Effective from: 18.08.2026
1. Introduction
Welcome to Yumsto.
Yumsto s.r.o., company no. 09685065, registered office: Příčná 1892/4, Nové Město, 110 00 Prague
1, registered in the Commercial Register kept by the Regional Court in Ústí nad Labem under file
no. C 46184 ("the Company", "we", "us" or "our") operates www.yumsto.com and the Yumsto mobile app
(together "the Services").
This Privacy Policy explains what data we process about you, why we process it, on what legal
basis, who we pass it to, and what rights you have. It covers both visits to www.yumsto.com and
use of the Yumsto mobile app.
Every processing activity described below rests on one of the legal bases in Article 6 GDPR —
performance of a contract, compliance with a legal obligation, our legitimate interest, or your
consent. Where consent is needed we ask for it up front and you can withdraw it at any time; we do
not treat merely using the site as consent.
Our Terms and Conditions ("the Terms") govern all use of the Services and, together with this
Privacy Policy, form your agreement with us. Unless stated otherwise here, terms used in this
Privacy Policy have the same meaning as in the Terms.
This Privacy Policy is also published in Czech. If the two versions differ, the Czech version
prevails.
2. Definitions
SERVICE/SERVICES means the website www.yumsto.com and the Yumsto mobile app operated by the
Company.
PERSONAL DATA means data about a living individual who can be identified from that data (or from
that data and other information in our possession or likely to come into our possession).
USAGE DATA is data collected automatically, either generated by use of the Service or from the
Service infrastructure itself (for example, how long a page visit lasts).
COOKIES are small files stored on your device (a computer or a mobile device).
DATA CONTROLLER means a natural or legal person who (alone or jointly with others) determines the
purposes and manner in which personal data is or is to be processed. For the purposes of this
Privacy Policy, we are the controller of your data.
DATA PROCESSORS (OR SERVICE PROVIDERS) means any natural or legal person who processes data on
behalf of the Data Controller. We may use various providers in order to process your data more
effectively.
DATA SUBJECT is any living individual who is the subject of Personal Data.
USER is an individual who uses our Services. The User corresponds to the Data Subject.
3. Collecting and using information
We collect several different types of information for various purposes, so that we can provide and
improve our Services for you.
4. Types of data we collect
Personal data
While using our Service we may ask you to give us certain personal data that can be used to
contact or identify you ("Personal Data"). It may include, but is not limited to:
0.1. Email address
0.2. Full name and surname
0.3. Phone number
0.4. Address, country, region, postcode, town
0.5. Cookies and usage data
0.6. Username
0.7. Billing details (company no. and VAT no. for businesses)
0.8. Delivery address and contact details for the courier
0.9. Order and payment history
We may use your Personal Data to contact you with newsletters, marketing or promotional material
and other information that may interest you. You can unsubscribe at any time using the link in any
email or by writing to support@yumsto.com.
Usage data
We may collect information that your browser sends whenever you visit our Services, from or
through any device ("Usage Data").
This Usage Data may include information such as your computer's internet protocol address (e.g. IP
address), browser type and version, the page of our Service that you visit, the time and date of
your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
If you use the Services on a mobile device, this Usage Data may include information such as the
type of device, its unique ID, IP address and operating system, the type of internet browser,
identifiers and other diagnostic data.
Cookies
Cookies are small files that a website stores on your device. Browser localStorage and
sessionStorage work in a similar way — in this policy we refer to all of them together as
cookies.
Necessary cookies do not need your consent — the law exempts them, because without them the
service you are asking us for would not work. Any personal data processed through them is
processed on the basis of our legitimate interest in running and securing the site, and for
purchases on the basis of performing the contract. Everything else is stored only after you give
us consent in the bar shown to you on your first visit. Until you decide, we store nothing on your
device other than necessary cookies. Consent is voluntary and the site works without it — we
simply know less about you.
You can change or withdraw your choice at any time under the "Cookie settings" link — on a
computer it sits at the bottom of the left-hand menu, on a phone under the Menu section — or using
the button on this page. Withdrawing consent is as easy as giving it, and we delete the relevant
cookies afterwards. We remember your consent for 12 months, then we ask again.
You can also manage cookies in your browser settings, but browser settings alone do not replace
consent or its withdrawal with us.
We do not act on the browser "Do Not Track" signal. Your choice in cookie settings is what
governs.
Necessary cookies
The site would not work without them, so they cannot be switched off and we do not ask for consent
to them.
yumsto_at, yumsto_it, yumsto_rt — signing in
and keeping your session.
yumsto_anon_session — holds your basket and an order in progress until you sign
in. Valid for 14 days from your last visit.
yumsto_consent — remembers your choice from cookie settings. Valid for 12
months.
PARAGLIDE_LOCALE — the language we show the site in.
Analytics cookies
We store these only with your consent. We measure which recipes and pages help people and where
things snag, and we tune the content and recommendations from that. We process the data ourselves,
we do not pass it to advertising networks, and we do not connect it with your behaviour on other
sites.
yumsto_device_id — an anonymous device identifier that lets us recognise a repeat
visit and recommend more relevant recipes. Valid for 12 months (stored in a cookie and in
localStorage).
yumsto_analytics_session_id — separates individual visits. Expires when you close
the tab.
yumsto_analytics_acquisition — remembers where your first visit came from (a
search engine, social network, newsletter), so we know what is worth doing next. We store nothing
from the address other than the campaign label.
Without consent to analytics cookies we measure only anonymous visit counts for individual pages,
we cannot recognise a repeat visit, and we do not tailor recommendations to you.
Marketing cookies
We store these only with your consent. They would let us measure whether advertising outside
Yumsto pays off, and show you offers that fit.
We are not using any marketing cookies yet. If that changes, we will add them to
this policy and ask you again.
Payments and card fraud protection
Payments are processed for us by Stripe Payments Europe, Ltd. When you add goods
to your basket, or open the basket, a product offer or the checkout, we load the Stripe.js script.
It is necessary for us to accept payment securely without your card details reaching our site, and
for Stripe to detect card misuse. We do not load it on recipe and article pages.
__stripe_mid (valid for 12 months), __stripe_sid (expires at the
end of the visit) and the m cookie on the m.stripe.com domain — device
recognition for protection against fraudulent payments. Stripe also collects browser and device
characteristics alongside them.
We store these cookies as necessary for carrying out the payment you have expressly asked us for,
and without consent we do not load them anywhere other than the shopping part of the site. On
pages where Stripe.js is loaded, Stripe may also use hCaptcha protection. You will find the
details in Stripe's privacy policy.
Error tracking
To find out about site errors we use Sentry (Functional Software, Inc.). It stores no cookies on
your device. We send it a technical description of the error, the address of the page where it
happened, and browser details — not your IP address or the contents of your cookies. The legal
basis is our legitimate interest in a working and secure site.
5. How we use data
Yumsto uses the data it collects for the following purposes:
0.1. providing and maintaining our Services;
0.2. to let you know about changes to our Services;
0.3. to let you take part in interactive features of our Services, if you choose to;
0.4. providing customer support;
0.5. gathering analysis or valuable information so that we can improve our Services;
0.6. monitoring the use of our Services;
0.7. detecting, preventing and addressing technical problems;
0.8. performing our obligations and enforcing our rights under contracts concluded between you and
us, including invoicing and collection;
0.9. giving you notices about your account and orders, including confirmations, delivery status
and related email instructions;
0.10. giving you news, special offers and general information about other goods, services and
events we offer that are similar to those you have already bought or asked about, unless you have
chosen not to receive such information;
0.11. for any other purpose with your consent;
0.12. for processing your orders, delivering goods and processing payments;
0.13. for meeting statutory tax and accounting duties (keeping invoices).
6. Data retention
We will keep your Personal Data only for as long as is necessary for the purposes set out in this
Privacy Policy. We will keep and use it to the extent necessary to meet our legal obligations (for
example where we are required to retain your data under applicable law), to resolve disputes and
to enforce our legal agreements and policies.
We will also keep Usage Data for internal analysis. Usage Data is generally kept for a shorter
period, except where it is used to strengthen security or improve the functionality of our
Services, or where we are required by law to keep it longer.
7. Data transfers
Your information, including personal data, may be transferred to — and kept on — computers located
outside your state, country or other governmental jurisdiction, where data protection laws may
differ from those of your jurisdiction.
If you are located outside the Czech Republic and choose to give us information, please note that
we transfer the data, including personal data, to the Czech Republic and process it there.
Yumsto will take all reasonably necessary steps to ensure your data is treated securely and in
accordance with this Privacy Policy. No transfer of your Personal Data to an organisation or a
country outside the European Economic Area will take place unless appropriate safeguards under
Chapter V of the GDPR are in place.
8. Disclosure of data
We may disclose Personal Data that we collect or that you give us:
0.1. Disclosure to law enforcement.
In certain circumstances we may be required to disclose your Personal Data where the law requires
it or in response to valid requests from public authorities.
0.2. Business transactions.
If we or our subsidiaries are involved in a merger, acquisition or sale of assets, your Personal
Data may be transferred.
0.3. Other cases. We may also disclose your data:
0.3.1. to our subsidiaries and affiliated companies;
0.3.2. to suppliers, service providers and other third parties we use to support our business;
0.3.3. to fulfil the purpose for which you provided it;
0.3.4. for any other purpose we disclose when you provide the information;
0.3.5. with your consent in other cases;
0.3.6. where we believe disclosure is necessary or appropriate to protect the rights, property or
safety of the company, our customers or others.
9. Data security
The security of your data matters to us, but remember that no method of transmission over the
internet and no method of electronic storage is 100% secure. While we strive to use commercially
acceptable means to protect your personal data, we cannot guarantee its absolute security.
10. Your data protection rights under the General Data Protection Regulation (GDPR)
If you are a resident of the European Union (EU) or the European Economic Area (EEA), you have
certain data protection rights covered by the GDPR.
We aim to take reasonable steps to let you correct, amend, delete or limit the use of your
Personal Data.
If you want to know what personal data we hold about you, or you want it removed from our systems,
write to us at support@yumsto.com.
In certain circumstances you have the following data protection rights:
0.1. the right to access, update or delete the information we hold about you;
0.2. the right to rectification. You have the right to have your data corrected if it is
inaccurate or incomplete;
0.3. the right to object. You have the right to object to our processing of your Personal Data;
0.4. the right to restriction. You have the right to ask us to restrict the processing of your
personal data;
0.5. the right to data portability. You have the right to receive a copy of your Personal Data in
a structured, machine-readable and commonly used format;
0.6. the right to withdraw consent. You also have the right to withdraw your consent at any time
where we rely on consent to process your personal data;
Please note that we may ask you to verify your identity before responding to such requests, and
that without certain necessary data we may not be able to provide the service.
You have the right to lodge a complaint about our collection and use of your personal data with
the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů). Your local data
protection authority in the European Economic Area (EEA) can give you more information.
11. Recipients of personal data (subprocessors)
We use third-party services to run the online store and deliver goods. We pass those parties only
the data strictly necessary to provide the particular service:
1. Payments (Stripe):
We use Stripe, operated by Stripe, Inc. and its affiliates, to process online payments. Card
details are not processed by us but directly by Stripe. You will find Stripe's privacy policy
here: https://stripe.com/privacy.
2. Delivery (Zásilkovna, PPL):
To deliver goods we pass your name, surname, delivery address, phone and email to the carrier you
chose in the basket — Zásilkovna s.r.o. (Packeta), company no. 28408306, or PPL CZ s.r.o., company
no. 25194798 — so they can let you know about the delivery and hand the parcel over.
3. Accounting and tax services:
Your billing details may be processed by an external accounting firm in order to meet our
statutory tax obligations.
12. Analytics
We measure traffic and use of our Services with our own tools on our own infrastructure. We do not
pass analytics data to advertising networks and we do not connect it with your behaviour on other
sites. You will find the details and retention periods above under Analytics cookies.
13. CI/CD tools
We may use third-party service providers to automate the development process of our Services.
14. Advertising and remarketing
We do not run advertising or remarketing yet. We do not show third-party adverts
in our Services, we do not use remarketing or advertising cookies, and we do not pass data about
your visits to advertising networks.
If that changes, we will describe it in this Privacy Policy, add the relevant cookies to the list
above, and ask you for consent in advance.
15. Links to other sites
Our Services may contain links to other sites that we do not operate. If you click a third-party
link, you will be taken to that third party's site. We strongly encourage you to read the privacy
policy of every site you visit.
We have no control over, and take no responsibility for, the content, privacy policies or
practices of any third-party sites or services.
16. Children's privacy
Our Services are not intended for use by children under 15 ("a Child" or "Children").
We do not knowingly collect personal data from children under 15. If you find that a child has
given us personal data, please contact us. If we find that we have collected personal data from a
child without their legal guardian's consent, we will take steps to remove that information from
our servers.
17. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will let you know about changes by
publishing the new version on this page and updating the effective date at the top.
If a change affects something you gave us consent for, we will ask you again before it takes
effect. We recommend checking this Privacy Policy from time to time. Changes take effect when they
are published on this page.
18. Contact us
If you have any questions about this Privacy Policy, write to us at support@yumsto.com.