Privacy Policy
Here you’ll find what data we process about you, why we do it, who we share it with, and what rights you have. We process only what we need to sell and deliver your goods.
Effective from August 26, 2026.
1. Who controls your data
The data controller is the operator of the online store www.mixbox.cz:
Aloi Solutions s.r.o.
Předmostí 701
278 01 Kralupy nad Vltavou
Company ID (IČO) 04032420, VAT ID (DIČ) CZ04032420
mixbox@mixbox.cz · +420 771 164 494
We have not appointed a data protection officer — for anything concerning your data, contact us at the e-mail or phone number above. Processing is governed by the General Data Protection Regulation (GDPR) and Czech Act No. 110/2019 Coll.
2. What data we process and why
Most of the data comes from you when you place an order or ask a question. Without it we can’t process your order.
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Processing your order and delivering the goods | first and last name, billing and delivery address, e-mail, phone, order contents, company ID and VAT ID for businesses, selected pickup point | performance of a contract | for the duration of the order and then for as long as a defect in the goods can be claimed |
| Issuing and archiving tax documents | billing details and payment details | compliance with a legal obligation | for as long as tax and accounting regulations require (10 years for tax documents) |
| Replying to a contact form inquiry | name, e-mail, optionally phone and the message text | legitimate interest in handling the inquiry | for the duration of the inquiry and a reasonable period afterwards |
| Operating and securing the store | cart contents, chosen delivery country and language (cookies); for each visit the IP address, browser and device details and the pages visited (our own cookieless traffic measurement, fraud prevention for orders) | legitimate interest in a working and secure operation | according to the cookie type (see below); IP address and visit records for the period set by the operator (90 days by default), aggregated statistics without personal data permanently |
| “Verified by Customers” satisfaction survey | e-mail, order number and codes of the purchased goods | legitimate interest in feedback — you can opt out in advance by ticking the box at checkout | one-time transfer to Heureka Group a.s. after the order is placed |
We don’t offer customer accounts yet, so we keep nothing about you beyond what you sent us in a specific order or message. We don’t do profiling or automated decision-making with legal effects for you.
3. Who we share data with
We always share only the necessary minimum, and only with these recipients:
- the carrier you choose — Zásilkovna s.r.o. or General Logistics Systems Czech Republic s.r.o. (GLS); they receive your name, address or pickup point, phone, e-mail and, for cash on delivery, the amount,
- the payment gateway provider ComGate Payments, a.s., if you pay by card online; you enter your payment details directly with them and we never see your card number,
- the operator of the “Verified by Customers” program, Heureka Group a.s. — after you place an order we pass on your e-mail, order number and codes of the purchased goods so they can send you a purchase satisfaction survey; you can decline the survey by ticking the box at checkout,
- the store’s hosting and technical support provider, who has access to the data when administering the system,
- accountants, tax advisors and public authorities where required by law.
We don’t sell personal data and we don’t pass it to anyone for their own marketing.
4. Cookies
Essential cookies, without which the shop would not work, are used without consent. Traffic measurement (Google Analytics) and the comparison sites’ measurement scripts at checkout completion (Heureka, Seznam/Zboží.cz, Google) run only with your consent — you choose it in the bar on your first visit and can change it at any time via the “Cookie settings” link in the footer. Without consent, the scripts of these services are not loaded at all. We also measure traffic ourselves, without cookies: each visit is recorded with the IP address, browser and device details and the pages visited; this serves operational statistics and fraud prevention for orders (legitimate interest). Without consent, a visitor is distinguished only within a single day using a random key from which the IP address cannot be recovered.
| Cookie | What it’s for | Lifetime |
|---|---|---|
| mb_cart | keeps your cart so it survives closing the browser | 30 days |
| mb_market | remembers your selected delivery country (determines prices, currency and shipping) | 1 year |
| .AspNetCore.Culture | remembers the language you browse the site in | 1 year |
| mb_consent | remembers your choice in the cookie consent bar | 1 year |
| _ga, _ga_* | Google Analytics — distinguishes visitors for traffic measurement; only with your consent | 2 years |
| mb_vid | recognizes a returning visitor for our own traffic measurement; only with your consent | 13 months |
You can delete or block cookies at any time in your browser settings. Without them, however, you won’t be able to complete a purchase — the cart won’t remember you.
5. Transfers outside the European Union
We process and store personal data in the European Union and do not transfer it outside. Fonts and our own scripts are served by us. Only the following is loaded from third-party servers: the map on the Contact page (OpenStreetMap), the Verified by Customers rating panel (Heureka servers) and — only with your consent from the cookie bar — measurement scripts: Google Analytics (traffic measurement and the purchase event) and, after checkout completion, the Heureka and Seznam (Zboží.cz) scripts, which receive the order number and details of the purchased items (names, codes, prices, quantities) for conversion evaluation. When pages are displayed, these providers technically see your IP address; beyond what is stated we pass them no data. With the same consent, after checkout completion we also pass Google your e-mail address and phone number, but only in hashed form (the original value cannot be recovered) — Google uses them to attribute the purchase to the ad you came from (so-called enhanced conversions). Google Analytics is operated by Google Ireland Ltd.; processing is governed by its EU terms.
6. Your rights
You have the following rights, and all you need to do to exercise them is write to us:
- to know what data we process about you and to receive a copy,
- to have inaccurate data corrected or incomplete data completed,
- to have your data erased once the reason for processing it no longer applies,
- to restrict processing until it is clarified whether the data is accurate or whether we have grounds to process it,
- to receive your data in a machine-readable format and transfer it elsewhere,
- to object to processing based on legitimate interest,
- to withdraw consent at any time where you have given it; withdrawal doesn’t affect processing carried out before it.
We will respond within one month at the latest. Data we are legally required to keep (typically tax documents) can’t be erased — we will always let you know.
If you are not satisfied with how we handle things, you can lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic.
7. How to reach us
For anything concerning your data, contact us at: