Privacy policy

In short

We use your data mainly to process your purchase, deliver it and provide customer support. We have to keep some of it for accounting and possible legal claims. You control optional website analytics and advertising in the cookie settings. Artificial intelligence helps us draft replies, but a person checks and sends every reply. You can reach us about anything at the contact in section 1; details on purposes, retention periods and your rights are below.

1. Who processes your data

This policy explains how we handle personal data when you visit our Hobby Horse LarDen online store, buy from us (including via Amazon), return goods, subscribe to our newsletter or write to us. It applies to all our national websites (for example hobby-horse.com, hobby-horse.cz, hobby-horse.sk, hobby-horse.dk, hobby-horses.fr, hobby-horses.it, hobby-horses.pl and hobby-horsing.nl).

The controller of your personal data is:

NG IT Solutions s.r.o.
Plzeňská 1270/97, 150 00 Prague 5, Czech Republic
Company ID (IČO) 01680790, VAT ID CZ01680790
registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 210145

Contact for questions about personal data and for exercising your rights:

• email: info@hobby-horse.com
• phone: +420 604 196 373
• by post to the registered office above

We have not appointed a data protection officer. Please direct any questions and requests concerning your data to the contact above.

We process data under Regulation (EU) 2016/679 (GDPR), Czech Act No. 110/2019 Coll. on the Processing of Personal Data and, for cookies and commercial communications, also Czech Act No. 127/2005 Coll. on Electronic Communications and Czech Act No. 480/2004 Coll. on Certain Information Society Services. Where applicable, the rules of the country in which you use our services also apply, in particular for cookies, electronic marketing and the protection of children.

2. What data we process, why and for how long

For each purpose we state its legal basis under Art. 6(1) GDPR. We process the data needed to handle your order in order to conclude and perform the contract. Once it has been performed, we keep only selected data, separately for accounting, legal obligations and the protection of legal claims, to the extent and for the period stated in the table. After that we delete it or irreversibly anonymise it.

Where we get the data. You give us most of it yourself when ordering, in your account, in a form or by email. We collect technical data from your device, and for analytics and advertising technologies only with your consent. When you buy via Amazon, Amazon passes us the delivery details and also keeps them separately under its own rules. Payment providers tell us the result of the payment and carriers the delivery status.

Mandatory and voluntary data. Data required to process an order or request is marked as mandatory in the forms; without it we cannot process it. Other data, the newsletter, reviews and cookie consent are voluntary, and refusing them does not prevent you from buying.

Profiling and automated decision-making. We sort newsletter contacts into groups by language, country and purchases so that we do not send you offers that do not interest you; you can object to this. We do not take decisions with legal or similarly significant effects for you based solely on automated processing. An automated assessment of the fraud risk of a payment is only an input for us; any cancellation of an order is reviewed by a person. Payment providers may decide according to their own rules.

3. Who we share data with

We share data only with those who need it for the given purpose, and only to the extent necessary. We name the recipients you deal with directly or who set cookies on our website; others are listed by specific service category. On an access request we will tell you the identity of the specific recipients to whom your data has been or will be disclosed.

Some recipients process data on our instructions as processors; we have contractual data protection obligations with them (Art. 28 GDPR). Others decide on their own purposes as independent controllers; we say so where this applies.

We give carriers your name, address, phone and email so that they can notify you about delivery. For shipments outside the EU we also pass on customs data (contents and value of the shipment), which the carrier forwards to the customs authorities of the destination country.

Independent controllers. Shopify is an independent controller for Shop Pay and the Shop app. When providing its enhanced services, Shopify processes data about your interactions with our store in connection with interactions with other stores and with Shopify, and for these own purposes it is also an independent controller. Details are in Shopify's consumer privacy policy, and you can exercise your rights towards Shopify at privacy.shopify.com. For purchases via Amazon, Amazon is an independent controller. Payment providers process some data themselves to meet their legal obligations, for example against money laundering.

Other recipients. Legal advisers bound by confidentiality. Public authorities (for example the tax office, the Czech Trade Inspection Authority, courts, police), only where the law requires us to.

4. Transfers outside the EU and EEA

Some recipients in section 3 are based in or process data outside the European Economic Area, mainly in the USA. We transfer data to them only with an appropriate safeguard under the GDPR: on the basis of a European Commission adequacy decision (for example for US companies certified under the EU-US Data Privacy Framework, for the United Kingdom or for Switzerland), or on the basis of standard contractual clauses approved by the Commission, with supplementary measures where needed.

When delivering outside the EEA, we pass the necessary recipient and shipment data to carriers and customs authorities in the country of delivery. For countries with an adequate level of protection, the relevant decision applies. Where no other safeguard exists for the country of delivery, we transfer only the data needed to deliver the shipment you ordered there, under the derogation for the performance of a contract with you (Art. 49(1)(b) GDPR).

You can obtain information about a specific transfer and a copy of the relevant safeguards at the contact in section 1.

5. Cookies and similar technologies

We use optional analytics and marketing technologies only after you give your consent. In the banner shown on your first visit you can just as easily choose "Accept all", "Decline all" or set individual purposes. You can change or withdraw your consent at any time via the "Cookie settings" link in the website footer. Declining does not prevent you from buying.

Without consent we use only technologies needed to transmit communications or to provide a service you have explicitly requested, such as the cart and checkout. We treat similar technologies the same way as cookies: the browser's local storage, tracking pixels and the forwarding of events from our server to an advertising platform.

If you decline marketing cookies, you will still see ads, they just will not be tailored to your visit to our store. You can also delete or block cookies in your browser settings; without necessary cookies, however, the cart and checkout will not work.

6. Newsletter and marketing emails

We send you marketing emails, including the newsletter, only on the basis of your consent, which you give by subscribing on the website or at checkout. Without consent we do not send them.

We send a reminder about an unfinished purchase only if you have valid consent to marketing emails. Simply entering your email at checkout is not enough for us to send a promotional reminder.

We send emails via Klaviyo. For marketing emails we measure which ones you opened and what you clicked, so that we send you what interests you.

You can unsubscribe at any time via the link in every email or by writing to the contact in section 1. After you unsubscribe, we no longer use your contact for marketing. To respect your choice, we keep only your email address and the date and scope of the unsubscription. We may separately keep evidence of your earlier consent for as long as needed to show that we acted in line with the law; we do not use it for sending emails.

We send you necessary messages about an order, shipment, return or account security even after you unsubscribe. We do not include advertising in them.

7. Customer support and artificial intelligence

For drafting replies, translations and checking the format of delivery addresses, we use contracted providers of artificial intelligence tools. The purpose is faster and clearer support and fewer delivery errors; we base this on our legitimate interest (Art. 6(1)(f) GDPR).

• A member of our team checks and sends every reply to a customer.
• We give providers only the data needed for the task at hand.
• We use business modes in which providers do not use your data to train their models. They may keep it temporarily for operating and securing the service, as a rule for no more than 30 days.
• AI does not make decisions about you (see automated decision-making in section 2).

You can object to this processing (section 12).

8. Reviews, social media and your photos

Review requests. After a purchase we may send you an email asking you to review it. We only send it if you have agreed to receive marketing emails. Unsubscribing also applies to these requests.

Reviews. We publish your review and attached photos with your consent and with the name or nickname you give when submitting it. We mark as a verified purchase only reviews we have actually linked to a purchase. You can withdraw your consent at any time via the contact in section 1 and we will delete the review.

Your photos and videos. Before we publish a photo or video, we ask for consent to the specific use and check that you are entitled to give it. Simply tagging our account on social media does not replace consent. Use in paid advertising must be expressly covered by the consent. For photos and videos of children we ask for a parent's consent. If consent is withdrawn, we remove the content from the places we manage.

Our social media profiles. We have profiles on Facebook, Instagram, TikTok, YouTube and Pinterest. When you follow us, message us or comment, the platform operator also processes your data under its own policies. We reply to messages and comments on the basis of our legitimate interest in communicating with customers. For the statistics of our Facebook page we are joint controllers with Meta Platforms Ireland Limited to the extent of the Page Insights addendum; it divides responsibilities between us and Meta, and you can exercise your rights against either of us.

Our website contains ordinary links to our social media. It also displays posts from our Instagram; any data transfer by advertising technologies is governed by section 5.

9. Our internal tools for YouTube, TikTok and Pinterest

These tools work only with our own accounts and do not collect personal data of viewers or users.

YouTube API Services (internal tool)

We operate our own YouTube channels and use an internal tool, available only to our own employees, that accesses YouTube API Services in order to manage them. By using this tool, our staff agree to be bound by the YouTube Terms of Service: https://www.youtube.com/t/terms

Through YouTube API Services we access only data belonging to the YouTube channels we own: our own videos and their titles, descriptions and publication dates, aggregate statistics for those videos such as views, likes and comments, and our own channel subscriber counts. We use this only for our own internal reporting and to upload our own original video content to our own channels. We do not collect, store or process any personal data about YouTube viewers through this tool, and we do not access data belonging to any channel other than our own.

Google's Privacy Policy describes how Google handles information in connection with these services: https://policies.google.com/privacy

Access granted to our tool can be revoked at any time through the Google security settings page: https://security.google.com/settings/security/permissions

TikTok API Services

We operate our own TikTok account and use an internal tool to manage it, which accesses the TikTok API. By using this tool, our staff are agreeing to be bound by TikTok's Terms of Service: https://www.tiktok.com/legal/page/global/terms-of-service/en

Through the TikTok API we access only data belonging to the TikTok account we own: our own videos and their captions and publication dates, aggregate statistics for those videos such as views, likes, comments and shares, and our own follower count. We use this only for our own internal reporting, and to publish our own original video content to our own account. We do not collect, store or process any personal data about TikTok viewers, we do not store comment text, and we do not access data belonging to any account other than our own.

Access credentials for our own account are held securely by us and are used for no other purpose. Access granted to our tool can be revoked at any time from the TikTok app, under Settings and privacy, Security and permissions, Manage app permissions.

TikTok's Privacy Policy describes how TikTok handles information in connection with these services: https://www.tiktok.com/legal/page/eea/privacy-policy/en

Pinterest API Services

We operate our own Pinterest accounts and use an internal tool to manage them, which accesses the Pinterest API. By using this tool, our staff are agreeing to be bound by Pinterest's Terms of Service: https://policy.pinterest.com/en/terms-of-service

Through the Pinterest API we access only data belonging to the Pinterest accounts we own: our own boards and their names, our own Pins and their titles, descriptions and links, aggregate statistics for those Pins such as impressions and saves, and our own follower count. We use this only for our own internal reporting, and to publish our own original images to our own boards — and only after a member of our team has reviewed and approved each individual Pin. We do not collect, store or process any personal data about Pinterest users, we do not store comment text, and we do not access data belonging to any account other than our own.

Access credentials for our own accounts are held securely by us and are used for no other purpose. Access granted to our tool can be revoked at any time from the Pinterest settings of the account concerned.

Pinterest's Privacy Policy describes how Pinterest handles information in connection with these services: https://policy.pinterest.com/en/privacy-policy

10. Children

Whether a minor may conclude a purchase contract on their own depends on civil law and the minor's maturity; where needed, a parent or other legal guardian makes or approves the purchase. Where processing in an online service offered directly to a child is based on consent, below the applicable age limit we need a parent's consent. In the Czech Republic this limit is 15 years; in other EU countries it ranges from 13 to 16 years. If valid consent is missing, we stop the processing concerned and delete the data unless we have to keep it for another reason.

11. Security

We use technical and organisational measures appropriate to the nature of the data and the risks of processing it, including an encrypted connection to the website (HTTPS). We restrict access to personal data according to job duties. We will inform you of a data breach without undue delay where the law requires it given the risk.

12. Your rights

Your rights apply under the conditions of the GDPR. You have the right to:

• access your data and obtain a copy, including information about the specific recipients (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16);
• erasure, where we no longer need the data or are not required by law to keep it (Art. 17);
• restriction of processing, for example while the accuracy of the data is being verified (Art. 18);
• data portability for data you have given us and that we process by automated means on the basis of consent or a contract (Art. 20);
• withdraw consent at any time; withdrawal does not affect the lawfulness of processing before it.

Right to object (Art. 21 GDPR). You can object to processing based on legitimate interest on grounds relating to your particular situation. You can object to direct marketing at any time and without giving reasons; we will then stop processing for that purpose, including related profiling.

You can exercise your rights by email, phone or letter to the contact in section 1. We will reply within one month. If in a complex case we need to extend this period by a further two months, we will tell you, with the reason, within one month of receiving your request. This is free of charge. If we have reasonable doubts about your identity, we will ask for the necessary verification.

Complaints. If you are not satisfied with how we handle your data, you can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz, or with the supervisory authority in the country where you live (list of EU authorities). We would be glad if you contacted us first.

13. Changes to this policy

We review and update this policy regularly as our services and the law change. We will notify you in advance of changes that significantly affect how we handle your data, in a manner appropriate to the change, for example by a notice on the website or a message to the customers concerned. If a change requires new consent, we will ask for it before the processing starts.

This policy is effective from 19 October 2026 and replaces the previous versions of the privacy policy on the store page and at checkout.