How we handle your data

The controller of your personal data is Jetlio, s.r.o., Voroněžská 2547/1, 616 00 Brno, Company ID (IČO) 09967231, registered at the Regional Court in Brno under C 121887—the operator of the Tiskárník platform. For anything concerning personal data, reach us at podpora@tiskarnik.cz. We have not appointed a data protection officer (the statutory conditions are not met); the agenda is handled by the managing director.

The print shop's role depends on who sells your order—your order always shows which case applies:

For orders where Tiskárník is the seller, the shop produces your order as our subcontractor and processes the order data on our behalf as a processor, under a data-processing agreement with us.

For orders where the print shop sells directly, it handles the order in its own name and is an independent controller of the order data (contact, files, delivery address where applicable) that we pass to it for production, handover and complaints.

Either way the shop receives only the data needed for your order, nothing more.

Guest orders. Contact name, email and phone, a delivery address where applicable; your notes; and the print files themselves. Access to the order is protected by a random access key in the link; keep it safe, it works as the key to your order. Legal basis: performance of the contract; legal obligations for documents and complaints.

Print files can contain anything—including sensitive documents. We treat them accordingly: private EU storage, time-limited links, access restricted to fulfilling the order (the chosen shop and, where needed, its printer via our MagicPrint device). We never look into your files out of curiosity, never use them for anything but the order, and never train anything on them.

Payments and documents. For orders sold by Tiskárník we process incoming-payment data from bank statements (payer account, amount, variable symbol—to match your payment and handle refunds) and we issue the tax documents. We never see card data; counter card payments go through the shop's terminal. Legal basis: performance of the contract; accounting and tax obligations.

Print shop accounts. Email, name, phone, billing identity, bank account, the shop details the print shop itself publishes (contacts, addresses, price list); for platform-sales cooperation also settlement records and accepted agreements. Passwords are stored solely as secure hashes.

Reviews. A rating and text tied to a completed order, published under the name you choose. The review form is reachable only through the private order link—that is how we verify each review against a genuine purchase.

Technical data. Ordinary server logs (IP address, request time) necessary to run and secure the service. Legal basis: our legitimate interest in a secure service; retention short, in weeks.

Order messages. What you write with the print shop and with our Support—see the separate section below.

Analytics only with your consent from the cookie bar (PostHog, EU servers)—details and revocation in the cookie policy.

Ad measurement likewise only with your consent from the cookie bar (Google Ads, Google Ireland Ltd.)—only whether one of our ads brought you to the order; we do not target ads at you. Google may process the data outside the EU under the adequacy decision for the EU-U.S. Data Privacy Framework. Details in the cookie policy.

We never sell personal data. No decision with legal effects on you is made purely automatically.

For every order you can write with the print shop handling it in Messages—on the order page, or by replying to the email that tells you about a new message. Either of you can start the conversation. You don't have to use Messages; your order is fulfilled without them too.

What we process. The text of messages and the attachments you send (JPG, PNG, WebP or HEIC photos and PDFs up to 10 MB); who wrote a message, when, and whether it came from the website or by email; read status—up to which message each party has read the conversation and how many messages are waiting for them (we use it to decide on notifications; it is not shown to the other side as a read receipt); for a request to involve Support, its time and your optional note, which only Support sees. When you reply by email, we keep the sender address, subject, text, attachments and only the technical headers we need to file the reply in the right conversation and to recognize automatic replies and spam (such as Message-Id, In-Reply-To, Auto-Submitted). Quoted text of earlier emails is stripped from the reply. We do not analyze message content automatically (apart from spam and auto-reply filters on emails), we do not use it for advertising, and we do not train any artificial intelligence on it.

Why, and on what legal basis.

• Communication between you and the print shop about the order (files, deadline, handover, changes) and email notifications about unread messages. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Involving Support when you ask for it with the "Get Support involved" button. Support then sees the whole conversation history and replies in it. Legal basis: performance of the contract.
• Support looking into a conversation nobody invited it to—only where needed to handle a complaint or dispute about the order, to investigate reported abuse, fraud or a breach of the terms, to fix a technical fault, or to establish, exercise or defend legal claims and meet obligations toward authorities. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in properly fulfilling orders we are responsible for as the seller, in a secure platform and in protecting legal claims. We protect your privacy by looking only for these reasons and only as far as necessary, and every such view is logged (who, when and which conversation; Support signing in to a print shop's account for technical help is logged too). The logs exist to check that access is not misused.
• Abuse prevention: limits on the number of messages and attachments, checking that an attachment really is an image or a PDF, rejecting spam and automatic replies, and verifying that an email reply arrived at the address issued for that conversation. Legal basis: legitimate interest in a secure service free of spam and fraud.
• Messages may serve as evidence in a complaint or a dispute about the order. Legal basis: legitimate interest in establishing, exercising and defending legal claims; for complaints also compliance with a legal obligation (Art. 6(1)(c) GDPR).

You may object at any time to processing based on legitimate interest (see Your rights)—we will assess the objection and stop unless compelling legitimate grounds prevail, typically an open complaint or dispute.

Who sees the messages. You and the print shop handling your order (in the role explained above—for orders sold by Tiskárník, as our processor). Tiskárník Support, i.e. authorized people at Jetlio, s.r.o.—at your request, otherwise only for the reasons above. Notifications of new messages are sent by email through Mailgun (EU servers), which also receives your email replies. When you ask for Support, Support gets an SMS (via BulkGate) to its work phone in addition to the email—it contains only the service name and the order number, no message text and none of your details. No other print shop, no other customer and no one else can see the conversation.

Replies by email. Every notification has its own reply address (reply+…@mg.inkaround.com). It is valid for 180 days and we may invalidate it earlier—for example when you change your contact email. Anyone who knows that address can post to the conversation, so do not forward the notification email. If a reply comes from a different address than the one we sent the notification to, we record that with the message.

Please don't send sensitive data. Messages are not meant for health data or other special categories of personal data (Art. 9 GDPR), national ID numbers, payment card numbers, passwords or access codes. We will never ask you for a card number or a password in a message; the bank transfer details are always on your order page. If you send something like that by mistake, write to podpora@tiskarnik.cz and we will have it erased.

The print shop you choose—the order data (in the role explained above). Carriers—name, phone, email and the destination when you choose delivery (Zásilkovna/Packeta and the carrier of your parcel). Infrastructure: Amazon Web Services (EU, Frankfurt—storage and servers), Cloudflare (website hosting and protection). Communication: Mailgun by the Sinch group (EU region—transactional emails, message notifications and receiving email replies to Messages), BulkGate (SMS where you give a phone number, and Support's SMS alerts without message content). Messages and their attachments are stored in our database and in private AWS storage in Frankfurt. Our bank—statements for payment matching on orders sold by Tiskárník.

Maps and address suggestions (OpenFreeMap, Photon by komoot) are loaded directly by your browser; browser geolocation, if you allow it, stays on your device.

All our processors have signed a data processing agreement with us (Art. 28 GDPR). We store data on servers in the EU/EEA. Amazon Web Services, Cloudflare and Mailgun, however, belong to groups headquartered or present in the USA, and their engineers may access the systems from there (for example for support or troubleshooting). Such transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795) where the recipients are certified, and additionally on the EU standard contractual clauses (Decision (EU) 2021/914) with supplementary measures such as encryption. We will send you a copy of these safeguards on request.

Print files: for the order and the complaint period, at most 26 months after the order closes; earlier deletion on request when no complaint is open. Tax documents and settlements: statutory periods (up to 10 years). Order contact data: up to the limitation period of contract claims. Logs: weeks. Analytics and ad measurement: per your consent.

Order messages (text, attachments, read status) belong to the order: the conversation is writable from placing the order until 60 days after it closes (fulfilled, canceled or declined), then it stays read-only. We keep messages as long as the order contact data—at most for the limitation period of contract claims, because they may serve as evidence in a complaint or dispute—and then delete them together with the order. Received email replies in their original form (text, headers, attachments) are deleted no later than 30 days after receipt; the conversation keeps only the resulting message and a technical delivery record (sender, time, processing result). Reply-by-email addresses expire after 180 days. Attachments uploaded but never sent are deleted after 24 hours. Logs of Support viewing a conversation are kept as long as the conversation itself.

Encrypted transport everywhere (HTTPS), private storage with signed, time-limited links, role-based access, encrypted secrets, EU data centers and tested backups. Shops reach orders only through authenticated accounts; print files never travel by email. Message attachments can be opened only by the conversation's participants (the print shop through its signed-in account, you through the private order link) via links valid for at most 15 minutes; notification emails contain the text of new messages and only the names of attachments. Messages are displayed as plain text—no scripts and no tracking elements.

If a security breach likely to risk your rights occurs, we notify the Office for Personal Data Protection within 72 hours and, where the risk to you is high, we tell you directly without undue delay.

You can at any time ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Consent (analytics, ad measurement) can be revoked as easily as it was given. Write to podpora@tiskarnik.cz—we answer within 30 days.

If you believe we process your data unlawfully, you can complain to the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. We will be glad if you try us first.