Privacy Policy

This policy describes what personal data we, as the controller, process in connection with the operation of the online shop www.lafemmemimi.com, for what purpose, on what legal basis, how long we keep it and what rights you have. Processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Czech Act No. 110/2019 Coll., on personal data processing.

1. Who is the data controller

La femme MiMi s.r.o.
Registered office: Štěpánská 630/53, Nové Město, 110 00 Prague 1, Czech Republic
Company ID (IČO): 28530284, VAT ID (DIČ): CZ28530284
Registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 148305.

Contact for personal data matters:
E-mail: mimi@lafemmemimi.com
Phone: +420 775 665 387

We have not appointed a data protection officer — we are not legally required to do so.

2. What data we process and why

Processing your order and performance of the purchase contract

Delivery of goods, communication about the order, handling of complaints.
Data: first and last name, e-mail, phone, billing and delivery address, for businesses the company ID and VAT ID, order content and value, chosen delivery and payment method, IP address.
Legal basis: performance of a contract — Art. 6(1)(b) GDPR.
Retention: for the duration of the contract and further for the warranty and complaint period (24 months); completed orders are then anonymised, at the latest within 36 months of completion. Incomplete orders are removed sooner — pending and failed within 30 days, cancelled and refunded within 6 months. Data on tax documents is kept for the statutory period (see below) regardless.

Bookkeeping and compliance with tax obligations

Issuing and archiving invoices and tax documents.
Data: billing details, payment data, order content.
Legal basis: compliance with a legal obligation — Art. 6(1)(c) GDPR.
Retention: tax documents for 10 years (Act No. 235/2004 Coll., on VAT; Act No. 563/1991 Coll., on accounting).

Customer account

If created — to make future purchases easier.
Data: e-mail, password in encrypted form, addresses, order history.
Legal basis: consent and performance of a contract — Art. 6(1)(a) and (b) GDPR.
Retention: until the account is deleted; inactive accounts are deleted after 12 months of inactivity.

Sending the newsletter

Sending news and offers by e-mail.
Data: e-mail address.
Legal basis: consent — Art. 6(1)(a) GDPR.
Retention: until consent is withdrawn (unsubscribed).

Customer support and communication

Handling enquiries sent by e-mail.
Data: e-mail, content of the communication, and any other data you provide us.
Legal basis: legitimate interest — Art. 6(1)(f) GDPR.
Retention: for the time necessary to handle and document the matter.

Operation, security and website analytics

Data: IP address, device and browsing data, cookies.
Legal basis: legitimate interest for operation and security, consent for analytical and marketing cookies — Art. 6(1)(f) and (a) GDPR.
Retention: depending on the type of cookie — see section 6.

Providing data for order fulfilment and bookkeeping is a necessary requirement for entering into and performing the contract; without it, the order cannot be processed. Providing your e-mail for the newsletter is voluntary.

3. Where we obtain the data

We obtain personal data directly from you — when you place an order, register an account, subscribe to the newsletter or communicate with us. Some technical data (IP address, cookies) is created automatically when you visit the website.

4. Who we share the data with

We share your data only to the necessary extent with the following recipients:

• Carriers — for delivery of goods: Packeta Group a.s. (Zásilkovna) and DHL Express.
• Payment gateway provider — for card payment processing: Československá obchodní banka, a.s. (ČSOB). For older orders, the WooCommerce Payments provider (Stripe).
• Website management and hosting provider — značkárna s.r.o.
• E-mail delivery provider — Postmark (transactional order e-mails).
• External accountant — Jitka Procházková, for bookkeeping and processing of tax documents.
• Newsletter distribution tool — ActiveCampaign (ActiveCampaign, LLC).
• Analytics and marketing tools (based on your cookie consent): Google Ireland Limited (Google Tag Manager, Google Analytics, Google Ads) and Meta Platforms Ireland Limited (Facebook / Instagram pixel).

We do not share the data with anyone else and we do not sell it.

5. Transfers to third countries

Some recipients (in particular Google, Meta, Postmark and ActiveCampaign) may process data outside the European Economic Area, for example in the USA. In such cases the transfer is safeguarded by appropriate guarantees under the GDPR — the European Commission’s standard contractual clauses, or the EU–US Data Privacy Framework.

6. Cookies and website analytics

The website uses cookies — necessary (for the functioning of the website, cart and checkout), analytical (traffic measurement) and marketing (remarketing). We use necessary cookies on the basis of legitimate interest; analytical and marketing cookies only with your consent, which you give in the cookie bar when entering the website.

You can change or withdraw your consent at any time here:

7. Automated decision-making and profiling

We do not carry out automated decision-making that would have legal effects for you. Within marketing cookies, based on your consent, relevant advertising may be displayed (remarketing); this processing has no legal or similarly significant impact on you.

8. Your rights

In relation to your personal data you have the right:

• of access to the data and information about its processing,
• to rectification of inaccurate data or completion of incomplete data,
• to erasure (“right to be forgotten”), unless our legal obligations prevent it (e.g. archiving of tax documents),
• to restriction of processing,
• to data portability,
• to object to processing based on legitimate interest,
• to withdraw consent (for the newsletter and cookies) — withdrawal does not affect the lawfulness of processing before withdrawal,
• to lodge a complaint with the supervisory authority.

9. How to exercise your rights

Contact us at any time at mimi@lafemmemimi.com. We will handle your request without undue delay, at the latest within one month. You can unsubscribe from the newsletter at any time using the link in every e-mail sent.

10. Supervisory authority

You have the right to lodge a complaint with the supervisory authority:
Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 727/27, 170 00 Prague 7-Holešovice, Czech Republic
www.uoou.gov.cz

11. Changes to this policy

We may update this policy, for example when the tools we use or legal regulations change. The current version is always available on this page.

Effective from: 1 July 2026