Privacy Policy

1. Data controller

LA GEM s.r.o., IČO: 23811358, DIČ: CZ23811358 (VAT payer), registered office Dukelská 953/9, Vršovice, 100 00 Prague 10, registered at the Municipal Court in Prague, file C 433283.

Correspondence and complaints address: Truhlářská 1103/15, 110 00 Nové Město, Prague, Czechia.
Telephone: +420 778 005 125 · E-mail: lagem@lagem.cz

Contact for personal-data matters: lagem@lagem.cz (subject "Osobní údaje / Personal data"). Write to us here to exercise any of the rights in section 8.

We operate the website lagem.cz. Personal data is processed in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and Act No. 110/2019 Coll., on personal data processing.

We have not appointed a data protection officer, because the conditions of Article 37 of the GDPR are not met.

2. What data we collect

Depending on how you reach us, we process the following categories of personal data:

• Identification and contact data: your name, e-mail address, telephone number and, where relevant, your delivery or correspondence address.
• The content of your enquiry or message, including messages you send us through the contact form or via Instagram, WhatsApp or Telegram.
• Order and contract data: the piece, gemstones, sizes, design details, price and delivery arrangements.
• Payment-related data: bank-transfer details and invoices. We never see or store your card numbers.
• Communication history: the record of what we have discussed, so we can serve you well over time.
• Client-account data, if you create an account: your e-mail address, optionally your first name, and the pieces you save to your favourites.
• Technical data: your IP address and browser or device type, kept only briefly in our server logs. Our visit statistics use the same request data only for a moment and store no IP address (see section 4).
• Cookies and local storage, as described on our Cookies page.
• Advertising data, only if you accept marketing cookies: online identifiers such as the click identifier of the Google ad you came from and Google Ads cookie identifiers. If you then send an enquiry, we keep with it the ad click identifier, the campaign and the page you first arrived on, and Google receives your e-mail address in hashed (one-way encrypted) form so it can match the enquiry to the ad click (see sections 4 and 7, and the Cookies page).

Date of birth is optional. We ask for it only if you choose to share it, and use it solely for a personal greeting or an anniversary note, and only with your consent. It is never required to place an order.

3. Consultations in our atelier

Much of our work happens in person. During private consultations in our Prague atelier we make notes about your wishes and requirements: your vision for a piece, gemstone preferences, sizes, occasions, budget and similar details discussed while preparing your order and contract.

This information is treated with absolute discretion. It is used by LA GEM to prepare your proposal, your contract and your piece, and to serve you better in the future. It is stored in our internal client system, hosted by Hetzner in Germany; copies of order documents may be held in Google Drive (see section 7). It is never sold and never used for third-party marketing.

We keep these client notes for the duration of the contract and a further 4 years. You may ask us at any time to show, correct or erase them (see section 8).

4. How and why we use data

1. Performance of a contract (Art. 6(1)(b)). Data provided when ordering is processed without your separate consent because it is necessary to conclude and perform the contract: to prepare your commission, communicate with you and deliver your piece.
2. Steps before a contract (Art. 6(1)(b)). When you send an enquiry or complete the contact form, we use your name, e-mail and phone number to answer you and, if you wish, to prepare an offer, as steps taken at your request before entering into a contract.
3. Legal obligations (Art. 6(1)(c)). We further process data where the law requires it, in particular the record-keeping and archiving of accounting and tax documents.
4. Legitimate interest (Art. 6(1)(f)). We keep short-lived security logs to protect and operate the website, and we may process data to establish, exercise or defend legal claims. We may also write to existing clients about pieces or services similar to those they have acquired from us (see section 5). We also count, in aggregate, how the website is used: which pages are visited, the site or campaign a visit came from, the browser and device type, the screen size, and the country and city (derived from the IP address, which is then discarded). For this we use Umami, an open-source tool running on our own server in the EU. It sets no cookies, stores no IP address, cannot recognise you on another day and is never shared with anyone.
5. User account (Art. 6(1)(b)). Your e-mail, optional first name and favourites are processed solely to send you sign-in links and run the account you asked for. You can download this data or delete the account yourself at any time, under “My data” in your account. Occasional news about new gemstones and creations is sent only if you switch it on under “Preferences” in your account; that is your consent (Art. 6(1)(a)), and you can switch it off there at any time (see section 5).
6. Consent (Art. 6(1)(a)). Broader marketing and the optional birthday note happen only with your explicit consent, which you may withdraw at any time. If you are under 15, consent must be given by your legal guardian; we may ask for confirmation of age.
7. Consent to cookies (Art. 6(1)(a) GDPR and Section 89(3) of Act No. 127/2005 Coll.). If you accept marketing cookies, we use Google Ads to measure which of our ads lead to an enquiry: the Google tag sets cookies and, when you send an enquiry, reports it to Google together with your e-mail address, which your browser hashes (SHA-256) before sending (“enhanced conversions”). We keep the ad click identifier and campaign with your enquiry, so we can tell which advertising works. We do not use this to tailor ads to you (no remarketing, no ad personalisation). You can withdraw consent at any time in the Cookie settings; withdrawal does not affect processing before it.

We will only use your personal data for a purpose other than the one for which it was collected on the basis of your consent.

Giving us your data is voluntary. Without your contact details we cannot answer your enquiry, and without the data a contract needs we cannot conclude or perform it. Some data, such as the details on an invoice, we must keep by law.

5. Marketing communications

We do not send newsletters or mass campaigns. From time to time we may write personally to existing clients about pieces, gemstones or events similar to what they have shown interest in. If you have an account on this website and have switched on occasional news under “Preferences”, we may also send you news about new gemstones and creations.

If you prefer not to receive such messages, simply write to lagem@lagem.cz or reply to any of them. We will place your address on our internal do-not-contact list and you will receive no further marketing from us. Opting out never affects communications necessary for an ongoing order.

We record each opt-out and its date, and any consent you give us, so we can show on what basis we contacted you (see section 6).

6. How long we keep data

We keep personal data only as long as we need it for the purpose it was collected, or as long as the law requires. In practice:

7. Who has access to data

Within the scope necessary to perform a contract or our legal obligations, we share data with carefully chosen processors:

• Hetzner Online GmbH (Germany, EU): hosting of the website, our internal client system and the databases behind them.
• Google (Google Workspace: Gmail and Google Drive; Ireland / USA): our business e-mail and document storage, used under Google’s data processing terms for business customers; it receives contact-form e-mails, sends the sign-in links for client accounts and holds copies of order documents.
• Meta Platforms (Instagram; Ireland / USA): where you contact us through Instagram, that conversation is processed by Meta and may be saved to our client system.
• Our external accountant and secure carriers or couriers, as needed to invoice and to deliver your piece.
• Anthropic PBC (Claude; USA): an AI service we use internally, on LA GEM’s own business account and under its commercial terms, which do not allow training on our data, to read invoices and bank statements and to help prepare notes on enquiries and orders; names, addresses and messages in those documents may pass through it.
• Google Ireland Limited (Google Ads; Ireland / USA), only if you accept marketing cookies: it receives the identifiers described in section 2 and, for an enquiry, a conversion with your hashed e-mail address. For enhanced conversions Google acts as our processor; for measuring ad clicks it acts as an independent controller under its own privacy terms.

Where the law requires it, we also disclose data to public authorities, such as the tax office or a court. On request we will tell you exactly who processes your data. Some of our processors (Google, Meta, Anthropic) may process data in the USA; such transfers rely on the EU-US Data Privacy Framework and, where applicable, on standard contractual clauses.

If you choose to write to us through WhatsApp or Telegram, the conversation is carried by that service under its own terms; we use it only to talk with you.

8. Your rights

1. Withdraw consent at any time by e-mail, telephone or letter; withdrawal does not affect the lawfulness of processing before it.
2. Access: ask whether we process your data and receive a copy, together with the purpose, categories, recipients and retention period. Additional copies may carry a small administrative fee.
3. Rectification of inaccurate data and completion of incomplete data, without undue delay.
4. Objection to processing based on our legitimate interest (Art. 21(1) GDPR), on grounds relating to your particular situation; we then stop unless we show compelling legitimate grounds or need the data for legal claims. You may object to processing for direct marketing at any time, and we then stop it immediately.
5. Erasure, where data is no longer needed, consent was withdrawn, you objected, or processing was unlawful, unless legal grounds require us to keep it.
6. Restriction of processing while accuracy or the legitimacy of processing is being resolved, or where you need the data for legal claims.
7. Data portability: receive the data you provided in a structured, commonly used, machine-readable format and have it transferred to another controller.

You can exercise all rights through the contact details in section 1, at lagem@lagem.cz. We respond within one month of your request (Art. 12(3) GDPR); in complex cases this period may be extended, and we will tell you if so.

9. Cookies

Cookies and local storage are small pieces of data kept in your device. We use those strictly necessary for the features you use, for example to remember the language you chose or to keep you signed in to your account. Only with your consent do we also use Google Ads cookies, to measure which of our ads lead to an enquiry. Our own visit statistics (section 4) work without cookies.

A full list of what we store, why and for how long is on our Cookies page, where you can also review or change your choices at any time through the Cookie settings panel.

10. Security

We protect your personal data with measures appropriate to the risk. The website is served only over encrypted connections (TLS). Access to client data is limited to the staff who genuinely need it, and the admin area is protected by individual logins.

Server logs that contain an IP address are deleted within 30 days. Our databases are backed up daily; the backups stay with our hosting provider in the EU, and only the people who run our systems can access them.

11. Supervisory authority

We will always try to resolve any concern about your data personally and to your satisfaction. You also have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), www.uoou.cz, which supervises data protection in the Czech Republic. If you live or work in another EU member state, you may contact the supervisory authority of that state.

12. Automated decisions and profiling

We do not make any decisions about you by solely automated means, and we do not profile you within the meaning of Article 22 of the GDPR.

13. Changes to this policy

We may update this policy as our services or the law change. The current version always lives at this address; the date and version below tell you which text is in force. For material changes we will draw your attention to them where it makes sense, for example the next time you contact us.

LA GEM s.r.o., Prague · version 2026-11 · valid from 25 October 2026