Skip to content
0

Privacy notice

What we collect, why we need it, who sees it and what you can ask us to do.

Who is responsible

Bright Valley s.r.o., Podskalská 1512/22, Nové Město, 128 00 Prague 2, Czech Republic, is the controller of your personal data: the company that decides why and how it is used. Email: support@oodlemart.com.

For questions about your personal data: support@oodlemart.com

What we collect, why, and on what legal basis

We collect only what we need for the purpose named. “GDPR” is the General Data Protection Regulation of the EU; the article named with each purpose is its legal basis.

When you visit the shop

What:
Your IP address, the date and time, the pages you open, and the kind of browser and device you use. Cookies remember your delivery country, language, currency and cookie choice.
Why:
To show you the shop, keep it running and protect it against attacks and misuse.
Legal basis:
Our legitimate interest in a working and secure shop (GDPR art. 6(1)(f)). The cookies are strictly necessary; see the cookie policy.

When you put something in your bag

What:
The products in your bag, linked to a cookie on your device. No name is attached until you check out or sign in.
Why:
To keep your bag while you shop.
Legal basis:
Steps taken at your request before a contract (GDPR art. 6(1)(b)).

When you order

What:
Your name, delivery and billing address, email address and phone number; the products, prices and delivery you chose; whether the payment succeeded.
Why:
To conclude and carry out the contract: confirm your order, have it packed and delivered, tell you how it is getting on, and handle returns, withdrawals and guarantee claims.
Legal basis:
Performance of the contract (GDPR art. 6(1)(b)).

We also use this data to issue invoices and keep accounting records, which is a legal obligation (GDPR art. 6(1)(c)).

And we use it to prevent fraud and misuse of the shop, which is our legitimate interest in secure payments and a secure shop (GDPR art. 6(1)(f)).

When you pay

What:
You enter your card or account details on the payment provider's own page. We receive a confirmation and a reference for the payment, not your card details.
Why:
To take the payment for your order.
Legal basis:
Performance of the contract (GDPR art. 6(1)(b)).

If you create an account

What:
Your name, email address, your password in a scrambled form that cannot be read, your saved addresses and your orders.
Why:
So that you can sign in, see your orders and check out faster.
Legal basis:
Performance of the agreement on your account (GDPR art. 6(1)(b)).

When you write to us

What:
Your name, email address, your message, and the order number if you give one.
Why:
To answer you and deal with your request.
Legal basis:
Performance of the contract when your message is about an order (GDPR art. 6(1)(b)); otherwise our legitimate interest in answering enquiries (GDPR art. 6(1)(f)).

When you withdraw from a contract

What:
Your name, email address, order number, the products you name, and the date and time of your statement.
Why:
To process your withdrawal, confirm it to you and be able to show when it was made.
Legal basis:
A legal obligation (GDPR art. 6(1)(c)) and performance of the contract (GDPR art. 6(1)(b)).

When you use your data protection rights

What:
Your email address and your request.
Why:
To answer your request and be able to show that we did.
Legal basis:
A legal obligation (GDPR art. 6(1)(c)).

Offers and news by email

What:
Your name and email address.
Why:
To send you offers and news, only if you asked for them.
Legal basis:
Your consent (GDPR art. 6(1)(a)). You can withdraw it at any time with the link in each email or in your account.

Statistics and marketing cookies

What:
Which pages you view and what you do in the shop, linked to an identifier stored in a cookie.
Why:
To measure how the shop is used and to show you relevant advertising on other websites.
Legal basis:
Your consent (GDPR art. 6(1)(a)), given in the cookie settings. Without it these tools are not loaded.

Data we do not get from you

The payment provider tells us whether your payment succeeded. Our supplier and the carriers tell us when your parcel was sent and delivered. If someone orders a delivery to you, that person gives us your name, address and phone number.

We do not sell your data.

Who receives your data

We pass on only what each recipient needs for its task:

  • BigBuy (Spain), our supplier, which stores, packs and ships the products, and the parcel carriers that deliver them: your name, delivery address, phone number and email address;
  • Our payment service provider, which processes your payment;
  • Contabo GmbH (Germany), with our server in France, which hosts this website and its database;
  • Our own mail server, hosted by Contabo GmbH in France, which delivers our emails to you;
  • public authorities, where the law obliges us to, for example tax authorities.

Companies that work on our behalf may use your data only as we instruct them.

Transfers outside the European Economic Area

Our supplier and the carriers process your data inside the European Economic Area (EEA).

Our payment, hosting and email providers: hosting and email stay inside the EU (France). The payment provider is named here once online payment is switched on, together with any transfer outside the EEA and its safeguard.

Statistics and marketing tools could send data to the United States. The shop does not use such tools at the moment.

How long we keep your data

  • Orders and invoices: 10 years, as the tax and commercial law of our country requires.
  • Your account, with your saved addresses: until you delete it or ask us to. Orders placed with it are kept as stated above.
  • A bag you did not check out: the cookie that links it to your device expires after 7 days.
  • Messages you send us, and our replies: 2 years after the last message.
  • Withdrawal statements: as long as the records of the order they belong to.
  • Requests about your personal data: 2 years after the last message.
  • Server logs: up to 52 days.
  • Cookies: as listed in the cookie policy.
  • Your consent to offers by email: until you withdraw it.

Your rights

Under the GDPR you have the right to:

  • get confirmation of whether we process data about you, and a copy of it (access);
  • have wrong or incomplete data corrected (rectification);
  • have your data deleted where the law provides for it, for example when it is no longer needed (erasure);
  • have the use of your data restricted in certain cases (restriction);
  • receive the data you gave us in a common, machine-readable format, or have it passed on to another company (portability);
  • object, for reasons arising from your particular situation, to processing that we base on a legitimate interest, and object at any time to the use of your data for direct marketing (objection);
  • withdraw a consent you gave, at any time; this does not affect what was done before you withdrew it;
  • complain to a data protection authority, in particular in the country where you live or work. The authority responsible for us is: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), uoou.gov.cz.

How to use your rights: if you have an account, open your profile, where “Your data” lets you download a copy of your data or ask us to delete your account. Otherwise write to support@oodlemart.com. We answer within one month. If we are not sure who is asking, we may first ask you to confirm who you are.

You can change your cookie choice at any time in the cookie settings, at the bottom of every page and in the cookie policy.

Do you have to give us your data?

To order, we need your name, delivery address, email address and phone number: without them we cannot conclude the contract or deliver. The carrier needs the phone number to arrange delivery; we do not use it for marketing. Everything else, such as an account or offers by email, is your choice.

No automated decisions

We do not take decisions about you that are based solely on automated processing, including profiling, and that have legal or similarly significant effects for you. The payment provider may run its own automated checks against fraud when you pay; its privacy notice explains them.

Changes to this notice

We update this notice when the way we use personal data changes. The date below shows the current version.

Last updated: 14 November 2026.