Privacy Policy

This Privacy Policy explains how DRAKKARIA s.r.o. processes personal data collected through WULFLUND.com, including orders shipped to customers in the European Union and worldwide. As a company established in the European Union, we comply with the General Data Protection Regulation (GDPR). Other privacy laws may also apply depending on the country concerned and the circumstances of processing.

1. Who is responsible for your personal data

DRAKKARIA s.r.o.
Neklanova 145/14
128 00 Prague 2
Czech Republic
Company ID: 03602524
VAT ID: CZ03602524
Registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File No. 233356.

E-mail: shop@wulflund.com
Phone: +420 777 948 705

You can also use this e-mail address for privacy-related enquiries and requests.

2. What data we process and why

Depending on how you use our store, we may process your name, contact details, billing and delivery addresses, order contents and history, payment and delivery information, customer communications, technical website data and information concerning your marketing preferences.

  • Orders, customer accounts, payments, deliveries, returns and complaints: processing necessary to enter into or perform a contract with you (Article 6(1)(b) GDPR).
  • Accounting, taxes and other legal obligations: processing necessary to comply with applicable legal obligations (Article 6(1)(c) GDPR).
  • Customer enquiries, website security, fraud prevention and protection of legal claims: depending on the circumstances, performance of a contract or our legitimate interests in providing customer support, securing our services and protecting our rights (Article 6(1)(b) or (f) GDPR).
  • Preparation of anonymised customer communications to improve our language model: processing necessary to anonymise customer communications for this purpose is based on our legitimate interests (Article 6(1)(f) GDPR). You have the right to object to this processing.
  • Optional newsletters and non-essential analytics and advertising technologies: your consent where required by law (Article 6(1)(a) GDPR).
  • Offers of our own similar products to existing customers: our legitimate interest in direct marketing (Article 6(1)(f) GDPR), but only where the applicable electronic marketing rules allow us to use a customer contact without separate consent.

3. Which information you need to provide

To place an order, you must provide the information marked as required in the checkout, particularly the details necessary to identify and contact you, arrange payment and deliver your order. Providing this information is generally a contractual requirement; certain billing information is also required by law. Without the necessary information, we may be unable to accept or fulfil your order.

Optional form fields, newsletter subscriptions and consent to non-essential analytics or advertising are voluntary and are not a condition for purchasing goods. Creating a customer account is not a condition for ordering where guest checkout is available.

4. Payments, worldwide shipping and customer communication

Depending on the selected payment method, we share necessary payment and order information with the relevant bank or payment service provider, which may include Stripe and PayPal where offered in checkout. Complete card numbers are normally handled by the payment provider rather than stored by our store. We receive information needed to confirm and record payments.

For delivery, we share the necessary details with the selected carrier, postal operator or logistics provider, such as your name, delivery address, phone number, e-mail address and shipment information. The carrier used depends on the destination and type of goods.

For deliveries outside the European Union or European Economic Area, your information may also need to be shared with customs brokers, carriers and customs or tax authorities in the destination or transit country. This can involve transfers outside the EEA. We share only the data needed for the shipment, customs clearance and related legal obligations.

If you contact us by e-mail, phone or form, we process the information you provide to answer your enquiry. For returns, contract withdrawals and complaints, we also process information needed to identify the order, handle your request and make any refund.

Customer communication (Automail)

If you e-mail us, we process your message as a ticket in our Automail helpdesk application. The controller of your personal data is DRAKKARIA s.r.o. (Company ID: 03602524). We process your name, e-mail address, the contents of your message and any information you provide in connection with an order, payment, delivery address or complaint.

The purposes of this processing are to handle your enquiry, order or complaint and to protect our rights in the event of a dispute. The legal bases are performance of a contract or steps taken before entering into a contract (Article 6(1)(b) GDPR), compliance with legal obligations concerning accounting and tax documents (Article 6(1)(c) GDPR) and our legitimate interests in establishing, exercising or defending legal claims after the matter has been resolved (Article 6(1)(f) GDPR).

Automail is operated on our behalf by GODS s.r.o. (Company ID: 45787956) as our data processor. Processing takes place on a server in the Czech Republic. We use Amazon SES to send and receive e-mails and Amazon S3 for backups in a data centre in Frankfurt am Main, Germany. These services are provided by Amazon Web Services EMEA SARL. The language model used to suggest replies runs on the Automail operator's own server. We do not send customer correspondence to external artificial intelligence providers.

Anonymised communications (without names or contact details) may be used by GODS s.r.o., which operates Automail on our behalf, to improve the language model that suggests replies. The legal basis is legitimate interests (Article 6(1)(f) GDPR). You may object to this processing by contacting the controller at shop@wulflund.com.

5. Newsletters and marketing communications

We use Ecomail, operated by ECOMAIL.CZ, s.r.o., to send marketing e-mails. Ecomail processes information needed to deliver messages, manage unsubscribes and, where permitted, measure campaign performance on our behalf.

If you voluntarily subscribe to our newsletter, we process your e-mail address on the basis of your consent, which you can withdraw at any time.

Where permitted by the laws applicable to a recipient, we may also e-mail existing customers with offers for our own similar products or services using an address obtained during a purchase. We do this only where the customer was given an appropriate opportunity to opt out when the address was collected and in each subsequent message, and has not opted out. Where a jurisdiction requires prior consent, we obtain it instead.

You can unsubscribe free of charge using the link in any marketing e-mail or by writing to shop@wulflund.com. We may retain the minimum information needed to respect your opt-out request. Transactional messages necessary for orders, payment, delivery, returns and complaints are not marketing messages.

Where measuring individual newsletter opens or clicks involves processing that requires consent, we carry out that measurement only after obtaining the required consent.

6. Technical operation and website security

When you use our website, technical data may be processed, including your IP address, the time of access, requested pages, browser and device details, and information about technical errors or security events. We use this information to operate the website, secure it against attacks, prevent misuse and resolve problems. The legal basis is normally our legitimate interest (Article 6(1)(f) GDPR), or contract performance where appropriate.

Our e-commerce platform and related technical services are provided by Simplia. We use Google reCAPTCHA to protect certain forms from automated misuse. In connection with this service, Google may process IP addresses, browser and device information. The use of the service is subject to the applicable rules on data protection and access to information stored on users' devices.

7. Cookies, analytics and advertising

We use strictly necessary cookies and similar technologies for the shopping cart, sign-in, security and privacy preferences. Other technologies, including analytics and advertising identifiers, are used only in accordance with the rules applicable to the visitor, including obtaining prior consent where required. You may change or withdraw your choices through the cookie preferences controls available on the website. You can also contact us if you cannot access those controls.

Google Analytics 4

Google Analytics 4 helps us understand website traffic and store usage. This may include page visits, events, online identifiers, device information, approximate location data and purchases.

Microsoft Clarity

Microsoft Clarity helps us find usability issues by analysing interactions such as clicks, scrolling, mouse movements and session recordings. Sensitive personal details and payment fields should be appropriately masked in recordings.

Meta Pixel

Meta Pixel helps us measure advertising on Facebook and Instagram, including product views, cart events and purchases. Meta may combine relevant information with other information it holds about its users.

These descriptions apply to the tools when active on the website. The use of non-essential tracking must follow the visitor's consent choices and any additional rights granted by applicable local law.

8. Who receives personal data

Depending on the purpose, personal data may be disclosed to providers of the store platform and hosting, security and technical providers, banks and payment companies, shipping and customs service providers, Ecomail, accounting and tax advisers, and analytics and advertising providers where a valid legal basis exists. For customer communications, we also use GODS s.r.o. as the data processor operating Automail, and Amazon SES and Amazon S3 provided by Amazon Web Services EMEA SARL. We also disclose information to public authorities where required by law.

Recipients may act as our processors or as independent controllers, depending on the service. We do not sell or rent customer contact lists to data brokers. However, certain advertising technologies can qualify as the sharing of personal information under some local laws; where those laws apply, relevant notice and choice requirements must also be respected.

9. International transfers of personal data

Automail data is processed on a server in the Czech Republic, and backups are stored through Amazon S3 in a data centre in Frankfurt am Main, Germany. Because WULFLUND.com accepts orders for delivery worldwide and uses international service providers, personal data may also be transferred or made accessible outside the European Economic Area, including in the destination country of an order and, for certain technology providers, the United States.

Transfers covered by Chapter V of the GDPR must use an appropriate legal mechanism. This may be a European Commission adequacy decision, including the EU-US Data Privacy Framework for participating and properly certified US recipients, or the European Commission's Standard Contractual Clauses with additional protective measures where required. In specific cases, an exception permitted by Article 49 GDPR may be applicable, for example where a transfer is necessary to fulfil an individual international delivery contract; such exceptions are not a blanket basis for routine transfers to service providers.

To ask which transfer mechanism applies to a particular provider, or how to access relevant safeguards or obtain a copy where applicable, contact shop@wulflund.com.

10. How long we keep data

  • Invoices and tax or accounting documents: for 10 years from the end of the relevant tax period in our accounting records, not in customer support tickets.
  • Order data: for the performance of the contract; Automail correspondence relating to a completed order is kept for 3 years. Data that also forms part of accounting or tax documents is retained for the legally required period.
  • Complaints, returns and other customer grievances: related Automail correspondence is kept for up to 5 years from receipt of the goods.
  • Ongoing legal disputes: related correspondence is kept until the dispute has been resolved and for a further 3 years.
  • General customer enquiries not related to an order: Automail correspondence is kept for 1 year from the last message.
  • Customer accounts: for the life of the account, except where certain records must be retained after deletion.
  • Newsletters: until you withdraw consent or object, subject to any period necessary to demonstrate prior lawful processing. Minimal suppression records may be kept to respect opt-out requests.
  • Technical, analytics and marketing data: for the period appropriate to their purpose and the actual retention settings of the service concerned. When no longer needed and no other lawful basis requires retention, they are deleted or anonymised.

After these periods have expired, we delete Automail correspondence or irreversibly anonymise it, unless continued retention is required by law or an ongoing dispute.

11. Your rights and complaints

Subject to the GDPR's conditions, you have rights of access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests. You can object at any time to processing of your personal data for direct marketing. You may also withdraw consent at any time with effect for the future. Withdrawal does not affect processing already carried out lawfully.

We do not use solely automated decision-making that produces legal or similarly significant effects on whether your order is accepted. Analytics and advertising services may produce audience or interest groups where legally permitted.

To exercise your rights, e-mail shop@wulflund.com. Under the GDPR, we normally respond within one month. We may ask for reasonable proof of identity where necessary.

You may complain to a data protection supervisory authority, including the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz, or another competent supervisory authority in the EU/EEA.

Depending on where you live and whether a local privacy law applies to our business and processing, you may have additional rights, such as access, deletion or the ability to opt out of certain advertising-related disclosures. Please contact us at the address above to make a request. Such rights are assessed under the law that actually applies, rather than assumed to be identical in every country.

12. Updates to this policy

We update this policy when our processing activities, providers or applicable legal requirements change.

Last updated: 26 October 2026.