Privacy policy

Effective from 18 October 2026 · Processing of personal data under Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll.

1. Who processes your data (controller)

Controller	Adam Oláh TLBRTY
Company ID (IČO)	50416987
E-mail	info@theliberty.store

Given the scope and nature of the processing we are not obliged to appoint a data protection officer (DPO). For data protection matters, contact us at the e-mail address above.

2. What data we process, why, and on what legal basis

Purpose	Categories of data	Legal basis	Retention
Fulfilling the order and delivering the goods	name and surname, delivery and billing address, e-mail, phone, order details	performance of a contract (Art. 6(1)(b) GDPR)	for the term of the contract and 3 years after it ends
Delivering a gift card to its recipient	recipient's e-mail and name, the sender's message, sending date	performance of the contract with the buyer (Art. 6(1)(b) GDPR) and legitimate interest in delivering the gift (Art. 6(1)(f))	for the validity of the card and 3 years after it
Accounting and tax obligations	billing details, payment and document data	legal obligation (Art. 6(1)(c) GDPR)	10 years under the Accounting Act
Handling claims and withdrawals from contract	identification and contact details, description of the defect, correspondence	legal obligation (Art. 6(1)(c) GDPR)	4 years from resolution
Records under the Hallmarking Act	type, weight and fineness of the goods sold, proof of sale	legal obligation (Act No. 94/2013 Coll.)	for the statutory period
Replying to messages and customer support	e-mail, content of the message, phone where given	legitimate interest: communication with customers (Art. 6(1)(f) GDPR)	2 years from the last exchange
Sending newsletters and marketing e-mails	e-mail, name, purchase history	consent (Art. 6(1)(a) GDPR)	until consent is withdrawn, at most 3 years from the last contact
Traffic analytics (Shopify Analytics, Google Analytics)	IP address, device and browser identifiers, pages visited and behaviour on the site	consent given in the cookie banner (Art. 6(1)(a) GDPR, Section 109(8) of Act No. 452/2021 Coll.)	for the lifetime of the cookies; Google Analytics data for at most 14 months
Advertising on Facebook and Instagram and measuring its effectiveness (Meta Pixel and Conversions API)	browser and device identifiers (e.g. the _fbp and _fbc cookies), IP address, browser type, pages visited and actions in the shop (page view, adding to cart, starting checkout, purchase and its value); for an order also e-mail, phone, name and surname, city, postcode and country, which are hashed (replaced with an unreadable code) before being sent to Meta	consent to marketing cookies given in the cookie banner (Art. 6(1)(a) GDPR, Section 109(8) of Act No. 452/2021 Coll.)	_fbp and _fbc cookies 90 days; data passed to Meta is kept by Meta under its own policy
Fraud prevention and shop security	IP address, transaction data, technical logs	legitimate interest: operational security (Art. 6(1)(f) GDPR)	1 year

The recipient's details are provided to us by the buyer and we use them only to deliver the card.

Providing data for the purpose of fulfilling an order is a contractual requirement, without it we cannot process your order. Providing data for marketing is voluntary.

3. Who we disclose data to (recipients and processors)

• Shopify International Limited: running and hosting the shop platform (Ireland / the Shopify group);
• Packeta Slovakia s. r. o.: parcel delivery; for parcels to the Czech Republic also Zásilkovna s.r.o. of the Packeta group;
• Stripe Payments Europe, Limited: processing card payments (Ireland; card data is processed solely by Stripe, we have no access to it);
• accountant or accounting firm: processing accounting documents;
• Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland): showing and measuring advertising on Facebook and Instagram, only with your consent. We are jointly responsible with Meta for collecting data through the Meta Pixel and the Conversions API and passing it to Meta (joint controllers under Art. 26 GDPR, Meta Controller Addendum). Meta carries out any further processing as an independent controller under its privacy policy. You can exercise your rights with us and also directly with Meta;
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland): Google Analytics, where activated, only with your consent;
• e-mail sending tool provider (Shopify Email): only if you have subscribed to the newsletter;
• public authorities: where required by law (for example the tax office, SOI, or the Slovak Hallmarking Office).

We have concluded agreements with processors under Art. 28 GDPR. We do not sell your data and do not use it for profiling with legal effects; we carry out no automated individual decision-making.

4. Transfers outside the EU

Some of our service providers may process data outside the European Economic Area, in the USA in particular (for example Meta Platforms, Inc., Google LLC, companies of the Shopify group). Transfers to the USA to recipients certified under the EU-U.S. Data Privacy Framework rely on the European Commission's adequacy decision of 10 July 2023. Otherwise the transfer is safeguarded by one of the instruments under Chapter V of the GDPR, above all standard contractual clauses approved by the European Commission.

5. Your rights

As a data subject you have the right:

• of access to your data and to a copy of the data processed,
• to rectification of inaccurate or incomplete data,
• to erasure (the „right to be forgotten“) where the data is no longer needed and no legal obligation prevents it,
• to restriction of processing,
• to portability of the data you have provided to us, in a structured, commonly used format,
• to object to processing based on legitimate interest and to direct marketing,
• to withdraw consent at any time, which does not affect the lawfulness of processing before the withdrawal; you can change or withdraw your cookie consent through the Cookie preferences link in the footer,
• to lodge a complaint with the supervisory authority.

We will deal with your request within one month of receiving it; in justified cases we may extend that by a further two months and will tell you if we do. We may verify your identity before acting on a request.

6. Where you can complain

Office for Personal Data Protection of the Slovak Republic
Hraničná 12, 820 07 Bratislava 27
E-mail: statny.dozor@pdp.gov.sk · dataprotection.gov.sk

You can also lodge a complaint with the supervisory authority of the EU country where you habitually reside; in the Czech Republic this is the Office for Personal Data Protection (uoou.gov.cz).

Supervision of the storing of and access to information on terminal equipment (cookies) is carried out by the Regulatory Authority for Electronic Communications and Postal Services.

7. Data security

We have adopted appropriate technical and organisational measures to protect data: encrypted transmission (HTTPS/TLS), access control, the use of vetted service providers, and keeping the scope of processed data to a minimum. In the event of a personal data breach that poses a risk to your rights we will report it to the Office for Personal Data Protection within 72 hours and, where the risk is high, we will inform you as well.

8. Children

The shop is not intended for children under 16. If we find that we have processed the data of a child under 16 without the consent of their legal guardian, we will erase that data without delay.

9. Changes to this policy

We may update this policy if the way we process data changes, or if the law changes. The current wording is always available on this page together with its effective date.