Privacy Policy
Last updated: 10.9.2026
The short version: We collect only what we need to send you our card deck and keep in touch if you asked us to. We never sell your data. Payment details go straight to Stripe – we never see your card number. You can ask us anytime what we know about you, or ask us to delete it. Write to gdpr@threebodyproduct.com.
Who we are
Three Body Product is run by Nikolaj Mokry, a sole trader registered in the Czech Republic.
Registration No. (IČO): 74321161
Address: Junácká 1621/13, 169 00 Praha 6 – Břevnov, Czech Republic
Email: gdpr@threebodyproduct.com
Under EU data protection law (GDPR), this makes me the “data controller” for the personal data described below.
What we collect and why
1. When you join the launch list or newsletter
We store your email address in MailerLite, the tool we use to send updates about the deck – like the launch date and your discount code. After signing up you’ll get a confirmation email; we only add you to the list once you click it. Legal basis: your consent. You can unsubscribe with one click in any email, or by writing to us, and we’ll remove you from the list.
2. When you place an order
We collect your name, email and the details of your order. If you choose home delivery, also your delivery address and – only if you give it – your phone number, which the carrier may use to contact you about the delivery. If you ask for a company invoice, also your company name, company ID, VAT ID and billing address. We use them to confirm your order, pack it, ship it, and handle any returns or complaints. Legal basis: performing our contract with you. Without this data we simply can’t deliver your deck.
3. When you pay
Payments are processed by Stripe. Your card details go directly to Stripe over an encrypted connection – they never touch our servers and we never see them. We only receive a confirmation that the payment went through, plus basic transaction info (amount, last 4 digits, country). See Stripe’s privacy policy.
4. When we ship your order
We pass your name and email – and, for home delivery, your delivery address and phone number (if you gave it) – to our delivery carrier (currently Packeta), so they can deliver the parcel and send you tracking updates. For some countries the carrier hands the parcel to a local partner for the final delivery.
5. When you email us
We keep the correspondence so we can help you and remember what we agreed. Legal basis: our legitimate interest in answering you properly.
6. After your purchase
We may occasionally email you about the product you bought (like new canvases or a restock). Legal basis: our legitimate interest in keeping customers informed. Every such email has an unsubscribe link.
7. When you browse this site
We use Google Analytics to understand how the site is used – but only if you allow it in the cookie banner. Details, including how to change your mind later, are in our Cookie Policy.
Who we share data with
Only with services that help us run the shop – never for their own marketing, and we never sell your data to anyone. Our processors:
| Service | What for | Where |
|---|---|---|
| GreenGeeks | website hosting | EU (Amsterdam) |
| MailerLite | stores the launch list / newsletter emails and sends the updates | EU |
| Stripe | payment processing | EU/USA (EU Data Privacy Framework) |
| Delivery carriers | parcel delivery and tracking updates | EU |
| website analytics (Google Analytics 4) – only with your consent | EU/USA (EU Data Privacy Framework) | |
| Our invoicing software | invoices for business customers (sole traders’ details are personal data too) | EU |
We may also disclose data if the law requires it (e.g. to tax authorities).
How long we keep it
- Launch list / newsletter emails: until you unsubscribe, or after 3 years of no activity.
- Order and invoice data: 10 years – Czech tax law requires this.
- Other order-related records (correspondence, complaints): up to 5 years, in case we need to resolve a dispute.
When the period ends, we delete the data.
Your rights
You can ask us to:
- tell you what data we hold about you (access),
- correct it,
- delete it (where the law doesn’t require us to keep it – e.g. invoices must stay),
- hand it over in a machine-readable format (portability),
- stop a particular use (objection), or
- withdraw a consent you gave earlier.
Just email gdpr@threebodyproduct.com – we’ll reply within 30 days.
If you’re not happy with how we handled your data, you can complain to the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, uoou.gov.cz) or to the data protection authority in your own EU country.
A few more things
- We don’t use your data for automated decision-making or profiling.
- This site isn’t directed at children.
- If we change this policy, we’ll update the date at the top; for significant changes we’ll let subscribers know by email.