Typical categories

• Contact details Name, email address, and message details when you contact the project directly.
• Order and billing data Name, billing address, email, phone if provided, ordered products, order history, and invoices.
• Customer account Login name, password stored only in hashed form, and saved addresses, if you create an account.
• Payment information Payments are handled by the payment provider. MAYAN ALFA only sees the payment status and never stores full card numbers.
• Technical access data IP address, browser information, and server logs required for site delivery, security, and diagnostics.

What the site is not built for

• No advertising tracking The site does not use advertising trackers or remarketing systems in the current public model.
• No behavioural profiling The project does not build public behavioural profiles of visitors.
• No selling of data Personal data is never sold, rented, or shared for marketing purposes.
• No unnecessary collection Only data needed for the purposes described on this page is requested.

Contract

Art. 6(1)(b): processing orders, delivering eBooks and archive access, managing customer accounts, and answering questions before a purchase.

Legal obligation

Art. 6(1)(c): issuing invoices and keeping accounting and tax records as required by Czech law.

Legitimate interest

Art. 6(1)(f): website security, server logs, prevention of fraud and abuse, answering general messages, and defending legal claims.

Consent

Art. 6(1)(a): only where consent is requested separately, for example a future newsletter. Consent can be withdrawn at any time.

Service providers

• Web hosting Stores the website, the store database, and server logs.
• Payment providers Process card and online payments for orders.
• Email delivery Sends order confirmations and correspondence.
• Automattic (Jetpack / WordPress.com) Delivers images through its content network. Transfers outside the EU rely on safeguards such as the EU–U.S. Data Privacy Framework or standard contractual clauses.
• Accountant or tax adviser Receives invoices and accounting records where required by law.

Retention periods

• Orders and invoices For the period required by Czech accounting and tax law, up to 10 years.
• Customer accounts Until you delete the account or ask for deletion, except data that must be kept for completed orders.
• Messages As long as needed to handle the matter, and no longer than 3 years after the last contact.
• Server and security logs Short term, usually a few weeks to a few months.

Basic rights

• Access You may ask what personal data is held about you.
• Correction You may request correction of inaccurate or incomplete information.
• Deletion or restriction You may request deletion or restricted processing where legally appropriate.
• Objection You may object to processing based on legitimate interest.
• Portability You may receive data you provided for an order or account in a structured, machine-readable format.
• Withdrawal of consent Where processing is based on consent, you may withdraw it at any time.

Complaint route

You may contact the Czech Data Protection Authority (ÚOOÚ) if you want to file a complaint about personal data processing.