Privacy policy

This policy explains how KHANAGHA collects and uses personal data when you visit this store or place an order.

1. Data controller

Elvin Mammadzada, OSVČ, operating KHANAGHA
IČO: 19100752
Registered address: Šimáčkova 1379/4, Holešovice, 170 00 Praha 7, Czech Republic
Privacy contact: khanaghaeu@gmail.com

KHANAGHA is a trading name of this sole trader; it is not a separate legal entity.

2. What we process, and why

Operating an online store necessarily involves processing certain personal data, including data needed to:

  • take and fulfil your order (for example, your name, delivery address, and order contents),
  • communicate with you about your order or an enquiry you've sent us,
  • process payment for your order, and
  • meet our own legal obligations (for example, retaining certain records for accounting purposes).

Depending on how you interact with KHANAGHA — for example, browsing the store, creating an account, placing an order, or contacting us — the categories of personal information that may be collected or processed, where applicable, include:

  • Contact details — name, address, billing address, shipping address, phone number and email address.
  • Financial information — credit/debit-card and financial-account information, transaction details, payment method and payment confirmation. This is processed through Shopify Payments, not directly by KHANAGHA — see section 5 for how payment processing works; KHANAGHA does not receive or store your complete payment-card details.
  • Account information — username, password, security questions, preferences and settings, if you create a customer account. Your password and security-question answers are handled by Shopify's account system; KHANAGHA cannot view your password.
  • Transaction information — products viewed, added to your cart or wishlist, purchased, returned, exchanged or cancelled, and your past transactions.
  • Communications with KHANAGHA — including customer-support enquiries you send us.
  • Device information — device, browser, network connection, IP address, and other unique identifiers.
  • Usage information — how and when you interact with or navigate the store.

This list describes categories of information that may be collected depending on how you use the store — it does not mean every field above is collected from every visitor or customer.

3. Purposes and legal bases

Purpose Likely legal basis
Taking and fulfilling your order Performance of a contract with you
Responding to an enquiry you send us Performance of a contract, or our legitimate interest in replying to you
Marketing communications, if you opt in Your consent, which you may withdraw at any time
Meeting legal/accounting obligations Legal obligation

This table describes the general categories of processing involved in running an online store.

For the "Marketing communications" row: new subscribers to email or SMS marketing must confirm their subscription through double opt-in before receiving marketing messages, as described in section 7 below.

4. Shopify's role

This store runs on Shopify's e-commerce platform. Shopify provides the hosting, checkout, and store infrastructure KHANAGHA relies on, and processes certain personal data (such as order and checkout information) on our behalf as part of providing that infrastructure. Payments made through this store are processed using Shopify Payments, Shopify's own payment service. Shopify's own handling of this role is described in Shopify's own privacy and data-processing documentation.

5. Payment processing

Payments are processed through Shopify Payments. For customers in the European Economic Area, the relevant Shopify entity is:

Shopify International Limited
The Sidings, 4th Floor
Grand Canal Quay
Dublin D02 E7K8
Ireland

Shopify and its authorised payment processors may process the information needed to:

  • process and authenticate your transaction;
  • prevent fraud and abuse;
  • comply with payment, accounting, sanctions, anti-money-laundering and other applicable legal obligations; and
  • administer refunds, disputes and chargebacks.

KHANAGHA does not directly receive or store your complete payment-card details. Payment information is entered into, and processed through, Shopify's payment infrastructure and the relevant authorised payment providers, not KHANAGHA's own systems.

Depending on the specific processing activity involved, Shopify and its payment processors may act as a data controller, a processor, or another role recognised under applicable law — their exact role is not the same for every activity, and this policy does not assume a single role applies across the board.

Shopify maintains a current, regularly updated list of the subprocessors it uses — including the payment processors that support Shopify Payments — at https://help.shopify.com/en/manual/your-account/privacy/subprocessors. Rather than reproducing that list here, where it could go out of date, this policy points to Shopify's own maintained page as the authoritative source.

6. Shipping

Fulfilling your order requires sharing necessary delivery details (such as your name and address) with the delivery partner used for your order. KHANAGHA works with several delivery partners — Česká pošta, Balíkovna, Zásilkovna (Packeta), GLS, and DHL — and the specific one used for a given order can depend on the destination, the parcel, and operational availability at the time. See Shipping & Delivery for details.

7. Apps and other processors

Messaging by Shopify is installed on this store. As part of the app's general access, it is permitted to access the following data about customers and store visitors: name, email address, phone number, physical address, geolocation, IP address, browser, and operating system. Having access to this data is not the same as it being used — the features actually enabled on this store are:

  • an automated "Complete your order" email, sent to customers who leave checkout without finishing their purchase;
  • automated cart-reminder, back-in-stock, price-drop, and browse-abandonment reminder emails, based on a visitor's or customer's activity on the store;
  • email open tracking (so we can see whether a marketing or automated email was opened) and UTM tracking on links in these emails (so we can see which email or campaign drove a visit); and
  • Smart Delivery, a Shopify feature that prioritizes sending these emails to recipients more likely to engage, and holds them back for recipients who haven't been engaging.

All of the above currently operates over email only. SMS and WhatsApp marketing have not been activated on this store, even though the Messaging app's general permissions include phone-number access. New subscribers to email or SMS marketing must confirm their subscription through double opt-in before receiving marketing messages, once such a channel is active.

Besides Messaging by Shopify, the store also has two apps used to translate store content: Translate & Adapt (by Shopify) and T Lab – AI Language Translate. Online Store and Point of Sale are Shopify's own sales channels, not separately installed apps — their role in providing the store's platform and checkout infrastructure is covered in section 4 above, not here.

8. Analytics and advertising

No custom or third-party advertising/analytics tracking pixels are currently installed on this store through Shopify's Customer Events. This store does, however, have Shopify Network Intelligence enabled (Settings → Customer privacy, in Shopify admin). When enabled, Shopify securely uses this store's customer data together with data from other Shopify merchants to improve products, advertising/ad targeting, and personalization for the store, as part of what Shopify calls "Enhanced Services." According to Shopify, no other merchant can access this store's data as part of this feature.

This can be turned off at any time in Shopify admin under Settings → Customer privacy, which (per Shopify) stops Shopify from using this store's customer data for that purpose going forward. Customers also have their own routes to opt out or object: via Shopify's data-sharing opt-out page or privacy portal (https://privacy.shopify.com), a Global Privacy Control (GPC) browser signal, or their cookie consent preferences on this store.

9. Cookies

This store uses Shopify's built-in cookie consent banner, which is shown to visitors and lets you choose Accept all, Decline all, or select specific categories and Save my choices. The categories are:

Category Description Can be turned off?
Required Necessary for the website to function, including login and cart functions No — always active
Personalization Optional Yes
Marketing Optional Yes
Analytics Optional Yes

Required cookies are used regardless of your choice, since the store can't function without them. Personalization, Marketing, and Analytics cookies are only used if you accept them, either via "Accept all" or by selecting them individually and saving your choices.

As noted in section 8, no custom or third-party app tracking pixels are installed on this store — the cookies set on this storefront come from Shopify's own platform, not from separately added tracking tools.

For the individual cookies behind each category above — exact cookie names, purposes, and durations — Shopify controls and maintains the definitive, current list of cookies used on merchant storefronts, at:

https://www.shopify.com/legal/cookies

We link to Shopify's own page rather than reproducing a static copy here, because Shopify may add, remove, rename, or change the purpose or duration of these cookies at any time, and some of them only appear depending on which store features are in use (for example, a cookie tied to Shop Pay only applies if a visitor uses Shop Pay at checkout) or on this store's own privacy-rule configuration. Not every cookie listed on Shopify's general page is necessarily active on this specific store — Shopify's page itself notes which cookies are conditional.

10. How long we keep your data

We keep personal data only for as long as needed for the purpose it was collected for. Our general retention periods are:

Data Retention period
Orders, invoices, payment confirmations, tax and accounting records Up to 10 years, where required for Czech tax/accounting compliance
Customer accounts While your account is active; deleted or anonymized after 3 years of inactivity, except information linked to records that must be kept longer (for example, order/tax records above)
Customer-service communications, returns and complaints 3 years after the matter is closed, unless needed longer for an active dispute or legal claim
Marketing subscriber data Until you withdraw consent, or after 3 years without engagement
Evidence of marketing consent or its withdrawal 3 years after we stop relying on that consent
Abandoned checkouts 3 months, reflecting Shopify's documented platform retention for this data
Technical, analytics and cookie data Retained according to the applicable Shopify or provider settings and documented cookie lifespan for each cookie — see section 9

We may retain information for longer than the periods above where legally required, where necessary for an active dispute or legal claim, or where subject to a legal hold. Once none of those apply, the information is deleted or anonymized.

11. International data transfers

Because this store runs on Shopify's global infrastructure, some processing of your data may take place outside the European Economic Area (EEA). When Shopify transfers personal data outside the EEA, UK, or Switzerland, it uses different legal safeguards depending on the specific transfer involved — not a single mechanism for every transfer:

  • Binding Corporate Rules (BCRs) — used for transfers of data from the EEA or Switzerland to other Shopify entities located outside the EEA or Switzerland.
  • Standard Contractual Clauses (SCCs) — used, for example, for transfers from the UK to outside the UK, EEA, or Switzerland, and more generally for transfers to Shopify's third-party subprocessors, using the European Commission's Standard Contractual Clauses, the UK's International Data Transfer Addendum, and the Swiss Federal Act on Data Protection's amended version of the SCCs, as applicable.
  • An adequacy decision — Shopify may rely on the European Commission's adequacy decision for Canada to support transfers of data from Shopify International Limited to its Canadian parent company, Shopify Inc.

Which of these applies to a given transfer depends on where the data is going and which Shopify entity or subprocessor is involved. Full details are set out in Shopify's own Data Processing Addendum.

12. Your rights

If data-protection law applicable to you grants these rights, you may generally:

  • ask what personal data we hold about you, and request a copy;
  • ask us to correct inaccurate data;
  • ask us to delete your data, in certain circumstances;
  • object to, or ask us to restrict, certain processing;
  • ask for your data in a portable format; and
  • withdraw consent at any time, where processing relies on consent.

To exercise any of these rights, email khanaghaeu@gmail.com.

13. Complaints to the supervisory authority

If you're not satisfied with how we've handled your personal data, you have the right to complain to your local data-protection authority. In the Czech Republic, this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ):

14. Changes to this policy

We may update this policy — for example, to reflect changes in the tools we use or in the law.

Last updated: 10 October 2026