Česky (CZK)
Slovensky (EUR)
Deutsch (EUR)
Belgium
Bulgaria
Croatia
Denmark
Estonia
France
Hungary
Italy
Latvia
Lithuania
Luxembourg
Netherlands
Poland
Portugal
Romania
Slovenia
Spain
SwedenPrivacy Policy
Last updated:
1. Data controller
The controller responsible for processing personal data under the General Data Protection Regulation is:
Progressive motor invest, s.r.o.
Záhumenní 686
739 23 Stará Ves nad Ondřejnicí
Czech Republic
Company ID: 04872207
VAT ID: CZ04872207
Registered in the Commercial Register maintained by the Regional Court in Ostrava, file No. C 65446
Phone: +420 602 701 324
Email: info@pmcolours.eu
Further company details are available on our Contact page.
2. Categories of personal data
Depending on how you use our online store, we may process the following categories of personal data:
- Identification data: name, company name, billing address, delivery address and country.
- Contact data: email address, telephone number and, where applicable, WhatsApp contact details.
- Order and contract data: ordered products, quantities, prices, discounts, order number, order status, delivery method and returns.
- Payment data: selected payment method, payment status and transaction or payment reference. Complete payment-card details are generally processed directly by the relevant payment service provider and are not disclosed to us in full.
- Customer account data: login details, order history and information saved in your customer account, where an account is created.
- Communication data: the contents of emails, contact forms, WhatsApp messages, complaints, withdrawal statements and other enquiries.
- Shipping and return data: recipient details, delivery address, telephone number, email address, parcel number, delivery status and return information.
- Technical data: IP address, device and browser information, operating system, language settings, timestamps and technical log data.
- Usage and event data: pages viewed, interactions, shopping-cart contents, purchases, approximate geographical region and traffic source, where you have consented to analytics or marketing.
- Consent records: your choices in the cookie banner and the time and content of any consent given or withdrawn.
We do not intend to collect special categories of personal data within the meaning of Article 9 GDPR. Please do not provide such information unless it is strictly necessary.
3. Purposes and legal bases
We process personal data for the following purposes and on the following legal bases:
- Taking steps before entering into and performing a purchase contract, including ordering, payment, delivery, returns, withdrawal and customer service – Article 6(1)(b) GDPR.
- Responding to pre-contractual enquiries about products, availability, application or quotations – Article 6(1)(b) GDPR.
- Compliance with legal obligations, particularly tax, accounting, commercial and consumer-law requirements – Article 6(1)(c) GDPR.
- Handling complaints and legal claims – Article 6(1)(b), (c) and (f) GDPR.
- Fraud prevention, abuse prevention, IT security and error analysis – Article 6(1)(f) GDPR.
- Analysis of website use and measurement of advertising performance – Article 6(1)(a) GDPR, where you have given consent.
- Personalised advertising and retargeting through Google or Meta – Article 6(1)(a) GDPR, where you have given consent.
- Sending newsletters and other marketing communications – Article 6(1)(a) GDPR or, where legally permitted, our legitimate interest in direct marketing under Article 6(1)(f) GDPR.
Where processing is based on Article 6(1)(f) GDPR, our legitimate interests include the secure and efficient operation of our online store, fraud prevention, responding to customer enquiries and establishing, exercising or defending legal claims.
4. Orders, customer accounts and communication
Orders
When you place an order, we process the identification, contact, order, payment and delivery information you provide. This processing is necessary to accept, process, dispatch and deliver your order and, where required, to handle a return, complaint or refund.
Customer account
If you voluntarily create a customer account, we store the information saved in the account and your order history in order to provide and manage the account. You may request deletion of your customer account. Information subject to statutory retention obligations may be restricted and deleted only after the applicable retention period has expired.
Electronic withdrawal
If you use the electronic function to withdraw from a contract, we process your order number, contact details, the content of your withdrawal statement and the date and time of submission. This information is used to document, confirm and process your withdrawal.
Contacting us
If you contact us by email, telephone, WhatsApp or contact form, we process the information you provide in order to respond to your enquiry. For product- or order-related enquiries, processing is generally necessary to take pre-contractual steps or perform the contract.
If you contact us through WhatsApp, WhatsApp or Meta may also process communication and technical data in accordance with their own privacy information.
5. Recipients and service providers
We disclose personal data only where this is necessary to perform a contract, comply with a legal obligation, protect a legitimate interest or where you have given consent.
We use the following categories of recipients and service providers in particular:
- Upgates / EVici webdesign s.r.o. – operation, hosting and technical administration of the online store.
- BaseLinker / Base.com – order administration, automation, shipment preparation, stock and status synchronisation and related customer communication.
- Google Workspace – provision of our business email services.
- GLS – shipping, parcel tracking, delivery communication and returns.
- Comgate, PayPal and Stripe – payment processing and, where applicable, fraud prevention.
- Klarna – provision of Klarna payment methods offered through Stripe, where selected and available.
- WhatsApp / Meta – communication where you contact us using WhatsApp.
- Banks and financial institutions – processing bank transfers and refunds.
- Accountants, tax advisers, legal advisers and public authorities – where necessary to comply with legal obligations or protect legal claims.
- Google and Meta – analytics, audience measurement and advertising-performance measurement after you have given consent.
Where a service provider processes personal data exclusively on our behalf, we enter into a data processing agreement in accordance with Article 28 GDPR where required.
6. Payment processing
Depending on the payment method you select, the information required to process the payment is transferred to the relevant payment service provider.
Comgate
Comgate processes payments made by credit or debit card, Apple Pay and Google Pay. The data processed may include your name, contact details, order number, payment amount, currency, payment status, technical information and transaction details required by the payment service provider.
Comgate may process some personal data as an independent controller, particularly where this is necessary to comply with legal obligations, prevent fraud or provide regulated payment services.
PayPal
If you select PayPal, the information required to process the payment is transferred to PayPal. PayPal processes your information in accordance with its own privacy policy and may request further information for payment processing, security checks and fraud prevention.
Stripe and Klarna
Where a payment method offered through Stripe is selected, including Klarna, the information required for the chosen payment method is transferred to Stripe and, where applicable, the relevant payment provider. This may include your name, address, email address, order details, payment amount, currency, payment status and technical information.
Individual payment providers may perform identity, creditworthiness or fraud-prevention checks under their own responsibility. Their own privacy information also applies to this processing.
Bank transfer
Where payment is made by bank transfer, we process the information contained in the payment transaction, including the account holder’s name, payment amount, payment reference and account details to the extent that they are visible to us.
7. Shipping and returns
We use GLS for shipping and returning orders.
For delivery purposes, we may transfer the following information to GLS:
- the recipient’s name or company name,
- the delivery or collection address,
- the email address and telephone number required for delivery notifications,
- the parcel number and information about the shipment where required.
If you use the GLS returns portal, GLS processes the information required to create the return label, transport the parcel and provide tracking. The information may also be used to send delivery or collection notifications and to document the return.
9. Google Analytics 4 and Google Ads
After you have given consent, we use Google Analytics 4, a service provided by Google, to analyse use of our online store and improve our services.
The following information may be processed:
- pages viewed and technical events,
- interactions with products and the shopping cart,
- purchases, order values and product information,
- approximate geographical region,
- browser, device, operating system and language,
- online identifiers and cookie identifiers,
- the time, duration and source of a visit.
Google Analytics is linked to our Google Ads account. Events such as completed purchases may be imported from Google Analytics into Google Ads in order to measure advertising performance and optimise campaigns.
Depending on your consent choices, information may also be used to create audiences, measure the effectiveness of advertisements and show advertising to previous visitors.
We use Google Consent Mode so that Google tags can take account of the consent signal selected in the cookie banner. If you do not consent to analytics or marketing technologies, we do not activate the corresponding non-essential cookies. Depending on the technical configuration, Google may process limited non-cookie signals.
Further information is available in the Google Privacy Policy and in Google’s information about how data is used from sites or apps that use Google services.
10. Meta Pixel
After you have given consent, we use the Meta Pixel provided by Meta Platforms to measure the effectiveness of our advertising on Facebook and Instagram.
The Meta Pixel may record that a user:
- visited our online store or a particular product page,
- viewed a product or added a product to the shopping cart,
- started the checkout process or completed a purchase.
Technical information, IP address, browser and device information, cookie or online identifiers, page views and information about completed events may be transferred to Meta.
Meta may associate this information with an existing Facebook or Instagram account and use it for measurement, security and advertising purposes in accordance with its own privacy policy.
The Meta Pixel is activated only after you have consented to the marketing category in the cookie banner. You can withdraw your consent at any time through the cookie settings.
Further information is available in the Meta Privacy Policy.
11. Newsletters and direct marketing
If you expressly subscribe to a newsletter or otherwise consent to receiving marketing communications, we use your email address to send the requested content. The legal basis is Article 6(1)(a) GDPR.
Where permitted by law, we may send existing customers information about our own similar products or services. The legal basis is our legitimate interest in direct marketing under Article 6(1)(f) GDPR in conjunction with the applicable rules on electronic marketing.
You may object to the use of your information for direct marketing or withdraw consent at any time free of charge, for example by using the unsubscribe link in the relevant message or emailing info@pmcolours.eu.
12. International data transfers
Some of the service providers we use, particularly Google, Meta, PayPal and Stripe, operate internationally. Personal data may therefore be processed outside the European Union or the European Economic Area.
Such transfers take place only where the applicable legal requirements are met. Transfer mechanisms may include:
- an adequacy decision adopted by the European Commission,
- certification of a US company under the EU-U.S. Data Privacy Framework, where applicable,
- standard contractual clauses adopted by the European Commission,
- other appropriate safeguards under Article 46 GDPR, or
- a statutory exception under Article 49 GDPR.
Further information about the transfer mechanisms used is available in the privacy information of the relevant service provider.
13. Data retention
We retain personal data only for as long as necessary for the relevant purpose or for as long as statutory retention obligations apply.
The following criteria apply in particular:
- Order, invoice and payment data: for the duration of contract performance and subsequently for the applicable tax, accounting and commercial-law retention periods, generally for up to ten years.
- Customer account: until the account is deleted or while it remains actively used; statutory retention obligations relating to order records remain unaffected.
- Customer communication: for as long as necessary to deal with the enquiry and subsequently where required for documentation, complaint handling or legal defence.
- Withdrawal and return data: for the duration of the process and subsequently where required to comply with legal obligations or protect legal claims.
- Marketing data: until consent is withdrawn or an objection to direct marketing is made.
- Consent records: for as long as necessary to document and demonstrate valid consent.
- Analytics and marketing data: according to the retention period configured for the relevant service and no longer than necessary for the stated analytics or advertising purposes.
- Technical log data: for the period necessary to ensure security, analyse errors and prevent misuse.
When the processing purpose no longer applies and the relevant statutory periods have expired, the information is deleted or anonymised.
14. Your rights
Subject to the applicable statutory requirements, you have the following rights:
- the right of access under Article 15 GDPR,
- the right to rectification under Article 16 GDPR,
- the right to erasure under Article 17 GDPR,
- the right to restriction of processing under Article 18 GDPR,
- the right to notification of recipients under Article 19 GDPR,
- the right to data portability under Article 20 GDPR,
- the right to object under Article 21 GDPR,
- the right to withdraw consent under Article 7(3) GDPR, and
- the right to lodge a complaint with a supervisory authority under Article 77 GDPR.
Objection to direct marketing
Where your personal data is processed for direct-marketing purposes, you have the right to object to that processing at any time. Following your objection, your information will no longer be used for direct marketing.
Withdrawal of consent
You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Right to lodge a complaint
You may in particular contact the Czech supervisory authority responsible for us:
Úřad pro ochranu osobních údajů
Office for Personal Data Protection of the Czech Republic
Pplk. Sochora 27
170 00 Prague 7
Czech Republic
uoou.gov.cz
You may also contact a data-protection supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.
15. Required information
Providing certain personal data is contractually necessary in order to place, pay for and receive an order. Without information such as your name, delivery address, email address and the details required for the selected payment method, we cannot process your order.
Providing information for analytics, marketing or newsletters is voluntary. Refusing or withdrawing consent does not affect your ability to purchase from our online store.
16. Automated decision-making
We do not generally make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.
Payment service providers may use automated procedures under their own responsibility for fraud prevention, identity checks, creditworthiness assessments or decisions about the availability of a particular payment method. Further details are available in the privacy information of the relevant payment provider.
17. Data security
We and our service providers use appropriate technical and organisational measures to protect personal data against loss, destruction, unauthorised access, alteration or disclosure.
These measures include encrypted data transmission using TLS, access restrictions, authorisation controls, data backups and measures designed to detect and prevent misuse.
However, transmission of information over the internet can never be completely risk-free.
18. Changes to this Privacy Policy
We may update this Privacy Policy where legal requirements, the services we use or the way in which personal data is processed change.
The version published on this page is the applicable version. The date of the latest update is shown at the beginning of this Privacy Policy.
19. Contact for privacy enquiries
PMcolours · Progressive motor invest, s.r.o.
Záhumenní 686
739 23 Stará Ves nad Ondřejnicí
Czech Republic
Phone: +420 602 701 324
Email: info@pmcolours.eu
When submitting a privacy enquiry, please describe as precisely as possible which processing activity or order your request concerns. We may request additional information where necessary to verify your identity.