Privacy policy

Last updated: September 20, 2026

This Privacy Policy explains how Morning Studio Prg s.r.o. (“Morning Studio”, “we”, “us” or “our”) collects, uses and shares personal data when you visit our website, create an account, purchase or return a product, subscribe to our marketing communications, contact us, or otherwise use our services.

1. Who is responsible for your personal data?

The controller responsible for the processing described in this Privacy Policy is:

Morning Studio Prg s.r.o.
Ovocná 520
161 00 Praha
Czechia
IČO: 29899796
Email: info@morningstudioprg.com

2. Personal data we collect

Depending on how you interact with us, we may process the following categories of personal data:

  • Contact and identification information, such as your name, email address, telephone number, billing address and delivery address.

  • Account information, such as information associated with your Morning Studio customer account, preferences and settings.

  • Order and transaction information, such as products you view, purchase or return, your order history, payment status, selected payment method, delivery method and selected pickup point.

  • Payment information, such as information necessary to process and confirm your payment. Payment card information is generally processed directly by our payment service providers rather than by Morning Studio.

  • Delivery information, such as your delivery address, selected pickup location and information required by the carrier to deliver or notify you about your shipment.

  • Return and withdrawal information, including information submitted when you return a product or exercise your statutory right of withdrawal.

  • Communications, including emails, messages and other information you provide when contacting us.

  • Marketing information, including your marketing preferences and information about your interactions with our marketing communications, such as whether an email was delivered, opened or clicked.

  • Device and usage information, such as your IP address, browser and device information, online identifiers, pages visited, interactions with our website and information collected through cookies and similar technologies.

  • Location and search information, where you use map, address-search or pickup-point functionality.

We collect personal data directly from you, automatically when you use our website, from Shopify and our other service providers, and, where applicable, from advertising and business partners.

3. How and why we use your personal data

Providing our store, customer accounts and processing orders

We process your contact, account, order and transaction information to operate our online store, provide customer accounts, process your purchases, manage orders and provide the services you request.

The legal basis for this processing is Article 6(1)(b) GDPR, as the processing is necessary to enter into or perform our contract with you.

Our online store and customer accounts are provided using Shopify.

Payments

We process information relating to your order and payment in order to receive and confirm payments, issue refunds and manage payment-related matters.

Our primary payment processor is Shopify Payments. Depending on the payment method you select, additional payment service providers or financial institutions may process your payment information.

The legal basis for processing by Morning Studio is Article 6(1)(b) GDPR, as the processing is necessary to perform our contract with you, and Article 6(1)(c) GDPR where processing is necessary to comply with accounting, tax or other legal obligations.

Invoicing, accounting and statutory records

We process customer, order, transaction and invoice information in order to issue invoices, maintain our accounting records and comply with applicable tax, accounting and other legal requirements. We use third-party invoicing and accounting service providers to support these activities.

The legal basis is Article 6(1)(c) GDPR where processing is necessary to comply with our legal obligations. Where processing is necessary to issue or administer an invoice in connection with your purchase, Article 6(1)(b) GDPR may also apply.

Shipping and delivery

We process your name, contact details, delivery address or selected pickup point, order information and other information necessary to arrange and complete delivery.

We share the information necessary to deliver your order with shipping and logistics providers and providers of delivery and pickup-point services.

The legal basis is Article 6(1)(b) GDPR, as this processing is necessary to deliver the products you purchase from us.

Maps, address search and pickup points

When you select a pickup-point delivery method, our pickup-point functionality uses Google Maps Platform, including Google Maps and Google Places.

When the map is displayed, your device communicates directly with Google. Google receives technical information including your IP address and information relating to your interaction with the map. Your interactions may also indicate the geographic area in which you are looking for a delivery location.

We also use Google Places to provide address and location autocomplete functionality. Search terms and address information that you enter into these fields are submitted to Google in order to provide autocomplete suggestions.

Google processes information it receives through Google Maps Platform in accordance with its own privacy terms.

We use these services to provide the address-search and pickup-point functionality you request and to arrange delivery of your order. The legal basis for the processing we perform is Article 6(1)(b) GDPR.

Marketing communications

If you subscribe to our marketing communications, we use your contact information and marketing preferences to send you information about Morning Studio, our products, offers and other marketing content.

We currently use Shopify Messaging to manage and send email marketing.

We measure the performance of our marketing communications. This may include information about email delivery, clicks, unsubscribes and spam reports.

Where you have provided the applicable consent for marketing analytics, we may also measure whether you open our marketing emails. Email open tracking uses technology embedded in the email that allows us to determine when an email has been opened. We use this information to measure engagement with our communications and improve our marketing.

Where marketing communications or marketing analytics require consent, the legal basis is Article 6(1)(a) GDPR. You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Where applicable law permits us to send marketing to existing customers without consent, we may do so on the basis of our legitimate interest in marketing similar Morning Studio products to our customers, subject to your right to object and applicable electronic-communications and direct-marketing laws.

You may unsubscribe from marketing communications at any time by using the unsubscribe link in our emails. We may continue to send non-marketing communications necessary to administer your account, orders, returns or other transactions.

Customer service, communications and business administration

We process personal data contained in emails, messages, order notifications and other business communications in order to communicate with you, provide customer support, administer orders and returns, coordinate our business operations and maintain appropriate business records.

Personal data may also be included in internal communications where this is necessary to handle an order, customer request, return, complaint or other matter relating to our business.

We use third-party communication, email and collaboration service providers to support these activities.

The legal basis is Article 6(1)(b) GDPR where the processing is necessary to enter into or perform a contract with you, including administering an order or responding to a request relating to a purchase. We may also rely on Article 6(1)(f) GDPR where processing is necessary for our legitimate interests in operating and administering our business, communicating internally and externally, and maintaining appropriate business records. Where we are required to retain or process information to comply with a legal obligation, the legal basis is Article 6(1)(c) GDPR.

Analytics

We use Shopify Analytics and Google Analytics to understand how visitors use our website, measure store performance and improve our services.

This may involve processing information about your device, browser, IP address, online identifiers, interactions with our website, pages viewed, referring sources, orders and other usage information. Where your consent is required and has not been given, analytics services may operate in a limited manner without storing or accessing non-essential identifiers on your device.

Where analytics processing requires consent, the legal basis is Article 6(1)(a) GDPR. Where we process analytics that does not require consent, we may rely on our legitimate interests under Article 6(1)(f) GDPR in understanding and improving our business and services.

Advertising and conversion measurement

Subject to your consent, we use advertising and measurement services provided by Google, including Google Ads, and Meta, including Facebook and Instagram advertising services.

These services may process online identifiers, device and browser information, website activity, interactions with advertisements, and information about purchases or other conversions. Depending on the features we configure, information such as customer or transaction information may also be used for conversion measurement, audience creation or advertising purposes.

We use this information to measure the effectiveness of our advertising, understand whether advertisements result in visits or purchases, create audiences and show more relevant advertising.

The legal basis is Article 6(1)(a) GDPR. You may withdraw or change your consent through our cookie preferences.

Google and Meta may also process personal data for their own purposes in accordance with their respective privacy policies.

Security, fraud prevention and protection of our rights

We process personal data where necessary to secure our website and accounts, prevent and detect fraud and misuse, investigate suspicious activity, enforce our terms and establish, exercise or defend legal claims.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are protecting our customers, our systems and our business, preventing fraud and misuse, and establishing, exercising and defending legal rights.

Where processing is required by law, Article 6(1)(c) GDPR applies instead.

4. Cookies and similar technologies

We and our service providers use cookies and similar technologies to operate our website, remember preferences, understand how our website is used and, subject to your choices, measure and personalize advertising.

Some technologies are necessary for our website and services to function. Other technologies, including those used for analytics and advertising, are used only after obtaining your consent where they require consent under applicable law.

For visitors in the European Economic Area, United Kingdom and other regions for which we provide consent controls, you can accept or reject non-essential technologies through our cookie banner and can subsequently change your choices through our cookie preferences.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

5. Shopify and Shopify Network Intelligence

Our store is hosted by Shopify, which provides the technology we use to operate our online store, customer accounts, checkout, analytics, marketing and other services.

Shopify collects and processes personal data relating to your access to and use of our store in order to provide its services to us and to you. Information you submit through our store is therefore transmitted to and processed by Shopify.

We have enabled Shopify Network Intelligence. This allows Shopify to use information relating to interactions with our store together with information relating to interactions with Shopify and other Shopify merchants to provide Enhanced Services.

These Enhanced Services may help us and Shopify provide more personalized experiences, understand how customers interact with our store and advertising, improve Shopify services, and provide more relevant advertising.

For some of these activities, Shopify processes personal data as a controller independently from Morning Studio. Shopify is responsible for responding to requests concerning the processing for which Shopify acts as controller.

Where required, we obtain your consent before information from non-essential cookies or similar technologies is used for these purposes. You can change your consent choices through our cookie preferences.

You can learn more about how Shopify processes your personal data in the ⁠Shopify Consumer Privacy Policy.

You can also visit the ⁠Shopify Privacy Portal to learn more about your privacy rights in relation to Shopify and how to exercise them, including how to withdraw consent or object to Shopify’s processing of your personal data for Enhanced Services.

Information processed through Shopify may be shared with Shopify and third parties located in countries other than your country of residence, including where necessary to provide Shopify’s services and Enhanced Services.

6. How we share personal data

We share personal data only where necessary for the purposes described in this Privacy Policy. Depending on how you interact with us, recipients may include:

  • e-commerce platform and infrastructure providers;

  • payment processors and financial institutions;

  • invoicing and accounting service providers;

  • shipping, logistics and pickup-point service providers;

  • communication, email and collaboration service providers;

  • returns and withdrawal-management service providers;

  • analytics, advertising and marketing service providers;

  • professional advisers, such as accountants, auditors, insurers and legal advisers;

  • public authorities, courts and regulators where disclosure is required by law; and

  • parties involved in a merger, acquisition, restructuring, sale or other corporate transaction.

Some recipients process personal data on our behalf and according to our instructions, while others process personal data as independent controllers for their own purposes. Where a recipient acts as an independent controller, its own privacy policy applies to its processing.

7. International transfers

Some of our service providers operate internationally. As a result, personal data may be transferred to or processed in countries outside the European Economic Area.

Where personal data is transferred outside the EEA to a country that has not been recognized by the European Commission as providing an adequate level of protection, we rely on appropriate safeguards as required by applicable data-protection law, such as the European Commission’s Standard Contractual Clauses, where applicable.

In some circumstances, a service provider may rely on another legally recognized transfer mechanism.

8. How long we keep personal data

We retain personal data only for as long as necessary for the purposes for which it was collected, including to perform our contracts, comply with legal obligations, resolve disputes and establish, exercise or defend legal claims.

In particular:

  • order, invoice, accounting and transaction records are retained for the periods required by applicable Czech tax and accounting laws;

  • customer account information is generally retained while your account remains active and thereafter where necessary for our legal obligations or legitimate interests;

  • information relating to returns, complaints and customer-service matters is retained for an appropriate period after the matter has been resolved, taking into account applicable limitation periods and our legal obligations;

  • marketing contact information is retained until you unsubscribe, withdraw your consent or object to the processing, as applicable, subject to retaining limited information where necessary to record and respect your marketing preference; and

  • analytics data for which we control the retention period is generally retained for up to 14 months. Other analytics and advertising data are retained for as long as necessary for the purposes described in this Privacy Policy, taking into account the retention settings and policies of the relevant service provider.

Where personal data is no longer required, we delete or anonymize it unless continued retention is required by law.

9. Your data-protection rights

Subject to the conditions and limitations provided by applicable law, you have the right to:

  • access personal data we process about you and obtain information about its processing;

  • rectify inaccurate or incomplete personal data;

  • erase your personal data in circumstances where we are no longer entitled to process it;

  • restrict the processing of your personal data in certain circumstances;

  • receive certain personal data in a structured, commonly used and machine-readable format and, where applicable, have that data transmitted to another controller;

  • object to processing based on our legitimate interests, including the right to object at any time to processing for direct-marketing purposes; and

  • withdraw consent at any time where processing is based on your consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

You can exercise these rights by contacting us at info@morningstudioprg.com.

We may request information reasonably necessary to verify your identity before responding to a request.

These rights are not absolute, and applicable law may allow or require us to continue processing personal data in certain circumstances.

10. Complaints

If you have concerns about how we process your personal data, we encourage you to contact us first at info@morningstudioprg.com so that we can investigate your concern.

You also have the right to lodge a complaint with a competent data-protection supervisory authority.

Our supervisory authority in Czechia is:

Úřad pro ochranu osobních údajů
Pplk. Sochora 27
170 00 Praha 7
Czechia
Email: posta@uoou.gov.cz
Website: https://uoou.gov.cz/

If you live elsewhere in the European Economic Area, you may also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work or place of the alleged infringement.

11. Children’s privacy

Our services are intended for customers who are legally capable of purchasing our products. We do not knowingly collect personal data from children where doing so would require authorization from a parent or guardian.

If you believe that a child has provided personal data to us improperly, please contact us at info@morningstudioprg.com.

12. Third-party websites and services

Our website may contain links to websites or services operated by third parties.

When you leave our website or interact directly with a third-party service, that third party may process personal data under its own privacy policy. We are not responsible for the privacy practices of third parties acting independently from us.

13. Security

We use appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss and destruction.

No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, processing activities, service providers or legal requirements.

When we make changes, we will publish the updated Privacy Policy on our website and update the “Last updated” date above. Where required by law, we will provide additional notice or request renewed consent.

15. Contact

If you have questions about this Privacy Policy, our processing of your personal data, or would like to exercise your data-protection rights, please contact:

Morning Studio Prg s.r.o.
Ovocná 520
161 00 Praha
Czechia
IČO: 29899796
Email: info@morningstudioprg.com