Privacy notice

Information for visitors and customers of SOFAAH Design and SOFAAH Passion. Version privacy-2026-10-22-v3, 22 October 2026.

1. Who is responsible for your data

The controller is SMILE DESIGN s.r.o., company ID 02025345, Královédvorská 249, 541 01 Trutnov, Czech Republic. For privacy matters, contact info@sofaah.com or write to our registered address. This notice covers www.sofaah.com and passion.sofaah.com, the shared purchase process, customer account and related communication.

2. What data we obtain and where from

Depending on the service, we process your name, email, telephone number, delivery and billing address, business and tax details, ordered products, price and currency, delivery details, payment reference and status, enquiries and related correspondence. We mainly obtain these directly from you; payment or delivery information may also come from the relevant provider.

For an optional account, we process your login email, a secure password hash, profile, saved addresses, your own orders, and data needed for security, email verification and password recovery. We record the language and Design/Passion registration context. Communication choices are recorded separately for Design and Passion, including grants, refusals or withdrawals, time, source, language, notice version and wording, and contact verification.

For website operation and security, we process technical data, particularly IP addresses, request times, requested URLs, browser information, and operational or error records. Do not share your login details, order access links or password recovery links. Please do not enter unnecessary sensitive personal information in notes.

3. Purposes and legal bases

• Enquiries, quotations, renovation and rental: handling your request, taking steps at your request before a contract and performing any contract under Article 6(1)(b) GDPR; other enquiries based on our legitimate interest in proper communication under point (f).
• Purchases, production, payment, delivery and complaints: entering into and performing a contract under point (b). Accounting and tax obligations fall under point (c); necessary protection of legal claims under point (f).
• Optional account: providing the service you request under point (b), and security and abuse prevention under point (f). Neither an account nor a purchase requires marketing consent.
• Website security: our legitimate interest in protecting systems, data and rights under point (f).

Order messages use the language of that order. You can change your preferred language for future communication in your account; this does not change historical orders or authorise marketing. Service messages are not marketing and do not depend on consent to offers.

4. Design and Passion offers are separate

Following a purchase, subject to section 7(3) of Czech Act No. 480/2004, we may use the email obtained in connection with the sale for offers of our own similar design products and services. The processing basis is our legitimate interest under Article 6(1)(f) GDPR. You can easily object free of charge when ordering, and every offer must provide the same option. We also respect that refusal on subsequent purchases.

Optional Design email news requires separate consent under Article 6(1)(a) GDPR. Passion offers and inspiration containing erotic content require a separate explicit choice intended for adults. A purchase, registration, visit to Passion or age confirmation does not replace that choice. Choosing Design does not mean choosing Passion, or vice versa. Withdrawing consent does not remove your account or prevent purchases.

You can change consents and objections in your account or email info@sofaah.com. Withdrawal does not affect the lawfulness of previous processing. We do not circumvent an objection or unsubscribe request by switching the legal basis for the same offers. Before any mailing launch, we will also provide unsubscribe access without a customer account.

Current status: marketing mailings have not launched. Saved choices do not automatically enrol you in Ecomail or another external platform. Before activation, we will publish an appropriate notice update, including validity rules.

5. Passion privacy

We do not use purchase data to determine sexual orientation or intimate preferences or to build advertising audiences. The account is shared, but communication permissions remain separate. Simple age confirmation does not require a date of birth or identity document. Where particular data reveals sex life or sexual orientation, processing is also subject to the special conditions of Article 9 GDPR; ordinary marketing consent or a contract alone does not replace those conditions.

6. Who may access data

Access is limited to authorised persons acting for the controller and, where necessary, hosting and technical administration providers, email delivery providers, carriers, payment services, accounting and invoicing services, professional advisers and public authorities where a legal basis exists. A processor must act under appropriate contractual terms and instructions; carriers, banks and other recipients may act as independent controllers depending on their activities.

We use SMTP provided by Seznam.cz, a.s. for email delivery (provider information). A payment provider receives only data needed for the chosen payment method. Ecomail, advertising pixels, Hotjar and Heureka questionnaires do not currently receive customer data from this new installation. A product feed is not a customer list.

A provider's registered address alone does not rule out transfers outside the European Economic Area. Before using a service involving such transfers, we assess safeguards and use an appropriate GDPR mechanism, such as an adequacy decision or standard contractual clauses and necessary supplementary measures. Contact us for information about specific recipients and safeguards.

7. Cookies and measurement

Necessary cookies support the basket, sign-in, security and remembering choices. You can allow or refuse optional analytics in cookie settings; refusal does not prevent purchases or registration. Cookie choices are stored for 180 days and age confirmation for 30 days. Marketing emails and analytics consent are independent.

Analytics in the new installation is currently disabled. The prepared Google Analytics integration uses a browser identifier, so the data is not anonymous. Limited purchase measurement is designed without product names, line items or contact details; it includes value, currency and an opaque transaction identifier. Account pages do not load analytics, and advertising personalisation is not allowed. Before activation, we will update information about the providers actually used and any transfers.

8. How long we retain data

• Orders and claims: for performance and then to the extent necessary for complaints, warranties and the exercise or defence of rights, according to applicable time limits and any disputes.
• VAT documents: generally 10 years from the end of the tax period in which the supply occurred, under Czech VAT law. This is not a blanket retention period for all customer data.
• Account: while providing the account you choose to use. Request closure or erasure at info@sofaah.com; statutory documents and data necessary for other lawful purposes may remain separately.
• Unordered basket: one calendar month from creation or the last change.
• Enquiries: while handling them and then only as necessary for follow-up correspondence or legal claims.
• Communication choices: according to the validity of the relevant permission; limited evidence of consent or refusal may remain afterwards to demonstrate compliance and respect unsubscribes, not to send further offers.
• Technical records and backups: according to what is necessary for operation, recovery, specific incident investigations and protection of rights. Backups are not an independent basis for renewed active use of data; erasure requests must also be respected during restoration.

9. Your rights

Subject to the GDPR, you may request access, rectification, erasure, restriction and portability, withdraw consent, or object to legitimate-interest processing. Objections to direct marketing are respected without further assessment of its benefits. Email info@sofaah.com; we may reasonably verify identity where necessary. We normally respond within one month and will explain any lawful extension.

You can complain to the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7. Required fields are needed for the chosen service or legal obligations; without them we may be unable to provide the service. Accounts, marketing consents and optional analytics are voluntary. We do not make solely automated decisions with legal or similarly significant effects.