Privacy Policy

This page explains what personal data we collect when you use onemorepuff.com, why we collect it, how long we keep it and what rights you have. It is our information notice under Article 13 of Regulation (EU) 2016/679 (GDPR).

1. Who is responsible for your data

The controller of your personal data is:

PUFFY s.r.o.
Uralská 689/7, 160 00 Prague 6 – Bubeneč, Czech Republic
Company ID (IČO): 24370321 · VAT ID: CZ24370321
Registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 343681
E-mail: info@onemorepuff.com · Telephone: +420 776 889 152

We have not appointed a Data Protection Officer. We are not required to do so: we are not a public authority, we do not monitor people on a large scale, and we do not process special categories of data on a large scale. For anything concerning your personal data, write to info@onemorepuff.com.

2. What we process, why, and on what legal basis

2.1. Orders and delivery

Data: first and last name, delivery and billing address, e-mail address, telephone number, order contents, order and payment history.

Why: to conclude and perform the purchase contract — to process your order, deliver it, handle payment, and communicate with you about it.

Legal basis: performance of a contract (Article 6(1)(b) GDPR). Without this data we cannot deliver an order.

2.2. Age verification

Data: your confirmation that you are 18 or older; where the carrier checks age on delivery, the fact that the check was carried out.

Why: our products are sold only to adults and we must not supply them to minors.

Legal basis: compliance with a legal obligation and our legitimate interest in preventing sales to minors (Article 6(1)(c) and (f) GDPR).

2.3. Invoicing and accounting

Data: billing details, invoices, tax documents.

Why: to issue tax documents and keep accounting and tax records.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

2.4. User account

Data: e-mail address, password (stored in encrypted form), order history, saved addresses.

Why: to run your account and let you see your orders.

Legal basis: performance of a contract (Article 6(1)(b) GDPR). Creating an account is optional — you can order without one.

2.5. Newsletters and commercial communications

Data: e-mail address, and information about whether and how you opened our messages.

Why: to send you news and offers.

Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw consent at any time, free of charge, using the unsubscribe link in every message or by writing to us. Withdrawal does not affect the lawfulness of processing before it.

2.6. Cookies and measurement

Data: cookie identifiers, IP address, device and browser information, pages viewed.

Why: to run the shop (essential cookies) and, if you agree, to measure traffic and improve the shop.

Legal basis: our legitimate interest for essential cookies, and your consent for all others (Article 6(1)(f) and (a) GDPR). You can change or withdraw your cookie choices at any time using the cookie settings link at the bottom of every page.

2.7. Complaints, claims and disputes

Data: your correspondence with us, order data, photographs or video you send with a claim.

Why: to handle claims and to establish, exercise or defend legal claims.

Legal basis: compliance with a legal obligation and our legitimate interest (Article 6(1)(c) and (f) GDPR).

3. Who else sees your data

We do not sell your personal data and we do not share it with anyone who does not need it to do a job for us. Your data may be passed to:

• The carrier delivering your order — name, delivery address, telephone number and e-mail, so the parcel can reach you and the carrier can contact you about the delivery. The carrier used is shown at checkout.
• The payment provider handling your payment — the data needed to process and identify the payment. The provider is shown at checkout. We never see or store your full card number.
• Shoptet, a.s., IČO 28935675, which operates the e-shop platform and hosts it for us, as our processor.
• Our accountants and tax advisers, bound by a duty of confidentiality.
• Our e-mail provider, which delivers messages to and from info@onemorepuff.com.
• Public authorities, where we are required by law to provide data.

Every processor is bound by a written contract that permits them to use your data only for the purpose we set.

4. Transfers outside the EU

We process your data within the European Union. Should any processor transfer data to a third country, it will only be to a country the European Commission has recognised as providing adequate protection, or under the standard contractual clauses approved by the Commission.

5. How long we keep your data

• Order and delivery data — for the duration of the contract and then for 4 years, which covers the limitation period for claims.
• Invoices and accounting records — 10 years from the end of the tax period, as required by Czech accounting and VAT law.
• User account — until you delete it, or after one year of inactivity.
• Newsletter consent — until you withdraw it, or after 3 years of no response.
• Cookies — for the period stated in the cookie settings, at most 13 months.

When a retention period ends, we delete or irreversibly anonymise the data.

6. Your rights

Under the GDPR you have the right to:

• Access — to be told whether we process your data and to receive a copy of it.
• Rectification — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have your data deleted, where we no longer need it and no legal obligation requires us to keep it.
• Restriction of processing — to have processing limited while a dispute about your data is resolved.
• Data portability — to receive the data you gave us in a structured, machine-readable format, or to have it sent to another controller.
• Object — to processing based on our legitimate interest, including direct marketing. If you object to direct marketing, we stop immediately.
• Withdraw consent — at any time, without giving a reason and free of charge.

To exercise any of these rights, write to info@onemorepuff.com. We answer without undue delay and at the latest within one month. We may ask you to confirm your identity, so that we do not disclose your data to someone else.

We do not make decisions about you by automated means alone, and we do not profile you in a way that produces legal effects.

7. If you are not satisfied

If you believe we are processing your data unlawfully, please tell us first — most things are quickest to fix directly. You also have the right to lodge a complaint with a supervisory authority.

Our supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz.

You may also complain to the supervisory authority of the EU member state where you live or work, or where you believe the infringement occurred.

8. Changes to this notice

We may update this notice as the shop changes. The current version is always published on this page, with the effective date below.

This privacy notice takes effect on 1 September 2026.