Privacy Policy
Effective from 2 October 2026
1. Who processes your data
The controller of your personal data is KREATICO art s.r.o., Tovární 157, 783 72 Velký Týnec, Czech Republic, Company ID 29443377, VAT CZ29443377, registered in the Commercial Register of the Regional Court in Ostrava, Section C, File 53614 ("we"). We operate the Acrylium brand and the acrylium.eu website.
For any data protection matters, contact us at [email protected] or at our registered address. We are not required to appoint a data protection officer.
2. What data we process and why
| When | What data | Purpose | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| Partner request | business type, sales channel, country, company name, website, VAT ID, first and last name, email, phone, message | reviewing and answering the request | Art. 6(1)(b) – pre-contractual steps | 2 years from last contact if no partnership is formed |
| Partner account | username, company name, email, currency, individual prices, password (hashed only) | portal access, wholesale prices | Art. 6(1)(b) – contract | duration of the partnership + 3 years |
| Orders | order contents, prices, note, date, status, contact email | order handling, invoicing, order history | Art. 6(1)(b) and (c) – contract and legal obligations | 10 years (accounting and tax rules) |
| Bumper Guard community photo | name, email, chosen colour, photo | review and – only with your consent – publication | Art. 6(1)(a) – consent | until consent is withdrawn, at most 3 years |
| Email communication | email address, message contents | answering questions | Art. 6(1)(f) – legitimate interest | 3 years |
| Website visits | IP address, browser type, access time (technical logs) | security and operation of the website, abuse prevention | Art. 6(1)(f) – legitimate interest | at most 30 days |
Partner data is mostly company data; personal data are the names, emails and phone numbers of contact persons.
The chat assistant on the website runs entirely in your browser – nothing you type is sent anywhere. The colour-matching tool processes the photo of your card only in your browser; we do not upload it unless you submit it yourself through the community gallery form.
3. Cookies and browser storage
We only use strictly necessary cookies and storage that the website needs to work:
acr_lang– remembered website language (1 year),- partner portal sign-in (session storage – cleared when you close the browser),
- order history and an unfinished cart in the portal (local browser storage).
We do not use advertising or tracking cookies. We measure traffic with Cloudflare Web Analytics, which uses no cookies and does not store IP addresses. Strictly necessary cookies do not require consent.
4. Who we share data with
We do not sell data. We share it only with processors that help us run our business, and only to the extent necessary:
| Processor | Purpose | Where |
|---|---|---|
| Cloudflare, Inc. | website hosting, partner and order database, protection against attacks | EU/USA |
| Resend (Plus Five Five, Inc.) | sending confirmation emails | EU (Ireland) / USA |
| Seznam.cz, a.s. | email inbox [email protected] | Czech Republic |
| external accountant | bookkeeping | Czech Republic |
| PPL CZ s.r.o. | parcel delivery | Czech Republic / EU |
For transfers outside the EU (USA) we rely on the European Commission adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses.
5. Your rights
You have the right to:
- access your data and receive a copy,
- have inaccurate data corrected,
- have your data erased when we no longer need it or you withdraw consent,
- restrict processing,
- data portability for data processed on the basis of a contract or consent,
- object to processing based on legitimate interest,
- withdraw consent at any time (e.g. for a published photo) – this does not affect processing before withdrawal.
We handle requests free of charge within 1 month at [email protected]. You may also lodge a complaint with the Czech supervisory authority (uoou.gov.cz) or with the data protection authority in your country.
6. Security
The website runs exclusively over an encrypted connection (HTTPS). Partner passwords are stored only as hashes (PBKDF2), repeated sign-in attempts are limited, and access to the administration is password-protected.
7. Changes
We may update this policy; the current version with its effective date is always on this page.