Privacy Policy

Last updated: 8 October 2026

The controller of personal data is Bestio Group s.r.o., Company ID: 24878553, with its registered office at Ohrazenice 160, 262 23 Ohrazenice, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 445194 (hereinafter referred to as “Bestio”, “we”, “us” or “our”).

Bestio operates this online store and the related website, including all information, content, features, tools, products and services (collectively, the “Services”). We use the Shopify platform to operate our online store, which provides the technical operation of the e-shop and certain related services. The ordering process, issuing of accounting documents, dispatch and customer e-mails are handled by our own applications running on a server in the European Union.

This Privacy Policy describes how we collect, use, store and disclose your personal data when you use our Services.

Please read this Privacy Policy carefully. By using and accessing the Services you confirm that you have read this Privacy Policy and understand the collection, use and disclosure of your information as described herein.

Personal data we collect or process

When we use the term “personal data” we mean information that identifies you or another person, or that can reasonably be associated with you. Personal data does not include information collected anonymously or de‑identified so that it cannot identify or be reasonably associated with you. Depending on how you interact with the Services and as permitted or required by applicable law, we may collect or process the following categories of personal data:

Contact details including your first and last name, billing address, delivery address, telephone number and e-mail address.
Company details if you buy on behalf of a company: company name, company ID and tax / VAT ID.
Financial and payment information including details of the chosen payment method, payment information, payment confirmations, transaction details and other information necessary to process payments. For bank transfers we process data from the bank statement, in particular the payer’s account number and account name, variable symbol, amount and message for the recipient, to match the payment to your order. We do not directly process full payment card details; the relevant payment service provider processes those.
Account information including your username, password, preferences and settings if you create a customer account in our e-shop. If you sign in to the account with Google or Facebook, we receive your name and e-mail address from them.
Transaction information including items you view, add to cart, add to a wishlist or purchase, return, exchange or cancel, your past orders, issued accounting documents and the delivery status of your parcels.
Product reviews you send us: star rating, text, pros and cons and the name under which the review is to be published.
Communications with us including information you provide when communicating with us, for example when submitting an inquiry, complaint, support request or other message, including messages in the website chat.
Device information including information about your device, browser or network connection, IP address and other unique identifiers.
Usage information including information about your interaction with the Services, such as how and when you use our website, which pages you visit and how you navigate the e-shop.

Sources of personal data

We may collect personal data from the following sources:

Directly from you, in particular when you create an account, place an order, write a review, communicate with us or otherwise provide us with your personal data.
Automatically via our website, your device, cookies and similar technologies. We store analytics cookies, such as Google Analytics cookies, only with your consent; without consent, measurement runs in a limited cookieless mode (see the Cookie Policy).
From our service providers, in particular the bank (details of received payments), the payment gateway (payment result) and carriers (parcel delivery status).
From Google or Meta, if you sign in to your customer account with your Google or Facebook account (name and e-mail address).
From public registers: if you enter a company ID, company name or VAT ID at checkout, we complete the company details from the Slovak Register of Legal Entities (RPO) or the Czech ARES register and verify the VAT ID in the European Commission’s VIES system.

How we use your personal data

Depending on how you interact with us or which Services you use, we may use personal data for the following purposes. For each purpose we state the legal basis under Article 6(1) of Regulation (EU) 2016/679 (GDPR):

Providing, personalizing and improving the Services. We use your personal data to provide services to you, in particular to process orders, conclude and perform purchase contracts, process payments, arrange delivery, send order‑ and parcel‑related information, manage customer accounts, handle complaints and returns and communicate with customers. Legal basis: performance of a contract and steps prior to entering into it (point b).
Accounting and tax. We process data on accounting documents (proforma invoice, invoice, credit note) and payment data to comply with accounting and tax laws. Legal basis: compliance with a legal obligation (point c).
Purchase reviews. After your parcel is delivered we may send you an e-mail asking you to review the purchased products and we publish the review you send us on the product page (details below). Legal basis: our legitimate interest in assessing customer satisfaction and in publishing genuine experience with products (point f).
Analytics and marketing. We measure traffic and shopping behavior on the website via Google Analytics to improve our Services. We use Google Analytics cookies and identifiers only with the consent you give in the cookie banner; without consent Google receives only the cookieless signals described in the Cookie Policy. We do not currently use third‑party advertising or remarketing tools and do not send marketing newsletters. If we introduce them in the future, we will process your personal data only in accordance with applicable law and based on an appropriate legal basis or your consent. Legal basis: consent (point a); for cookieless measurement our legitimate interest in basic traffic statistics (point f).
Security and fraud prevention. We use your personal data to verify your account, ensure secure payments and shopping, detect, investigate or take action regarding potential fraudulent, unlawful, dangerous or harmful activities and to secure our Services, including short‑term server operation logs. If you choose to use the Services and register an account, you are responsible for protecting your login credentials. Legal basis: legitimate interest (point f).
Communicating with you. We use your personal data to provide customer support, respond to your requests, handle inquiries, complaints and contract withdrawals and to maintain a business relationship with you. Legal basis: performance of a contract (point b) and legitimate interest (point f).
Legal reasons. We use your personal data to comply with applicable laws, respond to public authority requests, protect our rights and legitimate interests and to resolve potential disputes. Legal basis: compliance with a legal obligation (point c) and legitimate interest (point f).

To whom we disclose personal data

We disclose your personal data only to the extent necessary for the given purpose. Processors process it on our instructions and under a data processing agreement. The recipients are in particular:

Shopify (Shopify International Limited, Ireland) – the e-shop platform: customer accounts, cart, orders and their confirmation by e-mail, website chat. See Relationship with Shopify below.
Fakturoid s.r.o. (Czech Republic) – the accounting system in which we issue proforma invoices, invoices and credit notes. We provide your name or company name, billing address, e-mail address, company ID, tax ID and VAT ID and order details. We send you the document by e-mail ourselves.
GoPay s.r.o. (Czech Republic) – payment gateway for online payments. For an online payment we provide GoPay with your first and last name, e-mail, telephone, address, amount and order number. You enter card details directly on the GoPay page. We also offer payment by bank transfer or cash on delivery.
Fio banka, a.s. (Czech Republic) – the bank holding our account for bank transfers. We take details of received payments from the statement and match them to orders.
Carriers DPD and GLS depending on the chosen shipping method – we provide first and last name, company name where applicable, delivery address or chosen pick‑up point, telephone number, e-mail address and, for cash on delivery, the amount to be collected and the variable symbol. The carrier may notify you about the delivery by e-mail or text message. The pick‑up point map at checkout is loaded by your browser directly from the chosen carrier’s servers; the preview map of the selected point is provided by the OpenStreetMap Foundation (United Kingdom) or Google Maps.
Google (Google Ireland Limited, Ireland) – address suggestions at checkout (Google Places): the text you type into the address field and the country and language code are sent to Google by our server, without your name, e-mail or IP address; we store the selected address only in the order. Also the preview map of a pick‑up point and, with your consent, Google Analytics.
MXroute – provider of mailboxes and e-mail sending, through which we send you accounting documents, parcel information, review requests and customer support replies.
netcup GmbH (Germany) – provider of the server on which our applications and databases run.
Cloudflare, Inc. – storage of database backups with data located in the European Union; the storage encrypts the data.
If you instruct us, ask us to do so or otherwise consent to the provision of certain information to third parties.
To public authorities where required by law, and in connection with a business transaction, such as a merger, transfer of business or another similar change, or for the purpose of protecting our rights, defending against legal claims or enforcing our terms.

Purchase reviews

Approximately 7 days after your parcel is delivered we may send you one e-mail asking you to review the purchased products, with no reminders. We do not send it to customers who have unsubscribed from marketing e-mails in our store. We send it to you as an existing customer on the basis of our legitimate interest. You can opt out of further requests at any time using the link in each such e-mail; to keep the opt‑out effective we retain only a one‑way fingerprint (hash) of your e-mail address.

Reviewing is voluntary. On the product page we publish the star rating, text, pros and cons, date, product variant, review language and the name you choose (we prefill your first name and the initial of your last name; you can change it or review anonymously). Reviews are marked “Verified purchase” because a review can only be written on the basis of a real order.
We do not publish your e-mail address, order number or address. Please do not include personal data in the review text.
Reviews with 1 to 3 stars are checked before publication. We may reply to a review publicly. Reviews from the Czech and Slovak stores are shown together.
A published review stays on the product page until you ask us to remove it or to hide your name.

Heureka Overené zákazníkmi

If the Heureka Overené zákazníkmi service is enabled in our online store, your e‑mail address and order information may be passed to Heureka Group a.s. after the order is completed for the purpose of sending a satisfaction questionnaire. This processing is based on our legitimate interest in assessing customer satisfaction. You may object to this processing at any time. At the time of this update the service is not active.

Relationship with Shopify

The Services are hosted by Shopify, which processes personal data about your access to and use of the Services for the purpose of providing and improving the e‑shop services. Information you provide through the Services may be transferred to and shared with Shopify and its service providers, who may be located in countries other than the one in which you reside.

In addition, we may use certain Shopify features that involve data and information obtained from your interactions with our store to protect, develop and improve our business. In certain circumstances Shopify may be responsible for processing your personal data to the extent set out in its own terms and privacy policies.
More information about how Shopify uses personal data can be found at: https://privacy.shopify.com/en.

Customer account

If you create a customer account with us and leave “Save these details to my account” ticked at checkout, we save the company details of the order (name, company ID, tax ID, VAT ID and registered address) and a delivery address that is not yet in your address book to your account, so that we can fill them in for your next purchase. You can edit or remove the company details in your account at any time and delete addresses in your account’s address book. We keep the details for as long as the account exists or until you remove them; the legal basis is your consent given by the ticked option, which you can withdraw at any time by removing them.

Signing in with Google or Facebook

You can sign in to your customer account with a code sent to your e-mail, with Shop, or with your Google or Facebook account. Signing in with Google or Facebook is optional; you do not need an account or to sign in to make a purchase.

If you choose Google or Facebook, we redirect you to sign in with Google (Google Ireland Limited, Ireland) or Meta (Meta Platforms Ireland Limited, Ireland). The provider thus learns that you are signing in to our store and, after you confirm, passes us your name and e-mail address. We do not receive the password to your Google or Facebook account.
We use this data only to create your customer account and to sign you in to it. Legal basis: performance of a contract, i.e. keeping the account at your request (point b).
Google and Meta process the sign-in data as separate controllers under their own privacy policies (policies.google.com/privacy, www.facebook.com/privacy/policy) and may transfer it to the USA, relying on the EU–US Data Privacy Framework and standard contractual clauses.
You can remove the connection to our store at any time in your Google or Facebook account settings; you can ask us to delete your customer account as described in Your rights and options.

Third‑party websites and links

The Services may contain links to websites or other online platforms operated by third parties. If you follow links to sites that are unrelated to us and that we do not control, we recommend that you review their privacy policies and other terms. We are not responsible for the privacy, security, accuracy or reliability of information on third‑party websites.

Children’s data

The Services are not intended for children. We do not knowingly process any personal data of children under 16 years of age. Where processing is based on consent, a child under 16 cannot give it on their own. If you believe a child has provided us with personal data, please contact us using the contact details below and request deletion.

Security and retention of your data

We take reasonable technical and organizational measures to protect personal data, in particular encrypted transmission, access limited to authorized persons and backups in encrypted storage. However, please note that no method of transmission over the internet or electronic storage is 100% secure.

The period for which we retain your personal data depends on the purpose of processing:

Orders and related communication are retained for the period necessary to perform the contract, assert rights for defective performance and protect our rights, i.e. for the duration of these rights and the limitation periods.
Accounting documents and payment data are retained for the period required by accounting and tax laws, usually 10 years from the end of the year in which they were issued.
A customer account is kept until it is closed.
An unfinished order (checkout in progress) for which no payment has started is deleted no later than 7 days after its last change; an unfinished draft order in Shopify is deleted when the checkout expires and no later than after 3 days of inactivity.
Copies of e-mails sent from our system are deleted after 90 days, shipping labels after delivery and no later than after 30 days.
Server operation logs are deleted after 14 days, database backups after 30 days.
A published review stays with the product until you ask us to remove it or to hide your name. An unpublished review (awaiting approval or rejected) is deleted 2 years after it was submitted. A record of a review request is deleted 1 year after the order was delivered; if a published review remains attached to it, we remove the fingerprint of your e-mail address and the suggested name from it.
An opt‑out from review requests is kept permanently, only as a one‑way fingerprint (hash) of the e-mail address, so that you do not receive another request; the address itself is not stored with it.
Data processed on the basis of consent are kept for the duration of the consent or until its withdrawal; the lifetime of individual cookies is stated in the Cookie Policy.

Your rights and options

Depending on the circumstances, you have the following rights in relation to the processing of personal data:

Right of access to personal data. You may request information about which personal data we process about you.
Right to rectification. You may request correction of inaccurate or incomplete personal data.
Right to erasure. You may request deletion of personal data if we no longer have a legal basis for their further processing. See the Deletion of personal data page for the procedure.
Right to restriction of processing. You may request restriction of processing of personal data in cases provided for by law.
Right to data portability. In certain cases you may request transfer of personal data in a commonly used and machine‑readable format.
Right to object. If we process personal data based on legitimate interest, you may object to such processing.
Right to withdraw consent. If we process personal data based on your consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing before its withdrawal.
Right to lodge a complaint. If you believe that the processing of personal data violates legal regulations, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence. In the Slovak Republic this is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk. The lead supervisory authority for the controller is the Czech Office for Personal Data Protection, www.uoou.gov.cz.

Managing communication preferences

You can opt out of purchase review requests using the link in each such message. If we introduce marketing messages or newsletters in the future, you will be able to unsubscribe at any time in the manner specified in each such message. Even after unsubscribing we may send you non‑promotional messages, for example information about your account, orders, accounting documents, parcels, complaints or changes to terms.

Complaints

If you have comments or complaints regarding the processing of your personal data, contact us using the contact details below. We will attempt to handle your request as soon as possible.

This does not affect your right to contact a supervisory authority, in particular the Office for Personal Data Protection of the Slovak Republic or the Czech Office for Personal Data Protection.

International transfers

Our applications, databases and their backups are stored in the European Union. However, some providers, in particular Shopify, Google, Meta, Cloudflare and MXroute, may transfer, store or process your personal data outside the country where you live, including countries outside the European Economic Area (for example the USA and Canada).

If your personal data are transferred outside the European Economic Area, we rely on appropriate legal transfer mechanisms, in particular an adequacy decision (including the EU–US Data Privacy Framework), the European Commission’s standard contractual clauses, or other mechanisms recognized by applicable law.

Cookies

We use cookies and similar technologies when operating our online store. Essential cookies ensure the proper functioning of the website, cart and checkout. We use analytics and marketing cookies only with your consent, which you give, refuse or adjust in the cookie banner.

Detailed information on the use of cookies can be found in the Cookie Policy.

Changes to this privacy policy

We may update this Privacy Policy from time to time, in particular due to changes in our procedures, services used, technologies or legal requirements. The current wording of the Privacy Policy will always be published on this website.

Contact

The controller of your personal data is:

Bestio Group s.r.o.
Company ID: 24878553
Registered office: Ohrazenice 160, 262 23 Ohrazenice, Czech Republic
File number: C 445194 kept at the Municipal Court in Prague
E-mail: support@bestio.sk

If you have any questions regarding personal data protection or wish to exercise your rights under the GDPR, please contact us using the contact details above.

This Privacy Policy becomes effective on 8 October 2026.

Added to cart

Privacy Policy

Sign in to your account