This Privacy Policy explains how personal data is processed when you visit the online store CM Store at store.cmindustry.co (the "Store"), buy from it, create an account, contact us, write a review or subscribe to our newsletter. It is written for the EU General Data Protection Regulation (GDPR) and Czech law.
1. Who is responsible for your data
The controller of your personal data is Stanislav Tarasov, a self-employed entrepreneur (OSVČ) trading under the brands CM Store and CM Industry:
- registered address: náměstí Přátelství 1518/3, 102 00 Praha 10 – Hostivař, Czech Republic;
- Business ID (IČO): 23724391;
- e-mail: store@cmindustry.co;
- phone: +420 777 672 378.
We have not appointed a Data Protection Officer because we are not required to. For any privacy question, write to the e-mail address above.
2. What we process, why, and for how long
| Purpose | Personal data | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Orders and delivery of files: processing your order, granting download access, sending order e-mails | Name, e-mail, billing address, phone and company name if you enter them, order contents, prices, download history, IP address at checkout | Art. 6(1)(b): performance of the contract | For the duration of the contract and then for 5 years: the 2-year period for reporting defects plus the 3-year limitation period for claims |
| Accounting and tax | Order and payment records, invoices | Art. 6(1)(c): legal obligation under Czech accounting and tax laws | 10 years from the end of the year of the transaction |
| Payments | Payment status, transaction ID, payment method, the last digits of a card or your PayPal e-mail. We never receive your full card details | Art. 6(1)(b): contract; Art. 6(1)(f): preventing payment fraud | Together with the order (see above) |
| Customer account | E-mail, password (stored encrypted), name, addresses, order history, wish lists | Art. 6(1)(b): contract (account terms) | Until you delete the account or ask us to delete it. Order data is then kept as stated above |
| Adapting a pre-made livery | Vehicle details, photos and measurements you send us, our correspondence | Art. 6(1)(b): contract | As for orders |
| Customer support, contact form and e-mail | Name, e-mail, order number, content of your message | Art. 6(1)(b) where it concerns a contract; otherwise Art. 6(1)(f): our legitimate interest in answering enquiries | 12 months after the last contact, unless the message is part of an order, complaint or claim |
| Withdrawals and complaints | Identification and contact data, order number, description of the problem, how it was resolved | Art. 6(1)(c): legal obligation under consumer protection law; Art. 6(1)(b): contract | 3 years after the matter is resolved (the limitation period for related claims) |
| Product reviews | Name or nickname, rating and review text (published) | Art. 6(1)(f): our legitimate interest in publishing customer feedback | While the review is published. You can ask us to remove it at any time |
| Newsletter | E-mail address, date and source of subscription | Art. 6(1)(a): your consent | Until you unsubscribe (link in every newsletter, or e-mail us). We currently only collect subscriptions; we will send newsletters only to people who have subscribed |
| Website analytics: Google Analytics 4, Microsoft Clarity (session recordings and heatmaps; text typed into forms is masked) and BigCommerce store analytics, to see how the Store is used and improve it | Online identifiers from cookies, pages viewed, device and browser data, approximate location (country/city), how you arrived at the Store | Art. 6(1)(a): your consent given through the cookie banner | Up to 14 months in Google Analytics; Clarity recordings up to 30 days; cookies as listed in the Cookie Policy. You can withdraw consent at any time through "Cookie settings" at the bottom of every page. Without consent, Google receives only cookieless signals (technical data such as browser type) that it uses for aggregated statistics |
| Security and abuse prevention: protecting the Store, forms and checkout from bots, spam and fraud (Cloudflare, Google reCAPTCHA) | IP address, browser and device data, interactions with the form | Art. 6(1)(f): our legitimate interest in a secure Store | Short-term technical records, usually hours to days |
| Legal claims | Data needed to establish or defend a claim | Art. 6(1)(f): our legitimate interest in protecting our rights | Until the claim is finally resolved |
We do not sell your personal data. We do not use it for advertising profiles, and the Store currently runs no advertising pixels.
3. Who else processes your data
We use the following service providers. Processors process data only on our instructions under a data processing agreement. Independent controllers process data under their own privacy policies.
| Provider | Role | What for | Location |
|---|---|---|---|
| BigCommerce: Commerce Software Ireland Ltd., Ireland, with its affiliates BigCommerce, Inc. (USA) and BigCommerce Pty. Ltd. (Australia) | Processor | E-commerce platform: hosting of the Store, orders, customer accounts, download delivery, transactional e-mails, store analytics. BigCommerce uses Cloudflare for security and content delivery | EU; data processed also in the USA, Australia and other countries |
| PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg | Independent controller | Payments by PayPal and payment card, fraud prevention | EU; transfers outside the EU under PayPal's safeguards |
| Stripe Payments Europe, Limited, Ireland | Independent controller | Card payments and other payment methods, fraud prevention | EU; transfers to Stripe, Inc. (USA) |
| Apple Distribution International Ltd., Ireland | Independent controller | Apple Pay, if you choose it | EU / USA |
| Google Ireland Limited | Processor (Google Analytics); controller for reCAPTCHA | Website analytics with your consent; spam and bot protection on forms and at checkout | EU; transfers to Google LLC (USA) |
| Microsoft Ireland Operations Limited | Processor | Microsoft Clarity website analytics (session recordings and heatmaps) with your consent | EU; transfers to Microsoft Corporation (USA) |
| Google Cloud EMEA Limited, Ireland (Google Workspace) | Processor | Our business e-mail (store@cmindustry.co) | EU; transfers to Google LLC (USA) |
| Public authorities | Independent controllers | Tax authorities, the Czech Trade Inspection Authority, courts and others, only where the law requires it | Czech Republic |
4. Transfers outside the EU
Some providers are based in the USA or Australia or use sub-processors there. Transfers to the USA rely on the EU–U.S. Data Privacy Framework for certified companies (Art. 45 GDPR). Otherwise they rely on the European Commission's Standard Contractual Clauses (Art. 46 GDPR). Australia does not have an EU adequacy decision, so transfers there rely on Standard Contractual Clauses in the provider's data processing terms. You can ask us for more information about these safeguards.
5. What you must provide
To buy, you must give us your e-mail address and billing details, because we cannot conclude the contract and deliver the Files without them. Everything else, such as a phone number, a company name or a customer account, is optional. Analytics cookies and the newsletter are voluntary and require your consent.
6. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our payment providers may use automated fraud checks when you pay. If a payment is declined, you can contact us or the payment provider.
7. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy;
- have inaccurate data corrected;
- have your data erased, unless we must keep it, for example for tax reasons;
- restrict processing;
- data portability, for data processed on the basis of a contract or consent;
- object to processing based on our legitimate interests;
- withdraw your consent at any time, without affecting processing before the withdrawal. For cookies, use "Cookie settings" at the bottom of every page; for the newsletter, use the unsubscribe link or e-mail us.
To exercise your rights, e-mail store@cmindustry.co. We will reply within one month. This can be extended by two further months for complex requests; we will tell you if that happens. We may ask you to confirm your identity, for example by writing from the e-mail address used for your order.
8. Right to complain
You can lodge a complaint with the Czech supervisory authority:
Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 727/27, 170 00 Praha 7, Czech Republic, uoou.gov.cz, posta@uoou.gov.cz.
You can also complain to the supervisory authority in the EU/EEA country where you live or work.
9. Children
The Store is intended for adults. We do not knowingly collect personal data of children under 15, which is the age of digital consent in the Czech Republic. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes
We will update this Privacy Policy when our Store or the services we use change. The current version is always on this page, with its date at the top.
