Privacy Policy

Last updated: 8 October 2026

1. Who we are

BrewTaurus s.r.o., Company ID (IČO) 09676872, VAT ID CZ09676872, registered office Sanderova 1616/16, 170 00 Praha 7, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, file C 340303 (“we”), is the controller of the personal data described in this policy. For anything about your data, write to info@brewtaurus.com or to the address above.

2. What data we process and why

  • Orders and delivery — name, e-mail, phone number, billing and delivery address, chosen pickup point, ordered items and order history; company name and VAT ID for business customers. We use them to conclude and perform the purchase contract, deliver your order and handle returns and complaints. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Payments — payment method and transaction status. You enter card details directly with the payment provider; we never see or store full card numbers. Legal basis: performance of a contract.
  • Invoicing and accounting — invoice data. Legal basis: legal obligation under Czech accounting and VAT law (Art. 6(1)(c) GDPR).
  • Customer support, withdrawals and complaints — the content of your messages and forms and our replies. Legal basis: performance of a contract, legal obligation, or our legitimate interest in answering your questions (Art. 6(1)(f) GDPR).
  • E-mails about our products — if you bought from us, we may occasionally e-mail you about similar products. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) and Section 7(3) of Czech Act No. 480/2004 Coll. You can opt out at any time with the link in each such e-mail or by writing to us. If you subscribe to our newsletter without buying, the legal basis is your consent (Art. 6(1)(a) GDPR).
  • Website, cookies and advertising — device and usage data such as IP address, browser, pages viewed and interactions. Cookies that are necessary to run the shop are used on the basis of our legitimate interest. Analytics and advertising cookies and pixels (Google, Meta) are used only with your consent, which you give or refuse in the cookie banner and can withdraw at any time.
  • Security, fraud prevention and legal claims — data needed to protect the shop and to establish or defend legal claims. Legal basis: our legitimate interest.

3. Who receives your data

We share data only with providers who need it to do their job for us, under data processing agreements, or where the law requires it:

  • Shopify — online store platform, checkout and order processing;
  • card payment providers and PayPal;
  • our warehouse and fulfilment partner Fulfillment CZ s.r.o. and the order management system Base.com;
  • the carriers and pickup point networks we ship with (for example GLS, PPL, DPD, UPS, FedEx, Packeta, Raben, TopTrans and Česká pošta) — name, address, phone and e-mail for delivery and delivery notifications;
  • the pickup point selection app used at checkout;
  • our invoicing software (Fakturoid) and external accountant;
  • Google and Meta for analytics and advertising, only with your consent;
  • public authorities where the law requires it.

4. Transfers outside the EEA

Some providers, such as Shopify, Google and Meta, also process data in Canada, the United States or other countries outside the European Economic Area. These transfers rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework) or on standard contractual clauses.

5. How long we keep data

  • order and contract data — for the duration of the contract and then until the limitation periods for possible claims expire;
  • invoices and accounting records — 10 years, as required by Czech VAT law;
  • marketing e-mails — until you opt out or withdraw your consent;
  • cookies — as set out in the cookie banner.

6. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing based on legitimate interest — including at any time to direct marketing. Where processing is based on consent, you can withdraw it at any time; this does not affect processing carried out before. Write to info@brewtaurus.com; we reply within one month.

You can also lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 727/27, 170 00 Praha 7, Czech Republic, uoou.gov.cz, or with the data protection authority of the EU country where you live.

7. Automated decisions

We do not make decisions with legal or similarly significant effects solely by automated means. Shopify runs automated fraud checks on payments, for example by temporarily blocking IP addresses or cards after repeated failed transactions.

8. Children

Our products are intended for adults. We do not knowingly collect personal data from persons under 18.

9. Changes

We update this policy when our processing changes. The date at the top shows the current version.