Privacy policy.
PRIVACY & COOKIE NOTICE Version: 2026-11-04-v1 · 4 November 2026
1. Who is responsible
The seller operating BARACHEVSKY Store is the controller for the customer and visitor information described here. Stan Barachevsky is the public brand name; the controller's full legal name, business address and registration details are stated in Seller details on this website. Those details must be completed before the shop accepts orders. Privacy requests and customer support: info@barachevsky.store or the Support form. This notice describes this store, not the separate privacy arrangements of any future hosted CRM service processing its customers' own contacts.
2. Data and purposes
Orders and delivery: checkout email, optional name, selected products, order identifiers, amount, currency, payment/refund/dispute status, delivery status, licence details and acceptance records. We use these to enter into and perform the contract, supply access, verify purchases and provide support (GDPR Article 6(1)(b)); retain legally required records (Article 6(1)(c)); and protect transactions and establish or defend claims (Article 6(1)(f), our legitimate interests in preventing abuse and protecting legal rights). We do not receive or store your full card number or card security code; Stripe processes payment details in its own checkout.
Support and withdrawal: the details you submit, correspondence, order reference, request timestamps and resolution. We use these to answer enquiries, deal with the contract and complaints, and meet consumer-law obligations; the relevant bases are Article 6(1)(b), (c) and, for general enquiries and security, (f). Do not include unnecessary sensitive information or other people's personal data.
Newsletter and discount offers: email, subscription source, date, wording/version of consent, personal offer and subscription preferences. Product news and promotional messages use a separate affirmative opt-in (Article 6(1)(a)); purchase or free access does not automatically subscribe you. Unsubscribe using the link in a marketing message or contact us. Withdrawal of consent does not affect earlier lawful processing, your purchased licence or necessary order emails. We may retain a minimal suppression record and evidence of earlier consent to respect an opt-out and address legal claims (Article 6(1)(c) or (f), as applicable). A discount is governed by its disclosed eligibility and expiry, not permission to ignore an unsubscribe.
Security and operation: hosting providers process connection information such as IP address, browser/device information, requests and technical logs to deliver and secure the website, limit abuse and investigate failures. Our legitimate interests are a functioning, secure store and fraud prevention (Article 6(1)(f)). Application rate limits use a keyed hash derived from the requesting address; rate-limit records older than 24 hours are eligible for deletion during subsequent request cleanup. We do not use solely automated decisions producing legal or similarly significant effects. Checkout validation, eligibility checks and rate limits may run automatically; contact Support for a human review of a problem.
3. Service providers and recipients
We disclose only information needed for the relevant service. Cloudflare provides website hosting, network security, the customer/order database, private file storage and owner authentication. Resend delivers transactional emails and any authorised email communications. Stripe handles checkout, payment processing and related risk/compliance activities and acts in its own controller capacity for some payment purposes. Zoho provides the business support mailbox when you email us. The site currently loads Google Fonts: your browser contacts Google's font servers with connection information to display the typefaces. We use that for consistent, readable presentation, based on our legitimate interest in operating the site; these font requests are not our advertising analytics.
Relevant provider information: Cloudflare: https://www.cloudflare.com/privacypolicy/ and https://www.cloudflare.com/cloudflare-customer-dpa/ Resend: https://resend.com/legal/privacy-policy and https://resend.com/legal/dpa Stripe: https://stripe.com/privacy Zoho: https://www.zoho.com/privacy.html Google Fonts: https://developers.google.com/fonts/faq/privacy
Authorised professional advisers, accounting providers and authorities may receive the limited records needed for their work or a legal requirement. We do not sell customer contact lists. Access to the store administration is restricted to the owner. We do not give other customers access to your order or contact details.
4. Locations and international transfers
The store uses a Cloudflare database provisioned in the EU and Resend's EU sending region. This is not a promise that every provider operation, support access or network request stays exclusively in the EU. Providers may process data in the EEA and other countries, including the United States. Where a restricted transfer occurs, the applicable legal mechanism must be in place, such as an adequacy decision covering the recipient or appropriate safeguards including the European Commission's standard contractual clauses and supplementary measures where required. Provider notices and data-processing terms describe their arrangements. Contact us for information about safeguards relevant to your data.
5. Retention
We retain data only for the relevant purpose and applicable legal duties. Purchase/licence records are needed while we provide the purchased rights or access and, afterwards, for the applicable claims period, generally three years unless a longer legal obligation or active dispute requires more. Tax/accounting records are kept for the statutory period applicable to the particular record, which may be up to ten years; this does not mean that every support message is kept for ten years. Support correspondence is normally reviewed for deletion within two years of resolution unless needed for a continuing contract, legal duty or dispute. Marketing contact data is kept until consent is withdrawn or the list is retired; a minimal opt-out record may remain for as long as necessary to prevent further unwanted messages. Consent and claim evidence may be retained for the relevant limitation period. Backups and provider security logs follow the applicable service retention cycles; relevant data may remain isolated until those cycles expire. Deletion or anonymisation can be requested as described below.
6. Cookies and browser storage
The store uses localStorage and sessionStorage for the requested shopping basket, your discount code and display preferences for the subscription window. Basket data is removed after a successful paid checkout or when you empty the basket or clear site storage; otherwise it remains in your browser. A stored discount is used only while valid, normally 30 days. A dismissal preference is used to avoid reopening the offer for seven days; session flags last for the browsing session. Underlying persistent entries can remain until you clear them. Storage of a requested basket or preference is separate from permission to send marketing emails. Owner login and security providers may use necessary authentication/security cookies. Stripe's checkout has its own provider cookies and information.
We do not currently deploy advertising pixels or optional audience analytics on the storefront. If we introduce optional tracking, we will explain it and obtain consent before placing non-essential cookies or equivalent tracking where required; refusing optional tracking will not block a purchase. You can clear or block site storage in your browser, but a basket, discount reminder or login may stop persisting.
7. Your choices and rights
Subject to the GDPR's conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw a marketing consent at any time. An objection to direct marketing will be respected. Some records cannot be erased immediately where a legal obligation or a necessary legal claim requires retention; we will explain any refusal or restriction. We may request proportionate identity verification to avoid disclosing another person's records. We normally respond within one month; any lawful extension and its reason will be communicated within that period.
You may complain to your competent data-protection authority, including the authority in your habitual residence, workplace or place of the alleged infringement. The Czech authority is Úřad pro ochranu osobních údajů, https://uoou.gov.cz/ , Pplk. Sochora 27, 170 00 Praha 7, Czech Republic. You need not first complain to us.
An email is needed to supply digital access and send a receipt; without it we cannot fulfil an online order. The checkout name is optional unless a particular service or legal document requires more information. A newsletter subscription is optional. We do not knowingly direct this store at children; a minor should not submit unnecessary data and must have the legal capacity or appropriate adult authorisation for a transaction. Policy changes will be dated and significant changes communicated where required; a new purpose requiring consent will not be authorised merely by continuing to browse.