Privacy
Who processes your data
Seller to the Czech Republic and the EU: Tomáš Srbecký, company ID 87168057, I. Olbrachta 910/34, 370 06 České Budějovice, Czech Republic, contact hello@boxedclassic.com. The same person processes the data from accounts and from the contact form.
Orders delivered outside the EU are processed by ESTOM s.r.o., company ID 05672856, B. Smetany 1428/61, 370 01 České Budějovice, Czech Republic, contact hello@boxedclassic.com.
What is collected
If you only browse: nothing that identifies you. There are no advertising cookies, no third-party trackers and no cookie banner, because there is nothing to consent to. Visits are counted with Cloudflare Web Analytics, which does not use cookies and does not fingerprint visitors.
Your cart is stored in your own browser, not on the server.
If you write through the form: your name, email address, the message itself and the IP address it came from. The IP is only used to stop one sender flooding the inbox, and it is deleted with the message. Messages are deleted once the answer has been sent.
If you order: your email address, name, delivery address and any note you write. That is the minimum needed to send a parcel and issue a record of the sale.
If you create an account: your email address, password and address if you fill it in, plus your list of favourites. The password is stored so that nobody can read it, us included. Staying signed in takes one cookie, without which the site could not tell it is you.
Why, and for how long
Order data is processed to perform the contract and kept as long as accounting law requires. Nothing is used for marketing — there is no newsletter and no profiling.
Invoices are kept for 10 years, as Czech VAT law requires.
An account is kept until you delete it, which is one button in the account itself. Your orders then stay in the shop's accounting records, but are no longer linked to you.
Who else sees it
- PayPal, if you pay with it, receives what it needs to process the payment. Card details are entered on PayPal's side and never reach this server.
- Stripe, if you pay by card, receives what it needs to process the payment. Card details are entered on Stripe's side and never reach this server.
- Resend, the email provider, transmits order confirmations and account emails.
- Cloudflare serves the images and analytics.
- The carrier gets the delivery address on the parcel label.
Nothing is sold, rented or shared beyond that.
Your rights
You can ask for a copy of your data, for corrections, or for deletion of anything not required by accounting law — write to hello@boxedclassic.com. You may also complain to your national data protection authority.
Last updated: 12 November 2026.