Privacy policy

1. Data Controller

The controller of your personal data is StepAtmo s.r.o., Company ID (IČO): 22472711, with its registered office at Korunní 2569/108, Vinohrady, 101 00 Praha 10, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, File No. C 416369 (the "Controller").


Contact for personal data matters: info@stepatmo.cz, +420 777 697 205.

2. What Data We Process and Why

a) Order fulfilment (performance of the contract)

Name and surname, delivery and billing address, e-mail, phone number, details of the ordered goods and payment. Without this data the order cannot be fulfilled. We process the data for the duration of the order processing and further for the duration of the periods for exercising rights arising from defective performance.

b) Compliance with legal obligations

We retain billing data and tax documents for the period required by law (in particular the Czech VAT Act and Accounting Act), generally 10 years.

c) Customer account

If you create a customer account, we process your login details and order history for as long as the account exists. The account can be cancelled at any time.

d) Marketing

We send commercial e-mail communications (newsletter):


  • to customers on the basis of our legitimate interest (in connection with a previous purchase of similar goods),

  • to others only on the basis of consent.


You can unsubscribe at any time using the link in every e-mail. We process marketing data until consent is withdrawn / an objection is raised.

e) Communication and support

We process data from e-mail, telephone and WhatsApp communication for the time necessary to handle the request, at most 2 years.

3. Recipients and Processors

We share personal data only to the extent necessary for the above purposes with the following categories of recipients:


  • Shopify International Ltd. (e-commerce platform provider),

  • manufacturers and fulfilment partners for made-to-order goods (e.g. Printful) — name and delivery address for production and dispatch,

  • carriers — data necessary for delivery,

  • payment service providers — payment processing (payment card data is processed exclusively by the payment gateway provider; the Controller has no access to it),

  • accounting and invoicing service providers,

  • providers of analytics and marketing tools (to the extent set in your cookie preferences).


Some processors (in particular Shopify and fulfilment partners) may process data outside the EU/EEA; transfers take place on the basis of the EU Standard Contractual Clauses or an adequacy decision.


Relationship with Shopify: The store runs on the Shopify platform, which processes data about your access and purchases in connection with the operation of the services, and for certain features acts as an independent controller. For details on how Shopify handles personal data, see the Shopify Consumer Privacy Policy; you can exercise your rights towards Shopify via the Shopify Privacy Portal.

4. Cookies

The store uses cookies necessary for its operation (cart, login) and — only with your consent given in the cookie banner — also analytics and marketing cookies. You can change your settings at any time in the cookie banner.

5. Your Rights

In connection with the processing of personal data you have the right to:


  • access your data,

  • have inaccurate data corrected,

  • erasure (unless a legal obligation to retain the data prevents it),

  • restriction of processing,

  • data portability,

  • object to processing based on legitimate interest (including marketing),

  • withdraw consent at any time.


You can exercise your rights at info@stepatmo.cz. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.gov.cz, or with the supervisory authority in your country of residence.

6. Security

Data is processed electronically on a secured platform with encrypted transmission (TLS). Access to the data is limited to persons who need it for the performance of their duties.

7. Effective Date

This Privacy Policy takes effect on 1 August 2026. It is a translation of the Czech Privacy Policy; in the event of any discrepancy, the Czech version prevails.