Privacy policy
This policy explains what personal data Reoviva collects when you visit reoviva.com or place an order, why we collect it, who we share it with, and what rights you have.
1. Who we are
Reoviva is a trading name of Daniel Dušek, a sole trader registered in the Czech Republic, business registration number (IČO) 24387932, registered place of business: Kajlovec 96, 747 41 Hradec nad Moravicí, Czech Republic.
We are the data controller for the personal data described in this policy.
Contact for anything related to your data: hello@reoviva.com
We are established in the EU and sell to customers in the United Kingdom. This means both the UK GDPR / Data Protection Act 2018 and the EU GDPR (Regulation 2016/679) apply to how we handle your data.
2. What data we collect
Data you give us
- Name, delivery address, billing address
- Email address and phone number
- Order contents, order history, order value
- Anything you write to us in an email or contact form
- Product review content and the name you publish it under, if you leave a review
Data collected automatically when you visit the site
- IP address, approximate location (country or city level), time zone
- Device type, operating system, browser, screen size
- Pages viewed, products viewed, items added to cart, referring website
- Cookie and pixel identifiers (see section 6)
Payment data
Card numbers are entered directly into our payment provider's systems. We never see or store your full card number. We receive only the payment status, the last four digits, the card brand and the billing address.
3. Why we use your data, and our legal basis
| Purpose | Legal basis |
|---|---|
| Processing and delivering your order, sending order and tracking emails | Performance of a contract |
| Handling payments and preventing fraudulent transactions | Contract / legitimate interests |
| Answering your emails and handling support, returns and warranty requests | Contract / legitimate interests |
| Keeping accounting, invoicing and tax records | Legal obligation |
| Sending marketing emails and SMS | Consent, or the soft opt-in for existing customers |
| Advertising measurement, retargeting and audience building | Consent, via the cookie banner |
| Website analytics and improving the store | Consent, via the cookie banner |
| Publishing product reviews you submit | Consent |
| Defending or bringing legal claims | Legitimate interests / legal obligation |
You can withdraw consent at any time. Withdrawing it does not affect anything we did lawfully before you withdrew it.
4. Who we share your data with
We do not sell your personal data. We share it only with the following recipients, and only with what they need to do their job.
Store platform and hosting. Shopify International Limited (Ireland) and Shopify Inc. (Canada) host our store and process order, customer and browsing data on our behalf.
Payment providers. Shopify Payments (operated by Stripe) and PayPal, depending on the method you choose. They act as independent controllers for fraud prevention and regulatory compliance.
Order fulfilment and dispatch. Our products are shipped directly from our fulfilment partner. CJdropshipping (Dongguan CJ E-Commerce Co., Ltd. and affiliated CJ entities, China) receives your name, delivery address, phone number, email address and order contents in order to pack and dispatch your parcel. This transfer is necessary to deliver the order you placed.
Delivery carriers. Depending on the route, your parcel is carried by international and UK carriers such as Yun Express, 4PX, Royal Mail, Evri or Yodel. They receive your name, delivery address and phone number so they can deliver and give you tracking updates.
Advertising and measurement. Meta Platforms Ireland Limited (Facebook, Instagram) receives event data through the Meta Pixel and the Conversions API — for example that a page was viewed, a product was added to cart, or a purchase was completed. Where identifiers such as your email address are sent, they are hashed before transmission. This only happens if you accept marketing cookies. Meta acts as an independent controller for its own purposes; see Meta's own privacy policy.
Email and reviews. Klaviyo (email and SMS marketing), LAI Product Reviews (collecting and displaying reviews), and other Shopify apps installed on the store, each limited to the data needed for that function.
Professional advisers and authorities. Our accountants, and tax authorities, courts, police or regulators where we are legally required to disclose.
We would also share data with a buyer if the business or its assets were ever sold or restructured.
5. Transfers outside the UK and EEA
Some of the recipients above are located outside the United Kingdom and the European Economic Area.
- China — CJdropshipping. There is no UK or EU adequacy decision for China. This transfer is protected by Standard Contractual Clauses together with the UK International Data Transfer Addendum, and is limited to the delivery details needed to ship your order. Where a transfer is unavoidable to perform your contract, Article 49(1)(b) UK/EU GDPR also applies.
- United States and Canada — Shopify, Meta, Stripe, PayPal and other providers. These transfers rely on the UK Extension to the EU–US Data Privacy Framework, on adequacy decisions where one exists, or on Standard Contractual Clauses plus the UK Addendum.
You can request a copy of the safeguards we rely on by emailing hello@reoviva.com.
6. Cookies and similar technologies
We use cookies, pixels and local storage to make the store work, remember your cart, measure advertising and understand how the site is used.
- Strictly necessary cookies (cart, checkout, security, fraud screening) are always on — the store cannot function without them.
- Analytics and marketing cookies, including the Meta Pixel, are only set after you accept them in the cookie banner.
You can change or withdraw your choice at any time through the cookie settings link in the footer, and you can block or delete cookies in your browser settings.
7. How long we keep your data
| Data | Retention |
|---|---|
| Order, invoice and accounting records | 10 years, as required by Czech accounting and VAT law |
| Customer account and order history | While the account is active, then 3 years |
| Support emails | 3 years from the last message |
| Marketing list membership | Until you unsubscribe, then a minimal suppression record so we don't contact you again |
| Published reviews | Until you ask us to remove them |
| Cookie and pixel data | As set out in the cookie banner and each provider's own policy |
8. Your rights
Under the UK GDPR and EU GDPR you have the right to:
- Access the personal data we hold about you
- Correct data that is wrong or incomplete
- Erase your data, where we don't have a legal reason to keep it
- Restrict how we use your data
- Object to processing based on legitimate interests
- Object to direct marketing at any time — this right is absolute, we must stop
- Data portability — receive your data in a machine-readable format
- Withdraw consent at any time
- Not be subject to a decision based solely on automated processing that produces legal effects
To use any of these rights, email hello@reoviva.com. We will respond within one month. We may ask you to confirm your identity first, so that we don't disclose your data to someone else.
Complaints. If you are unhappy with how we handled your data, you can complain to:
- UK — Information Commissioner's Office (ICO), ico.org.uk, 0303 123 1113
- Czech Republic — Úřad pro ochranu osobních údajů (ÚOOÚ), uoou.gov.cz
You can also complain to the supervisory authority in your own country.
9. Automated decision-making
We use automated fraud screening provided by Shopify and our payment providers to flag suspicious orders. Flagged orders are reviewed by a person before we cancel or refuse anything. We do not make decisions with legal or similarly significant effects on you by automated means alone.
10. Security
We use HTTPS across the whole site, restrict access to order data to the people who need it, and work with providers who maintain their own security standards. No system is completely secure, but if a breach occurs that is likely to put your rights at risk, we will notify you and the relevant supervisory authority as the law requires.
11. Children
Our store is not intended for children. We do not knowingly collect data from anyone under 16. If you believe a child has given us their data, email hello@reoviva.com and we will delete it.
12. Changes to this policy
We may update this policy. The current version is always the one published on this page. If a change materially affects how we use your data, we will tell you by email or through a notice on the site.
Questions: hello@reoviva.com