Privacy Policy**PRINTSTEP

s.r.o.

*Effective from: 1 May 2026 Version: 1.

0*## 1. Introductory

provisions### 1.1 Data

Controller The data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the ‘GDPR’) is:

PRINTSTEP s.r.o. Company registration number: 27947807 VAT number: CZ27947807 Registered office: Jičínská 226/17, 130 00 Prague 3, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File No. 128622 (hereinafter referred to as the “Controller” or “we”)

1.2 Contact details for data protection enquiries –

Email: [email protected] (requests from data subjects)

– Telephone: +420 246 082

412 – Postal address: same as the

Controller’s registered office### 1.3 Data Protection Officer (DPO)

The Controller is not obliged to appoint a Data Protection Officer pursuant to Article 37(1) of the GDPR (it does not process personal data on a large scale or sensitive categories of personal data). All enquiries and requests from data subjects are handled directly by the Controller via the contact details provided above.

1.4 Web interfaces to which this policy applies

This policy applies to the processing of personal data via

:- easybag.com (international online shop)

taskahned.cz and taskahned.sk (local online shops in the Czech Republic and Slovakia)
any other domains of the Controller listed in the statement of processing activities##

Definitions

Term	Meaning
Personal data	Any information relating to an identified or identifiable natural person
Data subject	A natural person whose personal data we process (you)
Controller	PRINTSTEP s.r.o. — determines the purposes and means of processing
Processor	A third party that processes data on the instructions of the Controller (e.g. hosting)
Processing	Any operation involving data (collection, storage, use, disclosure, erasure)
Consent

A freely given, specific, informed and unambiguous indication of consent

|## 3. What personal data do we collect###

3.1 When visiting the website (automatically)

IP address and approximate geolocation (at city level)
Browser type and version, operating

system- Date and time of visit, pages visited, time spent on the page-

Referring URL (referrer)

Session identifier (session cookie)
Data collected by Google reCAPTCHA Enterprise (see Article 8)

3.2 When registering and maintaining a user account-

First name and

surname- Email address-

Telephone number (optional)

Password (stored only in hashed form — bcrypt)

3.3 When ordering

goods- Identification details: first name, surname, Company registration number, VAT number (for business customers)

Contact details: telephone number,

email address- Billing

address- Delivery address-

Order details (goods, quantity, price)

We do not accept or store payment details (these are processed by Stripe / GoPay as independent data controllers — see Article 5)

3.4 When communicating with the

helpdesk –

Sender’s email address – Message content and any

attachments – Any details you provide yourself (telephone number, order number, etc.)

– Conversation records (internal tickets, operators’ notes)

3.5 When completing forms (contact, feedback, enquiry)

Examples of forms: contact form, feedback form (/references), B2B enquiry form, request for quotation.

Data collected

:- First name and

surname- Email

address- Telephone number (optional)

Order number (optional)
Content of the message /

enquiry- Rating (1–5 stars, for the feedback form only)

Any attached photographs (max. 5 MB, JPG/PNG/WebP/PDF only)
Technical data: IP, user-agent, timestamp (audit trail)

communications – Email

address – Record of consent granted and any withdrawal thereof –

Record of messages sent and your interaction with them (opens, clicks)

3.7 Cookies and similar technologies

See Article 7 below.

4. Purposes of processing and legal basis

Purpose of processing	Data categories	Legal basis	Retention period
Fulfilment of orders and delivery of goods	Identification, contact, address and order details	Performance of a contract (Article 6(1)(b) of the GDPR)	Duration of the contract + 4 years (warranty, complaints)
Issuing tax documents and maintaining accounts	Identification, billing	Compliance with a legal obligation (Article 6(1)(c)) — Act No. 235/2004 Coll. on VAT, No. 563/1991 Coll. on Accounting	10 years from the end of the tax period
Operation of a user account	Identification, contact and authentication data	Performance of the contract (Article 6(1)(b))	Until the account is closed + 1 year
Handling of complaints	Identification, contact and order details	Compliance with a legal obligation + performance of a contract	4 years from the conclusion of the complaint
Communication with the helpdesk	Contact details, content of communication	Legitimate interests (Article 6(1)(f)) — customer support	7 years from the last communication
Processing of form requests / feedback	Contact details, content, photographs	Legitimate interest (Article 6(1)(f)) — processing of the request	2 years from the last contact
Protection against spam (reCAPTCHA Enterprise)	Technical, behavioural	Legitimate interest (Article 6(1)(f)) — security	6 months (stored by Google)
Rate-limiting and protection against misuse	IP address, timestamp	Legitimate interest (Article 6(1)(f))	1 hour (Redis cache)
Sending marketing communications (newsletter)	Email address	Consent (Article 6(1)(a)) or legitimate interest (customer pursuant to Section 7(3) of Act No. 480/2004 Coll.)	Until consent is withdrawn or 5 years of inactivity
Ad targeting and remarketing	Online identifiers, behaviour	Consent (Article 6(1)(a))	As per settings in the cookie banner, max. 13 months
Analytics and website performance measurement	Anonymous/pseudonymous behavioural	Consent (Article 6(1)(a)) — analytical cookies	As per settings, max. 26 months
Defence of legal claims	All relevant	Legitimate interest (Article 6(1)(f))	For the duration of the limitation period (max. 10 years)

Recipients of personal data (processors)

We transfer your personal data to the following processors, who process it exclusively on our instructions and in accordance with the terms of a Data Processing Agreement (DPA):

5.1 Hosting and infrastructure

Processor	Purpose	Registered office	Transfer outside the EU
Hetzner Online GmbH	Server hosting, databases, backups	Germany (Falkenstein, Nuremberg)	No (EU)
Forpsi (Internet CZ, a.s.)	Backup storage (Object Storage)	Czech Republic	No (EU)
Cloudflare, Inc.	CDN, DDoS protection, WAF	USA (registered office); EU edge servers	Yes — safeguards via Standard Contractual Clauses (SCC) + Data Privacy Framework

###

5.2 The payment services

Stripe and GoPay act as independent controllers for payment transactions. We only pass on to them the data necessary to process the payment; you enter your payment details (card number, CVC) directly with them; we do not store them.

Processor	Purpose	Registered office
Stripe Payments Europe, Ltd.	Card payment processing	Ireland
GoPay s.r.o.	Payment processing (cards, bank transfers, e-wallets)	Czech Republic

###

5.3 Delivery of goods

We only provide the carrier with the data necessary for delivery (name, address, telephone number, email). Carriers are independent data controllers in relation to this data.

Carrier	Registered office
PPL CZ s.r.o.	Czech Republic
GLS	Czech Republic
Direct Parcel Distribution CZ s.r.o. (DPD)	Czech Republic
GEIS	Czech Republic

###

5.4 Communication services

Processor	Purpose	Registered office
PRINTSTEP s.r.o. — internal SMTP server (Postal)	Sending transactional emails	Hetzner DE (own infrastructure)
Google Ireland Limited	Google Workspace (Controller’s internal emails)	Ireland

###

5.5 Security and anti-spam services

Processor	Purpose	Registered office	Transfer outside the EU
Google Ireland Limited / Google LLC	reCAPTCHA Enterprise — form protection against spam (see Article 8)	Ireland / USA	Yes — SCCs + Data Privacy Framework

Note: For administrator authentication, the Controller uses its own self-hosted installation of the open-source software Logto on its own servers (Hetzner). Administrators’ data is processed exclusively by the Controller on its own infrastructure — there is therefore no external processor for authentication services.

5.6 Localisation and translation services

Processor	Purpose	Location	Note
DeepL SE	Translation of website texts	Germany	No (EU)
Anthropic PBC	Claude AI — translation of the user interface	USA	Only technical website text, no customer PII

###

5.7 Analytics and marketing (with consent only)

Processor	Purpose	Registered office
Google Ireland Limited	Google Analytics 4, Google Tag Manager (GTM)	Ireland
Meta Platforms Ireland Limited	Facebook Pixel	Ireland

Note: GTM itself does not store personal data, but serves as a container for triggering other tagging scripts (GA4, Pixel, etc.). Specific processing takes place within the individual connected services.

5.8 External accountancy services

We transfer accounting records to an external accountancy firm for the purposes of bookkeeping and tax consultancy (a statutory obligation under Act No. 563/1991 Coll. on Accounting).

We will provide a current list of external accounting partners on request at

[email protected].## 6. Transfer of personal data to third countries

Some of our processors are based outside the European Economic Area (EEA) or process data there, particularly in the USA. In such cases, we apply the following safeguards

:- Standard Contractual Clauses (SCCs) approved by the European Commission-

Data Privacy Framework (DPF) — for processors certified under the EU-US Data Privacy Framework-

Data Processing Agreements (DPAs) with each

processor- Transfer Impact Assessment (TIA) in accordance with the judgment of the Court of Justice of the European Union in Case C-311/18 (Schrems II)

Specific processors outside the EEA are listed in the table in Article 5.

7. Cookies and similar technologies###

7.1 What are cookies

? Cookies are small text files stored by your browser when you visit a website. They are used to remember preferences, for authentication and to measure website traffic.

7.2 Categories of cookies used on the website

Category	Purpose	Legal basis	Retention period	Examples
Essential	Website functionality (shopping basket, login, language)	Legitimate interest (Art. 6(1)(f)) — the website does not function without them	Session-based or max. 1 year	session, cart, locale
Security	Protection against spam and attacks (reCAPTCHA)	Legitimate interest (Art. 6(1)(f))	6 months	_GRECAPTCHA
Functional	Remembering preferences (theme, region)	Consent (Art. 6(1)(a))	Up to 1 year	theme, region
Analytical	Traffic measurement, A/B testing	Consent (Art. 6(1)(a))	Max. 26 months	_ga, _ga_*
Marketing	Ad targeting, remarketing	Consent (Article 6(1)(a))	Max. 13 months	_fbp, _gcl_au

###

7.3 Managing cookie

consent A cookie banner will appear on your first visit. You can change or withdraw your consent at any time

:- By clicking on the ‘Cookie settings’ link in the website footer-

In your browser settings (deleting or blocking cookies)

Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal of consent.

We use Google Analytics 4 and Google Tag Manager to track website traffic. Tracking requests are not sent directly to Google’s servers, but first to our own server at the domain gtm.easybag.com (known as server-side Google Tag Manager), which we operate in a data centre in Germany. Only from there is the data transmitted to Google Analytics 4 (Google Ireland Limited). This gives us control over what data reaches Google.

We use Google Consent Mode v2 (extended mode)

: - Before consent is granted, we do not store any analytics or marketing cookies, and only anonymous data—without identifiers or cookies—is sent to Google (so-called ‘cookieless pings’). At the same time, ad data redaction (ads_data_redaction) is enabled

.- Once consent has been granted, analytical and, where applicable, marketing cookies are activated and tracking takes place in full

.- Refusing to give consent does not affect the functionality of the website.

Google Analytics 4 does not store your IP address; it uses it only to deduce an approximate location and then discards it. We retain user-level and event-level data in Google Analytics 4 for a period of 14 months.

We do not store your consent choice in a cookie, but in the browser’s local storage under the key ‘eb_consent_v1’; which contains only information on whether consent has been given and the date of your choice. You can change your choice at any time via the ‘Cookie Settings’ link in the website footer, or remove it by clearing your browser’s website data. We do not use any external consent management platform — the cookie banner is our own solution and does not pass your data to third parties.

7.5 Transmission of e-shop events to Meta (Conversions API)

Selected events from the e-shop — product views, adding to basket, initiating an order and completing a purchase — are transmitted to Meta Platforms Ireland Limited (Ireland). Events are sent via two parallel channels: directly from your browser via the Meta Pixel, and simultaneously from our own server on the gtm.easybag.com domain via the Conversions API. The server-side channel does not pass through any other intermediary.

From the server, we transmit: the event name and time, the URL of the page visited, the order value and currency, the order ID and details of the items ordered, a unique event ID, identifiers from Meta’s marketing cookies (_fbp, _fbc), your IP address and your browser details (user-agent). The unique event identifier enables Meta to recognise that the event received from the browser and from the server is one and the same, and to ensure it is not counted twice. We do not transmit your email address, telephone number or any other direct contact details.

The legal basis is your consent to marketing cookies (Article 6(1)(a) of the GDPR). Without this consent, nothing is sent to Meta — neither from the browser nor from the server. You may withdraw your consent at any time via the ‘Cookie Settings’ link in the website footer; such withdrawal does not affect the lawfulness of processing prior to withdrawal.

8. Google reCAPTCHA Enterprise — specific information

To protect our forms against automated abuse (bots, spam), we use the Google reCAPTCHA Enterprise service provided by Google Ireland Limited (registered office: Gordon House, Barrow Street, Dublin 4, Ireland).

8.1 What data does reCAPTCHA

collect?-

Device IP address- User-agent (browser and operating system type)

Google cookies on the google.

com domain - Date, time and duration of interaction with the

form - Mouse movements, clicks, screen touches (anonymised behavioural data)

Browser fingerprint (resolution, plug-ins, fonts, language)
Data you have entered into the form (used for contextual purposes — not for ad targeting)

8.2 Purpose and legal basis-

Purpose: Detection and blocking of automated (bot) form submissions; protection against spam and fraud

.- Legal basis: The legitimate interest of the Controller and the user in the security of web forms and the integrity of communication (Article 6(1)(f) of the GDPR).

8.3 Status of the contracting parties –

PRINTSTEP s.r.o. — Data Controller

– Google Ireland Limited / Google LLC — Data Processor

– A Data Processing Agreement (DPA) containing the European Commission’s Standard Contractual Clauses (SCCs) has been concluded between the parties.

8.4 Retention period –

Controller (PRINTSTEP): Risk scores are stored for up to 30 days (after which they are aggregated into anonymous statistics).

Google: Raw data is retained for a maximum of 6 months in accordance with Google’s own retention rules (Google Privacy Policy).

8.5 Transfer to third countries

Google Ireland processes data primarily within the EU, but may transfer it to its parent company, Google LLC, in the USA. This transfer is protected by Standard Contractual Clauses (SCCs) and certification under the Data Privacy Framework (DPF).

8.6 Google’s

Terms and Policies By using our forms, you agree to

:- Google’s Terms of Service-

Google’s Privacy Policy## 9. Your rights under the GDPR

As a data subject, you have the following rights vis-à-vis the Controller:

You may request confirmation from us as to whether we are processing your personal data and, if so, you have the right to obtain a copy of it.

If your data is inaccurate or incomplete, you have the right to have it rectified or completed without undue delay.

You have the right to request the erasure of your data if:

The data are no longer necessary for the purpose for which they were collected-

You withdraw your consent and there is no other legal basis-

You object to the

processing on legitimate grounds- The data have been processed unlawfully

Exceptions: Data that we are required by law to retain (invoices — 10 years), or data necessary for the defence of legal claims (up to the expiry of the limitation period) cannot be erased.

In certain situations (e.g. verification of accuracy, raising an objection), you have the right to request that we temporarily cease processing your data.

If we process your data on the basis of a legitimate interest, you have the right to object to this at any time. We will cease processing the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests.

In the case of direct marketing, you may object at any time — without having to provide a reason — and we will immediately stop processing for this purpose.

Where we process data on the basis of consent or the performance of a contract, by automated means, you have the right to receive your data in a structured, commonly used and machine-readable format (JSON / CSV).

If you have given us your consent (e.g. to receive a newsletter), you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

We do not use automated decision-making with legal consequences. The reCAPTCHA risk scoring system merely determines whether a form is displayed — it does not determine your rights or obligations.

9.9 How to exercise

your rights You may submit your request

:- By email:

[email protected] By post: to the Controller’s registered office (see Article 1.1)

We will process your request without undue delay, at the latest within one month of receipt. In justified cases, this period may be extended by a further 2 months — we will inform you of this.

To verify your identity, we may ask you for additional information (particularly if the request was not sent from an email address registered with us).

9.10 Right to lodge a complaint

If you are not satisfied with how your request has been handled or if you believe we are in breach of the GDPR, you have the right to lodge a complaint with the supervisory authority:

Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7 Tel.: +420 234 665 111 Email: [email protected] Website:

www.uoou.cz## 10. Personal data

security We have implemented the following technical and organisational measures:

10.1 Technical

measures- Encryption in transit: TLS 1.3 for all communication between users, servers and

processors- Encryption at rest: AES-256 on the database storage, encrypted backups

Password hashing: bcrypt with a high work factor-

Private storage: Files from forms (avatars, attachments) stored in private storage with UUID names (URLs cannot be guessed) and ACL control-

Regular backups: Daily automatic backups to two independent off-site locations (Hetzner Storage Box + Forpsi Object Storage), 14-day retention period-

Web Application Firewall (WAF): Cloudflare with protection against the OWASP Top 10-

Rate limiting: Protection of forms and APIs against

abuse – DDoS protection:

Cloudflare – Anti-spam: Google reCAPTCHA

Enterprise – Honeypot array: Hidden detection of automated

submissions – Self-hosted authentication: Logto on our own servers (no transfer of authentication data to third parties)

10.2 Organisational

measures- Data minimisation principle: We collect only the data necessary for the specific purpose-

Access restriction principle: Only authorised persons have access to personal data (Logto SSO + role-based access control)

Confidentiality agreements with employees and external

collaborators- Data Processing Agreements (DPAs) with all data processors-

Audit log: Record of accesses and changes to sensitive data-

Regular security reviews — at least once a year##

10.3 Procedure in the event of a security incident

In the event of a personal data breach that could result in a high risk to the rights and freedoms of natural persons

:- We will report the incident to the supervisory authority (ÚOOÚ)

within 72 hours- We will inform the data subjects concerned without undue delay-

We will document the incident and the

measures taken## 11. Cookies — overview of specific cookies

Cookie name	Domain	Purpose	Duration	Category
easybag_session	easybag.com	Identification of logged-in session	Session	Strictly necessary
easybag_cart	easybag.com	Shopping basket contents	30 days	Strictly necessary
locale	easybag.com	Selected website language	1 year	Strictly necessary
region	easybag.com	Selected region (CZ/SK/EU)	1 year	Functional
cookie_consent	easybag.com	Record of consent to cookies	1 year	Essential
_GRECAPTCHA	google.com	Google reCAPTCHA Enterprise	6 months	Security
_ga, _ga_*	easybag.com	Google Analytics 4 — traffic measurement	13 months	Analytical (consent)
_gid	easybag.com	Google Analytics — daily identifier	24 hours	Analytical (consent)
_gcl_au	easybag.com	Google Ads conversions (via GTM)	90 days	Marketing (consent)
_fbp	easybag.com	Facebook Pixel	3 months	Marketing (consent)

Note: The specific list of active cookies may vary depending on your consent and the current configuration of the website. You can find the current status in the cookie settings in the website footer.

12. Processing of children’s

data Our website and services are not primarily intended for persons under the age of 16. We do not knowingly collect personal data from children under the age of 16 without the verifiable consent of a legal guardian. If we discover that we have collected a child’s data without consent, we will delete it immediately.

13. Changes to the

Privacy Policy This policy may be updated from time to time. The current version is always available on the Controller’s website. We will notify you of any significant changes

:- By email — if you have an active account with us or are a newsletter subscriber-

Via a banner on the website — at least 30 days before the change

takes effect Version history:

Version	Effective from	Main changes
1.0	1 May 2026	First published version (includes reCAPTCHA Enterprise disclosure)

Final Provisions

This policy is governed by the laws of the Czech Republic, in particular

:- Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)

Act No. 110/2019 Coll., on the processing of personal data-

Act No. 480/2004 Coll., on certain information society services

Act No. 89/2012 Coll., the Civil Code-

Act No. 235/2004 Coll., on Value Added Tax

Act No. 563/1991 Coll., on Accounting

In the event of any discrepancy between the English (or any other foreign-language) version of this policy and the Czech version, the Czech version shall prevail.

This policy comes into effect on 1 May 2026 and supersedes all previous versions.

PRINTSTEP s.r.o. Prague, Czech Republic