1. Who the data controller is

The controller of personal data is Švabín s.r.o., company ID (IČO) 26927462, VAT ID (DIČ) CZ26927462, registered office at Jičínská 226/17, Žižkov, 130 00 Praha 3, Czech Republic, entered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 107307.

For anything concerning personal data, write to us at [email protected].

We are not required to appoint a data protection officer and have not appointed one. Your requests are handled directly at the e-mail address above.

2. What data we process

• Identification and contact data: first and last name, e-mail, phone, delivery address or the pickup point or Z-BOX you selected.
• Order data: order contents, price, currency, order number, delivery and payment method, payment status and history, and for subscriptions the history of recurring payments.
• Payment data: payment is processed by the payment gateway. Only the payment type, the amount and a payment identifier reach us — we neither see nor store your card number.
• Content of communication: what you write in a form on the site or by e-mail, and for wholesale enquiries the name of the venue or company.
• Technical data: IP address, browser and device type, language, and data stored in cookies and in browser storage.

3. Why we process the data and on what legal basis

Where we process on the basis of consent, you can withdraw it at any time — by e-mail, via the unsubscribe link in the newsletter, or for cookies via the Cookie settings button at the bottom left of every page. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

We do not carry out automated decision-making or profiling that would produce legal effects for you or similarly significantly affect you.

4. Who we pass the data to

We pass data only to those who need it to get your order to you, and only to the extent necessary. We do not sell personal data.

5. Transfers outside the EU and EEA

Some of the providers listed above may process data outside the European Union and the European Economic Area, in particular in the United States. In such cases the transfer is safeguarded by a European Commission adequacy decision (the EU–US Data Privacy Framework) or by standard contractual clauses approved by the European Commission.

6. How long we keep the data

Once these periods expire we delete or anonymise the data.

7. Your rights

• The right of access — to confirmation of whether we process your data, and to a copy of it.
• The right to rectification of inaccurate data and completion of incomplete data.
• The right to erasure, where the reason for processing has ceased and no legal obligation stands in the way.
• The right to restriction of processing, for example while the accuracy of the data is being verified.
• The right to data portability for data obtained on the basis of consent or a contract, in a machine-readable format.
• The right to object to processing based on legitimate interest; you may object to direct marketing at any time and we will stop it immediately.
• The right to withdraw consent at any time where processing is based on consent.
• The right to lodge a complaint with the supervisory authority.

Exercise your rights by e-mail at [email protected]. We handle them without undue delay and no later than one month; in complex cases we may extend that by a further two months and will tell you if we do. So that we do not hand your data to a stranger, we may ask you to verify your identity.

8. Complaint to the supervisory authority

If you believe we are handling your data badly, you can turn to the supervisory authority. We would be glad of the chance to put it right first, but the right to complain is always yours.

9. Data security

The site runs exclusively over an encrypted HTTPS connection. Access to order data is limited to authorised people at the brewery and to our processors, with whom we have data processing agreements in place. Payment details stay with the payment gateway — they never reach us.

10. Changes to this policy

We may update this policy, for example when a new service or processor is added. The current wording is always on this page.

This policy takes effect on 7 August 2026.