Privacy Policy

Last updated: 18 August 2026

1. Controller and Contact Details

The controller responsible for the processing of personal data in connection with this website and our online shop is:

SYN2 s.r.o.
Národní 60/28
Nové Město
110 00 Praha 1
Czech Republic

Company ID No.: 22378154

Website: www.conbined.com
Privacy contact: info@conbined.com

SYN2 s.r.o. is hereinafter referred to as “we”, “us”, “our” or the “Controller”.

2. Scope of this Privacy Policy

This Privacy Policy explains how we collect and process personal data when you:

  • visit or use our website and online shop;

  • create or use a customer account;

  • place an order;

  • contact us;

  • subscribe to marketing communications;

  • interact with our advertisements;

  • use embedded content, videos or social-media functions;

  • use our virtual assistant or other interactive website tools; or

  • otherwise interact with our online services.

Personal data means any information relating to an identified or identifiable natural person.

3. Categories of Personal Data We Process

Depending on how you interact with us, we may process the following categories of personal data.

3.1 Identification and contact data

This may include:

  • first name and surname;

  • billing and delivery address;

  • e-mail address;

  • telephone number; and

  • customer or account identifiers.

3.2 Order and transaction data

This may include:

  • products ordered or purchased;

  • order number, order history and order status;

  • invoice information;

  • delivery and return information;

  • payment method;

  • payment status;

  • transaction amount; and

  • information required for refunds or payment reconciliation.

We generally do not receive or store complete payment-card details when a payment is processed directly by a payment service provider.

3.3 Communication data

When you contact us, we may process:

  • the content of your enquiry;

  • correspondence by e-mail, contact form, chat or other channels;

  • customer-support history; and

  • information you voluntarily provide during the communication.

3.4 Technical and security data

When you access our website, certain technical information may necessarily be processed for website delivery, security and troubleshooting. This may include:

  • IP address;

  • date and time of access;

  • requested URL or file;

  • referrer URL;

  • browser type and version;

  • operating system;

  • device information; and

  • technical log and error information.

3.5 Usage, analytics and advertising data

Where you have given the required consent, we may additionally process information such as:

  • pages visited;

  • clicks and interactions;

  • session and device identifiers;

  • cookie identifiers;

  • advertising identifiers;

  • approximate location derived from technical information;

  • referring websites or advertising campaigns;

  • shopping and conversion events;

  • products viewed or added to a shopping cart; and

  • interactions with advertising or embedded media.

4. Purposes, Legal Bases and Retention

4.1 Orders and performance of contracts

We process identification, contact, order, transaction and communication data in order to:

  • process and fulfil orders;

  • deliver products;

  • process payments;

  • administer returns and refunds;

  • provide customer support;

  • maintain customer accounts; and

  • handle contractual claims.

The legal basis is Article 6(1)(b) GDPR.

We retain such data for as long as necessary to perform the contract and thereafter for the applicable statutory limitation and retention periods.

4.2 Compliance with legal obligations

We process and retain data where required by applicable accounting, tax, commercial, regulatory or other legal obligations.

The legal basis is Article 6(1)(c) GDPR.

Accounting, invoice and tax records are retained for the statutory periods applicable under Czech law and any other mandatory law applicable to us.

4.3 Website operation, security and fraud prevention

We process technical and log data in order to:

  • provide the website;

  • maintain system security;

  • detect technical errors;

  • prevent fraud and abuse;

  • protect our IT systems; and

  • investigate security incidents.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of our website and business.

Technical data is deleted or anonymised once it is no longer required for these purposes, unless continued storage is required to investigate a security incident or comply with a legal obligation.

4.4 Responding to enquiries

If you contact us regarding an existing or potential order or contract, processing is based on Article 6(1)(b) GDPR.

For other enquiries, processing is based on Article 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries and communicating with customers and other interested persons.

4.5 Direct marketing to existing customers

Where permitted by applicable law, we may use an e-mail address obtained in connection with a previous purchase to inform existing customers about our own similar products or services.

Where Article 6(1)(f) GDPR applies, our legitimate interest is direct marketing to existing customers.

We only use such electronic marketing without separate consent where the additional requirements of applicable direct-marketing law are met. In particular, where § 7(3) German UWG applies, the e-mail address must have been obtained in connection with a sale, the advertising must concern our own similar products or services, the customer must not have objected, and a clear and free opportunity to object must be provided when the address is collected and with every marketing message.

You may object to direct marketing at any time and free of charge. Once you object, we will no longer use your personal data for that purpose.

We may retain limited information in a suppression list where necessary to ensure that your objection continues to be respected.

4.6 Newsletter and marketing communications based on consent

If you subscribe to our newsletter or otherwise consent to receiving marketing communications, we process your contact details based on Article 6(1)(a) GDPR.

You may withdraw your consent at any time, including through the unsubscribe function contained in our marketing e-mails.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Sources of Personal Data

We mainly obtain personal data directly from you, for example when you:

  • place an order;

  • create an account;

  • contact us;

  • subscribe to a newsletter;

  • use our virtual assistant;

  • submit information through a website form; or

  • interact with our website.

We may also receive transaction or payment-status information from payment providers and delivery-status information from logistics and shipping providers.

Technical, analytics and advertising data may be generated through your interaction with our website, subject to applicable consent requirements.

6. Recipients and Service Providers

We disclose personal data only where necessary for the purposes described in this Privacy Policy.

Recipients may include:

  • e-commerce and website platform providers;

  • hosting and IT providers;

  • logistics and shipping companies;

  • payment service providers;

  • accounting and tax advisers;

  • customer-support providers;

  • cloud and infrastructure providers;

  • analytics providers;

  • advertising and marketing platforms;

  • consent-management providers;

  • providers of embedded media;

  • providers of website widgets and virtual-assistant functionality; and

  • public authorities where disclosure is legally required.

Depending on the service and processing activity, these recipients may act as our processors, joint controllers or independent controllers.

7. International Transfers

Some service providers or their group companies may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred to a country outside the EEA, we ensure that the transfer is based on an appropriate legal mechanism, such as:

  • an adequacy decision of the European Commission;

  • the EU–U.S. Data Privacy Framework where the recipient is validly certified;

  • Standard Contractual Clauses approved by the European Commission; or

  • another legally permitted transfer mechanism.

Where necessary, additional safeguards are implemented.

Further information concerning the relevant safeguards or a copy of applicable safeguards may be requested from us using the contact details in Section 1.

8. Payment Services

We offer different payment methods. When you select a payment service, personal data required to process the transaction is transmitted to the relevant payment provider.

Payment providers may process personal data as independent controllers for their own regulatory, fraud-prevention, payment-processing and compliance purposes.

8.1 PayPal

We offer payments through PayPal.

For customers in the EEA, PayPal services are generally provided by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. PayPal acts as a controller for personal data processed in connection with the customer’s PayPal account and payment service.

Depending on the transaction, data transferred to or received from PayPal may include:

  • name;

  • billing or delivery information;

  • e-mail address;

  • transaction amount;

  • currency;

  • order and transaction identifiers;

  • payment status; and

  • fraud-prevention information.

Our processing in connection with the payment is based on Article 6(1)(b) GDPR.

PayPal’s own processing is governed by PayPal’s privacy documentation.

8.2 Google Pay

We offer Google Pay as a payment option.

For users in the EEA, Google Pay / Google Payments is generally provided by Google Ireland Limited. Google’s current Google Payments documentation identifies Google Ireland Limited as the controller for EEA users who are not sellers on a Google marketplace.

When Google Pay is used, information required to process the payment may be exchanged between Google, us, the relevant payment processor, your bank or card issuer.

Google may also inform participating websites whether Google Pay is available on a user’s device so that the payment option can be offered.

Our processing of information required to complete the transaction is based on Article 6(1)(b) GDPR.

Google’s independent processing is governed by Google’s and Google Payments’ privacy documentation.

8.3 Apple Pay

We offer Apple Pay.

For users in the EEA, Apple Payments Services are generally provided through Apple Distribution International Ltd., Ireland.

When Apple Pay is used, the information required for payment may be transmitted between Apple, the user’s payment-card issuer, payment networks, the payment processor and us.

According to Apple’s current documentation, the actual card number is not provided to the merchant when Apple Pay is used.

Our processing of information required to complete the transaction is based on Article 6(1)(b) GDPR.

Apple’s independent processing is governed by Apple’s privacy documentation.

9. Cookies, Similar Technologies and Consent Management

Our website uses cookies and similar technologies.

These technologies may store information on your device or access information already stored on your device.

9.1 Strictly necessary technologies

Certain technologies are required to provide functions expressly requested by you, such as:

  • shopping-cart functionality;

  • checkout functionality;

  • session management;

  • security;

  • fraud prevention;

  • consent-management functionality; and

  • other technically necessary website functions.

Where the conditions of § 25(2) TDDDG are met, consent is not required for storage or access that is strictly necessary to provide a digital service expressly requested by the user.

Any subsequent processing of personal data is based on the applicable GDPR legal basis, in particular Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR.

9.2 Analytics, advertising and other non-essential technologies

Analytics, advertising, remarketing and comparable non-essential technologies are used only after you have given the required consent through our consent-management platform.

The legal basis for the associated processing of personal data is Article 6(1)(a) GDPR.

Consent may also cover storage of or access to information on your device under § 25(1) TDDDG.

You may withdraw or modify your choices at any time through the Cookie Settings function available on our website.

Withdrawal is effective for the future and does not affect processing lawfully carried out before withdrawal.

A current list of the cookies and technologies used, including their providers, purposes and storage periods, is available through our Cookie Settings.

10. Google Services

We use various services provided by Google.

The relevant Google entity for many services provided to EEA business customers is Google Ireland Limited, Ireland.

10.1 Google Analytics

We use Google Analytics to understand how visitors use our website, measure website performance and improve our website and marketing activities.

Google Analytics may process information such as:

  • page and screen views;

  • interactions;

  • approximate geographical information;

  • device and browser information;

  • referrer information;

  • session information;

  • cookie or device identifiers; and

  • conversion events.

For users in the EU, Switzerland and the United Kingdom, Google states that IP addresses are used for location derivation and deleted before the data is logged or stored in Google Analytics.

We use Google Analytics only on the basis of your consent under Article 6(1)(a) GDPR and, where applicable, § 25(1) TDDDG.

The retention period for Google Analytics data is determined by our configured Google Analytics retention settings. Details concerning cookies and their current duration are available through our Cookie Settings.

10.2 Google Tag Manager

We use Google Tag Manager to manage and deploy website tags and integrations.

Google states that Tag Manager itself does not create visitor profiles or generally collect visitor information in the same manner as analytics services; it does process limited diagnostic and standard HTTP-request information for operation of the service.

Tags deployed through Google Tag Manager are subject to the consent requirements applicable to the respective service. The fact that a service is technically deployed through Tag Manager does not change its legal basis.

In particular, analytics and advertising tags managed through Google Tag Manager remain blocked until the required consent has been obtained.

10.3 Google Ads and Conversion Tracking

We use Google Ads to advertise our products and to measure the effectiveness of advertising campaigns.

Where you have consented, Google Ads technologies may process information concerning:

  • advertising clicks;

  • website visits;

  • conversion events;

  • device and browser information;

  • advertising and cookie identifiers;

  • page URLs;

  • transaction or conversion information; and

  • campaign attribution.

The processing enables us to determine, for example, whether a user reached our website through a Google advertisement and subsequently performed an action such as making a purchase.

The legal basis is your consent under Article 6(1)(a) GDPR and, where applicable, § 25(1) TDDDG.

Google provides consent controls for advertising and analytics tags, including consent parameters for advertising storage, advertising user data, advertising personalisation and analytics storage.

10.4 Google Search Console

We use Google Search Console to monitor our website’s technical presence and performance in Google Search, detect indexing issues and analyse search-performance information.

Google Search Console provides website operators with information such as:

  • search queries through which the website appeared in Google Search;

  • impressions;

  • clicks;

  • click-through rates;

  • indexing information; and

  • technical website issues.

We do not use Google Search Console as a visitor-tracking tag on our website.

Our use of Search Console for website administration and optimisation is based on Article 6(1)(f) GDPR, based on our legitimate interest in operating and improving our website.

10.5 Google reCAPTCHA

We use Google reCAPTCHA on selected forms or website functions to protect our website from automated abuse, spam, bots and fraudulent activity.

For this purpose, Google may process technical and interaction information such as:

  • IP address;

  • device and browser information;

  • website and referrer information;

  • interaction information; and

  • security-related signals.

Our legitimate interest under Article 6(1)(f) GDPR is protecting our website, forms, users and IT infrastructure from abuse and automated attacks.

Where reCAPTCHA stores information on or accesses information from the user’s terminal device beyond what is strictly necessary for the requested security function, we rely on prior consent under § 25(1) TDDDG and Article 6(1)(a) GDPR.

11. Meta Services, Meta Pixel and Meta Ads

We use advertising services provided by Meta, including Meta Ads and the Meta Pixel.

For users in the EEA, the relevant Meta entity is generally Meta Platforms Ireland Limited, Ireland.

The Meta Pixel allows website events to be shared with Meta for purposes including:

  • conversion measurement;

  • advertising attribution;

  • creation of advertising audiences;

  • remarketing;

  • optimisation of advertising campaigns; and

  • measurement and reporting.

Depending on configuration and the user’s interaction with our website, information may include:

  • page visits;

  • product views;

  • shopping-cart events;

  • purchases and other conversion events;

  • URL and referrer information;

  • browser and device information;

  • cookie and advertising identifiers; and

  • other event information.

Meta describes the Meta Pixel as part of its Meta Business Tools and distinguishes between processing for measurement/analytics and certain processing for which Meta and the business may act as joint controllers.

The Meta Pixel and comparable Meta advertising technologies are activated only after the required consent has been obtained.

The legal basis is Article 6(1)(a) GDPR and, where applicable, § 25(1) TDDDG.

You may withdraw your consent at any time through our Cookie Settings.

12. TikTok Pixel and TikTok Advertising

We use TikTok Ads and the TikTok Pixel for advertising, conversion measurement, campaign optimisation, remarketing and audience creation.

For users in the EEA, the relevant TikTok entity is generally TikTok Technology Limited, Ireland.

According to TikTok’s current documentation, the TikTok Pixel may collect information including:

  • advertising and event information;

  • website actions and conversion events;

  • timestamps;

  • IP address;

  • browser and device/User-Agent information;

  • cookies;

  • page metadata; and

  • certain interaction information such as button clicks.

The TikTok Pixel is activated only after the required consent has been obtained.

The legal basis is Article 6(1)(a) GDPR and, where applicable, § 25(1) TDDDG.

You may withdraw your consent at any time through our Cookie Settings.

13. Embedded YouTube, Instagram and TikTok Content

We embed video or social-media content from third-party platforms, including:

  • YouTube;

  • Instagram; and

  • TikTok.

When such embedded content is activated, the respective provider may receive information such as:

  • your IP address;

  • browser and device information;

  • the page on which the content is embedded;

  • time of access; and

  • information about your interaction with the embedded content.

If you are logged into the relevant platform, the provider may be able to associate the interaction with your account.

Where these services require access to your terminal device or involve non-essential third-party processing, we load the content only after the required consent has been given.

The legal basis is Article 6(1)(a) GDPR and, where applicable, § 25(1) TDDDG.

For YouTube, the relevant EEA Google entity is generally Google Ireland Limited.

For Instagram, the relevant EEA entity is generally Meta Platforms Ireland Limited.

For TikTok, the relevant EEA entity is generally TikTok Technology Limited.

You may withdraw your consent through our Cookie Settings.

14. Elfsight Widgets and Virtual Assistant

We use website widgets provided through Elfsight, including a virtual assistant / AI chatbot and other Elfsight tools.

Depending on the widget being used, Elfsight may process technical information required to display and operate the widget.

According to Elfsight’s current privacy information, this may include:

  • IP address;

  • operating system; and

  • browser type.

Elfsight states that this basic technical information is retained for seven days for service operation, troubleshooting, security and abuse prevention. Elfsight also states that certain widgets that accept user submissions may store submitted personal information on protected Google Cloud infrastructure.

Elfsight also indicates that its widgets may use an elfsight_viewed_recently cookie. Whether this cookie is used depends on the widget configuration.

Where such cookie or similar storage is not strictly necessary, it is used only after the required consent has been obtained.

14.1 Virtual Assistant / AI Chatbot

Our website includes an Elfsight-powered virtual assistant / AI chatbot.

When you interact with the assistant, we may process:

  • the questions and messages you enter;

  • the chatbot’s responses;

  • chat history;

  • date and time of the interaction;

  • technical information required to provide the service; and

  • contact information such as your name, e-mail address or telephone number if you voluntarily provide it or use a lead/contact function.

Elfsight’s current AI Chatbot functionality can retain conversation history, collect contact details and provide chat transcripts to the widget owner.

We use this information to:

  • answer questions;

  • provide customer support;

  • provide information about our products;

  • respond to purchase-related enquiries;

  • improve customer service; and

  • where requested, follow up on a customer’s enquiry.

Where the conversation concerns a potential or existing purchase, the legal basis is Article 6(1)(b) GDPR.

For general customer-service enquiries, the legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in providing efficient online customer support.

Where separate consent is required for a specific Elfsight technology, cookie or function, the legal basis is Article 6(1)(a) GDPR and, where applicable, § 25(1) TDDDG.

Please do not submit sensitive personal information, health information, payment-card information, passwords or other confidential information through the virtual assistant unless we expressly ask you to provide such information through an appropriate secure channel.

Chat and contact information is retained only for as long as required to deal with the relevant enquiry, provide customer support and, where applicable, establish, exercise or defend legal claims.

14.2 Other Elfsight Widgets

We may also use other Elfsight widgets for functions such as:

  • displaying content;

  • social-media or video galleries;

  • forms;

  • popups and banners;

  • interactive website elements;

  • reviews;

  • contact functions; and

  • other presentation or customer-service functionality.

The data processed depends on the particular widget.

Where a widget allows you to actively submit information, the data entered by you is processed for the purpose indicated at the point of collection.

Where an Elfsight widget embeds content from another provider, such as YouTube, Instagram or TikTok, that provider’s processing may additionally apply as described in this Privacy Policy.

15. Automated Decision-Making

We do not carry out solely automated decision-making within the meaning of Article 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

If this changes, we will update this Privacy Policy and provide the information required by law.

16. Provision of Personal Data

Providing personal data required to place and fulfil an order is a contractual requirement.

Without the necessary information, we may be unable to:

  • process your order;

  • deliver products;

  • process payment;

  • provide requested customer support; or

  • fulfil our contractual obligations.

Providing data for newsletters, advertising, analytics and other consent-based processing is voluntary.

Refusing or withdrawing consent to non-essential processing does not prevent you from purchasing products from our online shop.

17. Your Rights

Under the GDPR, and subject to the applicable legal requirements and limitations, you have the following rights.

17.1 Right of access – Article 15 GDPR

You have the right to obtain confirmation as to whether we process personal data relating to you and, where applicable, to obtain access to that data and the information required by Article 15 GDPR.

17.2 Right to rectification – Article 16 GDPR

You have the right to have inaccurate personal data corrected and incomplete personal data completed.

17.3 Right to erasure – Article 17 GDPR

You may request deletion of your personal data where one of the grounds set out in Article 17 GDPR applies.

This right is subject to the exceptions provided by Article 17(3) GDPR, including where continued processing is required by law or necessary for the establishment, exercise or defence of legal claims.

17.4 Right to restriction of processing – Article 18 GDPR

You may request restriction of processing in the circumstances specified in Article 18 GDPR.

17.5 Right to data portability – Article 20 GDPR

Where processing is based on consent or a contract and is carried out by automated means, you have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format.

You also have the right to transmit that data to another controller.

Where technically feasible, you may request that we transmit the relevant data directly to another controller.

17.6 Right to withdraw consent – Article 7(3) GDPR

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

For cookies, analytics and advertising technologies, you can change your decision through our Cookie Settings.

For marketing e-mails, you may use the unsubscribe option contained in the relevant communication or contact us directly.

17.7 Right to object – Article 21 GDPR

Where processing is based on Article 6(1)(f) GDPR, you have the right to object to the processing on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you may object at any time and without providing reasons.

Following an objection to direct marketing, your data will no longer be processed for that purpose.

18. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data-protection supervisory authority.

As SYN2 s.r.o. is established in the Czech Republic, you may in particular contact:

Office for Personal Data Protection
Úřad pro ochranu osobních údajů
Pplk. Sochora 27
170 00 Prague 7
Czech Republic

You may also lodge a complaint with another competent supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement.

19. Security

We use appropriate technical and organisational measures designed to protect personal data against:

  • unauthorised access;

  • unlawful processing;

  • accidental loss;

  • alteration;

  • destruction; and

  • unauthorised disclosure.

Our security measures are reviewed and adjusted taking into account the nature, scope, context and purposes of processing as well as the risks to affected individuals.

20. Changes to this Privacy Policy

We may update this Privacy Policy where necessary, in particular if:

  • our website or online shop changes;

  • we introduce or remove service providers;

  • our processing activities change; or

  • legal or regulatory requirements change.

The current version is always published on our website.

Where a change requires renewed consent, we will request that consent before the relevant processing takes place.

Last updated: 18 August 2026