Privacy policy

Last updated: 27 October 2026

1. Who we are

BrewTaurus s.r.o., Company ID (IČO) 09676872, VAT ID CZ09676872, registered office Sanderova 1616/16, 170 00 Praha 7, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, file C 340303 (“we”), is the controller of the personal data described in this policy. For anything about your data, write to info@brewtaurus.com or to the address above.

2. What data we process and why

  • Orders and delivery — name, e-mail, phone number, billing and delivery address, chosen pickup point, ordered items and order history; company name and VAT ID for business customers. We use them to conclude and perform the purchase contract, deliver your order and handle returns and complaints. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Payments — payment method and transaction status. You enter card details directly with the payment provider; we never see or store full card numbers. Legal basis: performance of a contract.
  • Invoicing and accounting — invoice data. Legal basis: legal obligation under Czech accounting and VAT law (Art. 6(1)(c) GDPR).
  • Customer support, withdrawals and complaints — the content of your messages and forms and our replies. Legal basis: performance of a contract, legal obligation, or our legitimate interest in answering your questions (Art. 6(1)(f) GDPR).
  • E-mails about our products — if you bought from us, we may occasionally e-mail you about similar products. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) and Section 7(3) of Czech Act No. 480/2004 Coll. You can opt out at any time with the link in each such e-mail or by writing to us. If you subscribe to our newsletter without buying, the legal basis is your consent (Art. 6(1)(a) GDPR).
  • Website, cookies and advertising — device and usage data such as IP address, browser, pages viewed and interactions. Cookies that are necessary to run the shop are used on the basis of our legitimate interest. Analytics and advertising cookies and pixels (Google, Meta) are used only with your consent, which you give or refuse in the cookie banner and can withdraw at any time.
  • Security, fraud prevention and legal claims — data needed to protect the shop and to establish or defend legal claims. Legal basis: our legitimate interest.

3. Who receives your data

We share data only with providers who need it to do their job for us, under data processing agreements, or where the law requires it:

  • Shopify — online store platform, checkout and order processing;
  • card payment providers and PayPal;
  • our warehouse and fulfilment partner Fulfillment CZ s.r.o. and the order management system Base.com;
  • the carriers and pickup point networks we ship with (for example GLS, PPL, DPD, UPS, FedEx, Packeta, Raben, TopTrans and Česká pošta) — name, address, phone and e-mail for delivery and delivery notifications;
  • the pickup point selection app used at checkout;
  • our invoicing software (Fakturoid) and external accountant;
  • Lovable (hosting of the BrewTaurus Crew loyalty service) and its database provider Supabase — only the Crew data described in section 9;
  • Google and Meta for analytics and advertising, only with your consent;
  • public authorities where the law requires it.

4. Transfers outside the EEA

Some providers, such as Shopify, Google and Meta, also process data in Canada, the United States or other countries outside the European Economic Area. These transfers rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework) or on standard contractual clauses.

The BrewTaurus Crew loyalty service and its database are hosted by Lovable and Supabase in the United States (Amazon Web Services, region us-west-2). This transfer relies on the standard contractual clauses included in our data processing agreements with these providers. Only the Crew data described in section 9 is stored there.

5. How long we keep data

  • order and contract data — for the duration of the contract and then until the limitation periods for possible claims expire;
  • invoices and accounting records — 10 years, as required by Czech VAT law;
  • marketing e-mails — until you opt out or withdraw your consent;
  • cookies — as set out in the cookie banner.

6. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing based on legitimate interest — including at any time to direct marketing. Where processing is based on consent, you can withdraw it at any time; this does not affect processing carried out before. Write to info@brewtaurus.com; we reply within one month.

You can also lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 727/27, 170 00 Praha 7, Czech Republic, uoou.gov.cz, or with the data protection authority of the EU country where you live.

7. Automated decisions

We do not make decisions with legal or similarly significant effects solely by automated means. Shopify runs automated fraud checks on payments, for example by temporarily blocking IP addresses or cards after repeated failed transactions.

8. Children

Our products are intended for adults. We do not knowingly collect personal data from persons under 18.

9. BrewTaurus Crew (loyalty points)

What we do. Every customer account on brewtaurus.com takes part in BrewTaurus Crew, our loyalty programme. We calculate points from your paid orders, show them to you after you log in, and let you exchange them for rewards. The rules are at brewtaurus.com/pages/crew.

What data we use. For Crew we process your customer ID and order IDs from our shop system (Shopify), the dates, amounts, shipping and refund status of your orders, the points calculated from them, and the rewards you redeem. The Crew service stores only these numeric identifiers and amounts; it does not store your name, e-mail or address, which stay in the shop system under the rest of this policy. When you choose to fill in your brewery profile, we also store what you enter there.

Why we are allowed to. Calculating and showing your points, issuing rewards and sending you service e-mails about your balance is performance of the Crew rules you join by using your account (Art. 6(1)(b) GDPR). Counting orders from the 24 months before Crew started is based on our legitimate interest in rewarding existing customers equally with new ones (Art. 6(1)(f) GDPR); nothing is calculated until you log in, and you can object at any time by leaving Crew. Marketing e-mails about Crew are sent only with your consent or, as an existing customer, with an unsubscribe link in every message.

Who sees it. The Crew service runs on infrastructure provided by Lovable and its database provider Supabase in the United States (see section 4); they process the data on our behalf under data processing agreements. Point balances are also stored in your Shopify customer record so they can be shown in the shop. No other third party receives Crew data.

How long. We keep Crew data for as long as your account takes part in Crew and for 24 months after the last change to your points, so that returns and disputes can still be settled. Technical logs of requests to the Crew service are kept for 90 days.

Your rights. You can leave Crew at any time by writing to info@brewtaurus.com; we remove you from Crew and delete your points data. Your other rights under section 6 apply to Crew data as well.

10. Changes

We update this policy when our processing changes. The date at the top shows the current version.