Privacy Policy

TEMPLATE – NOT LEGALLY REVIEWED. This text is a draft template and must be reviewed and completed by a qualified lawyer before publication. Replace all placeholders in [SQUARE BRACKETS] and delete this box.

Privacy Policy

Last updated: [DATE]

1. Who is responsible for your data (controller)

The controller of personal data processed through the online shop kodi-professional.eu is:
[COMPANY NAME]
[ADDRESS]
Company registration number: [REG. NUMBER], VAT ID: [VAT ID]
E-mail: [EMAIL]
Telephone: [PHONE]

Data Protection Officer (if appointed): [DPO] – [DPO EMAIL]

2. What data we process, why and on what legal basis

Purpose	Data	Legal basis (GDPR)	Storage period
Processing and delivering orders, payment, returns, invoices	Name, delivery and billing address, e-mail, telephone, order contents, payment status (card data is processed only by the payment provider)	Art. 6(1)(b) – performance of a contract; Art. 6(1)(c) – legal obligations (tax/accounting)	For the duration of the contract, then as required by tax and accounting law ([e.g. 10] years)
Customer account	Name, e-mail, telephone, password (hashed), addresses, order history, wishlist	Art. 6(1)(b)	Until you delete the account or ask us to delete it
Customer service (contact form, call-back request, chat, e-mail)	Name, contact details, content of your message	Art. 6(1)(b) or Art. 6(1)(f) – legitimate interest in answering enquiries	[e.g. 24 months] after the enquiry is closed
Newsletter and marketing e-mails	E-mail, selected interests, subscription date, opening/click statistics	Art. 6(1)(a) – consent (you can withdraw it at any time via the unsubscribe link)	Until you unsubscribe
Product reviews	Name/nickname, review text, rating	Art. 6(1)(a)/(f)	While the review is published
Operating and securing the website (server logs, session, fraud prevention)	IP address, browser data, date and time of access, pages visited	Art. 6(1)(f) – legitimate interest in a secure, working website	Logs: [e.g. 30 days]
Web analytics	Pseudonymous usage data, cookie IDs	Art. 6(1)(a) – consent via cookie banner	See Cookie Policy
Advertising and remarketing	Cookie IDs, pages viewed, products in cart, purchases	Art. 6(1)(a) – consent via cookie banner	See Cookie Policy

Providing personal data is necessary for concluding a purchase contract. Without it we cannot process your order. We do not use automated decision-making or profiling that produces legal effects for you.

3. Recipients and processors

We share personal data only where necessary with the following categories of recipients. Processors act on our instructions under a data processing agreement (Art. 28 GDPR):

Hosting and IT: [HOSTING PROVIDER], Cloudflare, Inc. (CDN/security)
Payment providers: [e.g. myPOS Europe Ltd.] – independent controllers for payment data
Shipping companies: [e.g. DHL, DPD, GLS, Nova Post] – for delivery
E-mail and marketing platform: eSputnik ([ESPUTNIK LEGAL ENTITY])
Customer chat / CRM: KeyCRM ([LEGAL ENTITY])
Analytics and advertising (only with consent): Google Ireland Ltd. (Google Analytics 4, Google Ads, Google Tag Manager, YouTube), Meta Platforms Ireland Ltd. (Meta Pixel), Hotjar Ltd.
Accounting and tax advisers, authorities where required by law

4. Transfers outside the EU/EEA

Some providers (e.g. Google, Meta, Cloudflare) may process data in the USA or other third countries. Such transfers take place on the basis of an adequacy decision (e.g. EU–US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses (Art. 46 GDPR). [LIST ANY OTHER THIRD COUNTRIES, e.g. Ukraine for eSputnik/KeyCRM, and the safeguard used.]

5. Cookies

We use strictly necessary cookies and, only with your consent, analytics and marketing cookies. Details and the option to change your choice at any time are in our Cookie Policy and under “Cookie settings” at the bottom of every page.

6. Your rights

You have the right to:

access your data (Art. 15 GDPR) and receive a copy;
rectification of inaccurate data (Art. 16);
erasure (Art. 17) and restriction of processing (Art. 18);
data portability (Art. 20);
object to processing based on legitimate interest or for direct marketing (Art. 21);
withdraw consent at any time with effect for the future (Art. 7(3));
lodge a complaint with a supervisory authority, e.g. [SUPERVISORY AUTHORITY, e.g. Commissioner for Personal Data Protection, Cyprus – www.dataprotection.gov.cy] or the authority of your place of residence.

You can request an export of your data or the deletion of your account online on the page “My personal data (GDPR)”, or by e-mail to [EMAIL]. We answer within one month.