing), as our processor;
Google Ireland Limited and Google LLC (Google Analytics 4, Google Ads and Google Tag Manager with your consent, Google Customer Reviews and Google Merchant Center);
Heureka Group a.s. (the Ověřeno zákazníky survey, only if you agree to it in the order form), as our processor;
OpenAI OpCo, LLC (AI product search), as our processor;
Websupport s.r.o. (sending emails), as our processor;
Zásilkovna s.r.o. (Packeta) and the carriers in its network (delivery), as independent controllers;
our hosting provider, as our processor;
public authorities, courts and our legal and tax advisers where the law requires it or where we need to defend our legal claims.
the OpenStreetMap Foundation (finding delivery addresses on a map);
5. Transfers outside the European Economic Area
Google, Cloudflare and OpenAI may process data in the United States. These companies are certified under the EU‑US Data Privacy Framework, for which the European Commission has adopted an adequacy decision; where they process data outside its scope, they rely on the standard contractual clauses approved by the European Commission. The OpenStreetMap Foundation is based in the United Kingdom, which is covered by an adequacy decision of the European Commission.
6. Which data you must provide
To conclude and perform a purchase contract we need your name, billing and delivery address, email and the details of the order. Without them we cannot accept the order. Your phone number is needed only for some delivery methods. All other data, such as consent to newsletters or surveys, is voluntary and refusing it has no effect on your purchase.
7. Your rights
You have the right to:
access your personal data and receive a copy of it;
data portability, that is to receive the data you gave us in a machine‑readable format;
have inaccurate data corrected;
have your data erased where we no longer need it or process it unlawfully;
lodge a complaint with the supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz, or with the supervisory authority in your EU country of residence.
object at any time to processing based on our legitimate interest, and to processing for direct marketing;
restrict processing;
withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal;
In your customer account you can download all data linked to the account and delete the account yourself. For anything else, write to info@ropere.com. We will reply without undue delay and within one month at the latest. Orders and invoices are not deleted with the account while we must keep them under the law.
9. Automated decision‑making
We do not make decisions that produce legal effects concerning you or similarly significantly affect you solely by automated means. We automatically assess technical features of visits to recognise bots; this has no effect on you as a customer.
10. Changes to this policy
We publish every new version of this policy on this page; it applies from its publication. Earlier versions remain available at their own address.