Privacy policy
Effective from: June 24, 2026
1. Data controller
DrinkAINI s.r.o.
Company ID (IČO): 24999512
Registered office: Rebovka 757/18, Bosonohy, 642 00 Brno, Czech Republic
Registered in the Commercial Register kept by the Regional Court in Brno, file no. C 151536
Email: info@drinkaini.com
The controller has not appointed a Data Protection Officer (DPO), as the processing is not subject to the obligation under Article 37 GDPR.
2. Purposes and legal basis
| Purpose | Legal basis | Data |
|---|---|---|
| Order fulfilment | Performance of a contract (Art. 6(1)(b) GDPR) | Name, email, phone, address, order |
| Payment processing | Performance of a contract (Art. 6(1)(b)) | Payment data processed by Stripe |
| Newsletter | Consent (Art. 6(1)(a)) | Email (opt-in) |
| Analytics and audience measurement | Consent (Art. 6(1)(a)) | Cookies, IP (anonymised), on-site behaviour |
| Conversion measurement and marketing | Consent (Art. 6(1)(a)) | Hashed email/phone/name + advertising identifiers, purchase-source attribution |
| Accounting and taxes | Legal obligation (Art. 6(1)(c)) | Billing data |
| Necessary cookies | Legitimate interest (Art. 6(1)(f)) | Cookie consent preferences |
3. Scope of data processing
We process only the data necessary for the given purpose:
- Order: name, email, phone, delivery address, order number, chosen shipping
- Payment: data is processed directly by the Stripe payment gateway — we do not store card numbers or bank details
- Subscription (optional): email, delivery address and Stripe customer identifier for recurring billing
- Newsletter: email address (voluntary consent)
- Attribution and marketing measurement: visitor/session identifier (cookies aini_vid, aini_sid, httpOnly), traffic source (UTM, referrer, advertising click IDs) and pre-purchase on-site interactions
- Cookies: cookie consent preferences (localStorage)
We do not process sensitive data (health, biometrics, political opinions, etc.).
4. Data recipients
We share your data solely with the processors necessary to provide the services:
| Processor | Purpose | Location |
|---|---|---|
| Stripe Payments Europe, Limited | Payment and subscription processing | Ireland (EU) * |
| Postmark (ActiveCampaign, LLC) | Sending transactional emails | USA * |
| Google Ireland Limited (Google Analytics 4) | Audience analytics (after consent) | Ireland (EU) * |
| Microsoft Ireland Operations Limited (Microsoft Clarity) | Behaviour analytics (after consent) | Ireland (EU) * |
| Meta Platforms Ireland Limited (Conversions API) | Ad conversion measurement (after consent) | Ireland (EU) * |
| Google Ireland Limited (Google Ads Enhanced Conversions) | Ad conversion measurement (after consent) | Ireland (EU) * |
| Ecomail.cz s.r.o. | Newsletter | Czech Republic |
| Fakturoid s.r.o. | Issuing invoices | Czech Republic |
| Packeta Czech s.r.o. (Zásilkovna) | Parcel delivery | Czech Republic |
| Hetzner Online GmbH | Website and database hosting | Germany (EU) |
* See section 9 — International data transfers.
5. Data retention
- Orders and accounting documents: 5 years (Act No. 563/1991 Coll., on Accounting). If the seller becomes a VAT payer, retention of tax documents extends to 10 years under §35 of the VAT Act.
- Newsletter: until consent is withdrawn (unsubscribe)
- Cookie preferences: 12 months (localStorage)
- Attribution touchpoints: 90 days, then deleted automatically. Visitor cookie aini_vid 730 days, session cookie aini_sid 30 minutes.
- Account (admin): for the duration of the account
After the retention period, data is deleted or anonymised.
6. Your rights
You have the right to access, rectify, erase, restrict, port, and object to processing of your data under GDPR Articles 15–22. Contact: info@drinkaini.com
8. Data security
We implement technical and organisational measures to protect your data:
- Encrypted communication (HTTPS/TLS)
- Data access limited to authorised persons
- Payment data is processed by Stripe (PCI DSS Level 1) — card numbers never pass through our server
- Regular security updates
9. International transfers
Some data is transferred to a limited extent outside the EU:
- Stripe — Stripe Payments Europe, Limited (Ireland) is the primary processor; part of the technical infrastructure (Stripe, Inc.) is located in the USA. Transfers are safeguarded by Standard Contractual Clauses (SCC) under European Commission Decision 2021/914.
- Postmark (ActiveCampaign, LLC, USA) — sending transactional emails. Same SCC regime.
- Google Analytics 4 (Google LLC, USA) — audience analytics after consent. Same SCC regime.
- Microsoft Clarity (Microsoft Corporation, USA) — behaviour analytics after consent. Same SCC regime.
- Meta Conversions API (Meta Platforms, Inc., USA) — conversion measurement after consent; only hashed identifiers (email, phone, name) + advertising click IDs are transmitted. Same SCC regime.
- Google Ads (Google LLC, USA) — conversion measurement after consent; hashed identifiers (email, phone) + click IDs. Same SCC regime.
The other processors are based in the Czech Republic/EU and no transfer outside the EU takes place.
10. Policy changes
We may update this policy. We will inform you of material changes by email or a notice on the website. The date of the last update is shown in the document header.
11. Contact & supervisory authority
Email: info@drinkaini.com
Supervisory authority: ÚOOÚ (Czech Data Protection Authority), www.uoou.cz
For questions, contact us at info@drinkaini.com.