Privacy Policy

CAPPALI – Online Store

Effective date: 30 October 2026

At CAPPALI, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, purchase our products, create a customer account or communicate with us.

We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), applicable Czech data protection legislation and other relevant European Union laws.

1. Data Controller

The controller responsible for processing your personal data is:

Business Name: MgA. Tomáš Vacek
Brand: CAPPALI
Company Identification Number (IČO): 87382440
Registered Address: Na Výsluní 464, 561 64 Jablonné nad Orlicí, Czech Republic
Email: cappali@cappali.com
Phone: +420 737 120 484
Website: https://www.cappali.com

Hereinafter referred to as "CAPPALI", "we", "us" or the "Data Controller".

For any questions regarding the processing of your personal data, please contact us using the details above.

2. Personal Data We Collect

We collect and process personal data only to the extent necessary for legitimate business purposes, the performance of contractual obligations, compliance with applicable laws and other purposes described in this Policy.

Depending on how you interact with our website, we may process the following categories of personal data.

2.1 Identification and Contact Information

First and last name.
Academic title, if provided.
Billing and delivery addresses.
Email address and telephone number.
Company name, Company Identification Number (IČO) and VAT number, where applicable.

2.2 Order and Transaction Information

Purchased products and order history.
Order numbers, transaction dates and amounts.
Payment status and transaction references.
Shipping and delivery information.
Information relating to returns, complaints and refunds.

Payment transactions are processed through supported payment service providers. CAPPALI does not need to receive or store complete payment card details in order to process standard online payments.

2.3 Customer Account Information

If you create a customer account, we may process your login identifier, account preferences, saved addresses and order history.

2.4 Technical and Website Usage Information

When you visit our website, certain technical information may be collected automatically, including:

IP address.
Browser and device information.
Operating system and approximate geographic location derived from technical data.
Website interactions and browsing activity.
Cookie identifiers and similar technical identifiers.
Information about your privacy preferences.

The collection and use of non-essential tracking information depends on applicable consent requirements and your privacy choices.

2.5 Communication Information

When you contact us, we may process your contact details, correspondence, enquiries and any information voluntarily provided in connection with customer support, orders or complaints.

We do not require special categories of personal data, such as information about health, religious beliefs or political opinions, for ordinary purchases.

3. Purposes and Legal Bases for Processing

We process personal data only where a valid legal basis exists under Article 6 of the GDPR.

3.1 Processing and Fulfilling Orders

Purpose: To process purchases, receive payments, arrange deliveries, manage customer accounts and communicate regarding orders.

Legal basis: Article 6(1)(b) GDPR – performance of a contract or steps taken before entering into a contract.

3.2 Compliance with Legal Obligations

Purpose: To maintain accounting records, comply with tax and other statutory obligations and fulfil legally required consumer protection procedures.

Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation.

3.3 Customer Support and Complaints

Purpose: To answer customer enquiries, process returns, resolve complaints and maintain relevant correspondence.

Legal basis: Article 6(1)(b), 6(1)(c) or 6(1)(f) GDPR, depending on the circumstances.

3.4 Protection of Legitimate Business Interests

Purpose: To protect our website, prevent fraud, maintain technical security, manage business operations and establish, exercise or defend legal claims.

Legal basis: Article 6(1)(f) GDPR – legitimate interests, provided these interests are not overridden by the rights and freedoms of the individuals concerned.

3.5 Marketing and Newsletters

Purpose: To send information about new collections, product launches, design projects, special offers and other CAPPALI news.

Legal basis:

Article 6(1)(a) GDPR – consent, where required.
Article 6(1)(f) GDPR – legitimate interests, where permitted for marketing our own similar products to existing customers and subject to the conditions of applicable electronic marketing laws.

You may unsubscribe from marketing communications at any time using the unsubscribe link included in our emails or by contacting us directly.

3.6 Website Analytics and Advertising

Purpose: To understand website performance, improve the shopping experience, measure advertising effectiveness and, where permitted, display relevant advertising.

Legal basis: Article 6(1)(a) GDPR – consent, where required, or another applicable legal basis for processing that does not require consent.

Non-essential cookies and similar tracking technologies are used only in accordance with applicable consent requirements.

4. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to support its operation, remember preferences and, where enabled, provide analytics and marketing functionality.

Cookies may be divided into the following categories:

4.1 Strictly Necessary Cookies

These cookies are essential for the operation of the online store, including shopping cart functionality, checkout, security and customer authentication.

They do not require consent where they are strictly necessary to provide a service requested by the user.

4.2 Functional Cookies

These technologies may help remember preferences such as language, region or other selected settings.

Consent is requested where required by applicable law.

4.3 Analytics Cookies

Where enabled, analytics technologies help us understand how visitors interact with the website and identify opportunities for improvement.

Non-essential analytics cookies are activated only after the required consent has been obtained.

4.4 Marketing Cookies

Where enabled, marketing technologies may be used to measure advertising performance, understand campaign interactions and display more relevant advertisements.

These technologies are subject to applicable consent requirements.

4.5 Managing Cookie Preferences

Where non-essential cookies are used, visitors are provided with appropriate options to accept, reject or manage these technologies.

Consent may be withdrawn or changed at any time through the cookie preference controls provided on the website.

Further information about individual cookies, their purposes, providers and retention periods should be available through the website's cookie management interface or accompanying cookie information.

5. Email Marketing and Consent

If you subscribe to the CAPPALI newsletter, we may use your email address to send updates about our products, collections, events and design-related news.

Where marketing is based on consent:

Providing consent is voluntary.
Consent is not a condition for purchasing products.
You may withdraw consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Where permitted by applicable Czech law, we may send information about our own similar products to existing customers whose contact details were obtained in connection with a sale, provided all statutory conditions are met.

Such customers are given a clear opportunity to opt out when their contact information is collected and in each subsequent marketing communication.

We do not use customer contact information to send promotional communications on behalf of unrelated third parties without an appropriate legal basis.

6. Shopify and Third-Party Service Providers

The CAPPALI online store is hosted on the Shopify e-commerce platform.

Shopify provides services supporting website operation, online shopping, checkout, order management, customer accounts and other e-commerce functions.

When customers visit or make purchases through our store, Shopify processes personal data as necessary to provide these services.

Depending on the services and settings enabled, Shopify may also process information for security, analytics, personalisation, fraud prevention and enhanced commerce features, including services informed by customer interactions with Shopify and other merchants.

For further information about Shopify's processing practices, please review:

Shopify Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/consumers

Shopify Privacy Portal:
https://privacy.shopify.com

We may also share personal data with the following categories of service providers where necessary:

Payment processing providers.
Shipping and logistics companies.
Accounting and tax service providers.
Website hosting and IT service providers.
Customer support and communication services.
Email marketing platforms.
Analytics and advertising providers, where applicable.
Legal or professional advisers.
Public authorities where disclosure is legally required.

We share only information reasonably necessary for the relevant purpose.

Depending on their role, third parties may act as data processors under appropriate contractual arrangements or as independent data controllers subject to their own legal obligations.

7. International Transfers of Personal Data

Certain technology providers and service partners may process or access personal data outside the European Economic Area (EEA).

Where personal data is transferred to countries outside the EEA, we take steps to ensure that the transfer complies with Chapter V of the GDPR.

Depending on the recipient and destination, appropriate mechanisms may include:

An adequacy decision issued by the European Commission.
Standard Contractual Clauses approved by the European Commission.
Other safeguards or transfer mechanisms permitted under applicable law.

Where relevant, supplementary technical and organisational measures may also be applied.

Information regarding applicable safeguards and relevant international transfers may be requested by contacting us at cappali@cappali.com.

8. Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, comply with applicable legal obligations or protect legitimate legal interests.

Retention periods depend on the type of information and the legal basis for processing.

8.1 Order and Accounting Records

Order information, invoices and related accounting documents are retained for the periods required by applicable Czech accounting, tax and other legislation.

Depending on the type of document and applicable legal requirements, statutory retention periods may differ.

8.2 Customer Account Information

Customer account information is generally retained while the account remains active and for any additional period necessary to comply with legal obligations or resolve outstanding matters.

8.3 Marketing Information

Personal data used for consent-based marketing is retained until consent is withdrawn or the information is no longer necessary for the relevant purpose.

Limited records may be retained where necessary to demonstrate compliance with legal obligations or respect previous unsubscribe requests.

8.4 Customer Correspondence

Customer communications are retained for the period necessary to respond to enquiries, resolve complaints and protect legitimate legal interests.

8.5 Technical Data and Cookies

Technical information and cookie identifiers are retained according to their purposes, the applicable legal requirements and the retention periods disclosed through the relevant cookie information or service settings.

When personal data is no longer required, it is deleted, anonymised or otherwise processed in accordance with applicable law.

9. Security of Personal Data

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, misuse, alteration or unlawful disclosure.

These measures may include:

Restricted access to customer information.
Secure account authentication.
Encryption and secure communication technologies.
Use of reputable e-commerce and payment service providers.
Appropriate confidentiality and access management procedures.
Regular review of relevant security practices.

Access to personal data is limited to individuals and service providers who need the information for authorised purposes.

Although we take reasonable steps to protect personal data, no electronic system can guarantee absolute security.

10. Your Rights Under GDPR

Subject to the conditions and limitations provided by applicable law, you have the following rights.

Right of Access
You may request confirmation of whether we process your personal data and obtain access to the relevant information.

Right to Rectification
You may request correction of inaccurate or incomplete personal data.

Right to Erasure
You may request deletion of your personal data where the legal conditions for erasure are met.

Right to Restriction of Processing
You may request that we restrict the processing of your personal data in certain circumstances.

Right to Data Portability
Where the legal requirements are met, you may receive certain personal data in a structured, commonly used and machine-readable format or request its transfer to another controller.

Right to Object
You may object to processing based on legitimate interests. You have the right to object at any time to the processing of your personal data for direct marketing purposes.

Right to Withdraw Consent
Where processing is based on consent, you may withdraw that consent at any time.

Right Regarding Automated Decision-Making
You have the rights provided by Article 22 GDPR in relation to qualifying decisions based solely on automated processing.

Right to Lodge a Complaint
If you believe that your personal data has been processed unlawfully, you may lodge a complaint with the competent supervisory authority.

In the Czech Republic, the supervisory authority is:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27
170 00 Prague 7
Czech Republic

Website: https://uoou.gov.cz

11. How to Exercise Your Rights

To exercise your rights or submit a privacy-related request, please contact:

Email: cappali@cappali.com

Mailing Address:
MgA. Tomáš Vacek – CAPPALI
Na Výsluní 464
561 64 Jablonné nad Orlicí
Czech Republic

We will respond without undue delay and generally within one month of receiving your request.

Where legally permitted and necessary due to the complexity or number of requests, this period may be extended by up to two additional months. You will be informed of any extension and the reasons for it.

Where necessary, we may request reasonable additional information to verify your identity before disclosing or modifying personal data.

Exercising your rights is generally free of charge, subject to exceptions permitted by the GDPR.

12. Automated Decision-Making and Profiling

CAPPALI does not use customer personal data to make solely automated decisions that produce legal effects or similarly significant effects on individuals as part of its ordinary retail decision-making.

Automated tools used by our e-commerce platform or service providers may assist with security checks, fraud prevention, analytics or other operational functions.

Where profiling or automated processing is carried out for analytics, advertising or personalisation, it is subject to the applicable legal basis, transparency requirements and relevant privacy preferences.

If any processing qualifies as automated decision-making under Article 22 GDPR, the applicable statutory safeguards and rights will be respected.

13. Providing Personal Data

Certain personal data is necessary to conclude and fulfil a purchase agreement, including identification, contact, delivery and payment-related information.

If the required information is not provided, we may be unable to process an order or deliver the purchased products.

Providing information for optional purposes, such as subscribing to a newsletter, is voluntary.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our business activities, technological services or applicable legal requirements.

The current version will always be made available on our website.

Where required by applicable law, we will provide additional notice of significant changes affecting the processing of personal data.

Changes will not retrospectively alter the legal basis of processing already carried out.

15. Contact Information

If you have questions about this Privacy Policy or how CAPPALI handles personal data, please contact us.

CAPPALI
MgA. Tomáš Vacek
Na Výsluní 464
561 64 Jablonné nad Orlicí
Czech Republic

Email: cappali@cappali.com
Phone: +420 737 120 484
Website: www.cappali.com