Právní minimum pro e-shopy

The cornerstone of every e-shop: GDPR and personal data protection

Why is GDPR crucial for your business and what is "personal data"?

The GDPR regulation applies to every entrepreneur who processes their customers' data in any way – from small family e-shops to large international corporations. If you collect contacts to ship orders or send newsletters, GDPR is binding for you.

Personal data means any information that leads to the identification of a specific person. In the context of e-commerce, this includes not only first name, last name, and delivery address, but also email address, phone number, computer IP address, or data collected through marketing and analytical cookies.

Under GDPR, it is crucial to distinguish between two roles. You, as the e-shop operator, are the data controller because you determine the purpose and means of processing the data. Your partners, such as carriers, accounting firms, marketing agencies, or email tool providers, act as data processors.

ARROWS routinely helps companies identify personal data processing operations and correctly set up contractual relationships between controllers and processors. For a legal consultation, contact us at consultation@arws.cz.

Privacy Policy: Is your document in order?

The fundamental information document for your customers is the Privacy Policy. This is not a mere formality, but a key document that must be easily accessible from every page of your website, written in an understandable way, and separated from the terms and conditions.

This document must contain precisely defined information: your contact details as the controller, what specific data you collect, for what purpose (e.g., order processing, marketing), on what legal basis (performance of a contract, legitimate interest, consent), to whom you transfer it (carriers, payment gateways), and how long you retain it.

Using generic templates downloaded from the internet is highly risky because they do not reflect the specific processes of your e-shop and may be incomplete or outdated.

The Czech legal team at ARROWS will prepare a Privacy Policy tailored to your business, ensuring it precisely meets your needs and protects you during any inspection. To have your documentation prepared, write to us at consultation@arws.cz.

A cookie banner that stands up to inspection: How to handle consents in 2025?

Since 2022, strict rules for using cookies have been in place in the Czech Republic. It is necessary to distinguish between technical cookies, which are essential for the functioning of the website (e.g., cart contents), and all others – typically analytical and marketing cookies. For these non-technical cookies, you must obtain the active and free consent of the visitor (so-called opt-in).

In practice, this means that your cookie banner must not have pre-checked boxes for marketing cookies. The reject button must be just as visible and easy to access as the accept button. At the same time, the banner must not prevent the visitor from browsing the website even if they do not grant consent.

Furthermore, technology platforms like Google and Microsoft have tightened their requirements and require the implementation of Consent Mode v2 for full ad and analytics functionality. This means that your website must technically correctly transmit the signal of granted or denied consent. Without this, your advertising campaigns and measurement accuracy may be restricted. Legal compliance is thus inseparably linked to the technical setup of the e-shop today.

Newsletters and email marketing: How to avoid breaking the law and losing customers?

Email marketing is a powerful tool, but it has its rules. To send commercial communications to your existing customers, you can use the so-called customer exception. This allows you to send them offers for your own, similar products and services without their explicit consent. However, the condition is that the customer must have the opportunity to easily and free of charge refuse such mailings at the time of purchase (opt-out).

If you want to send newsletters to people who have not yet purchased from you, you need their active and provable consent (opt-in). It is not enough for them simply not to uncheck a pre-checked box. The ideal solution is the so-called double opt-in, where the user, after signing up, confirms their interest by clicking a link in a confirmation email. Every email sent must then contain a functional link for easy unsubscribing.

ARROWS offers professional training for your marketing teams to prevent errors when sending commercial communications. For more information and a certificate of completion, write to us at consultation@arws.cz.

Advertising, discounts, and a fair approach to the customer: How to avoid fines from the ČOI?

Transparency in business practices is not a weakness, but a powerful marketing tool that builds customer loyalty. The Czech Trade Inspection Authority (ČOI) has focused intensively on the online environment in recent years and strictly penalizes unfair practices. Let's look at the areas where e-shops make mistakes most often.

The Omnibus Directive in practice: How to correctly communicate discounts?

One of the most significant recent changes is the rules for communicating discounts, introduced by the European Omnibus Directive. Its goal is to prevent the artificial inflation of prices right before discount events, such as Black Friday, which created a false impression of a bargain for customers.

The key rule is: if you indicate a discount on a product, you must state as the original price the lowest price at which you sold the product in the last 30 days before providing the discount. This obligation applies to any announcement of a discount, whether in percentages, a specific amount, or events like "Black Friday".

For example, if you sell a product for CZK 1,000 and decide to discount it to CZK 800, you must state CZK 1,000 as the reference price. However, if you had discounted the product to CZK 900 for a short time in the last 30 days, you must calculate the discount from this lowest price. The Czech Trade Inspection Authority (ČOI) focuses intensively on this area and imposes high fines.

ARROWS conducts e-shop audits and prepares internal pricing guidelines under Czech legislation to protect you from sanctions. For a legal consultation, write to us at consultation@arws.cz.

Customer reviews: How to work with them and when do you face penalties for fake ones?

Customer reviews have a huge impact on purchasing decisions. Up to 90% of customers rely on them. That is why legislation has introduced a new obligation: e-shop operators must adopt reasonable and proportionate measures to verify that reviews come from consumers who actually purchased the product or service.

Publishing fake reviews, deleting negative ones, or paying for positive ratings without transparently labeling it is considered a misleading commercial practice. You should therefore clearly inform visitors on your website how you verify the authenticity of reviews (e.g., by linking to an order number or sending a rating link only after purchase).

Our Prague-based legal team will help you set up review management processes and prepare the necessary information for your terms and conditions. Do not hesitate to contact our office – consultation@arws.cz.

Unfair competition in the online environment: Beware of misleading advertising and parasitizing on competitors

Unfair competition is any conduct in business relations that conflicts with the good morals of competition and is capable of causing harm to other competitors or customers. In the online environment, it takes many forms that you should avoid:

• Misleading advertising: Providing false or misleading information about product features, price, origin, or availability. An example is so-called bait advertising, where you lure customers with a product at a great price but do not have it in sufficient quantity in stock.

• Creating a risk of confusion: Using a product name, logo, or design that is easily confused with an established competitor's brand. The goal is to confuse the customer and benefit from the reputation of another entity.

• Parasitizing on reputation: Exploiting the good name, reputation, or brand of another competitor for one's own benefit without direct confusion occurring. This can include, for example, using a similar slogan.

It is important to realize that a single marketing misstep, such as a fake discount, can present a triple legal risk. You face not only a fine from the ČOI, but also private law claims from customers (e.g., the right to withdraw from the contract) and lawsuits from competitors for damages.

ARROWS has extensive experience representing clients in unfair competition disputes. Need legal help? Contact us at consultation@arws.cz.

The future is here: Are you ready for the new digital accessibility obligation from 2025?

The horizon brings a new and, for many e-shop operators, still unknown legislative obligation that will fundamentally affect online business. The European Accessibility Act (EAA) is not just another regulation, but an opportunity to make your business accessible to a wider range of customers and thus gain a significant competitive advantage. However, time for preparation is running out.

What is the European Accessibility Act (EAA) and does it apply to your e-shop?

The European Accessibility Act, implemented in the Czech Republic by Act No. 424/2023 Coll., on accessibility requirements for certain products and services, stipulates that from June 28, 2025, e-shop websites and mobile applications must be accessible to persons with disabilities. The goal is to remove digital barriers that prevent people with visual, hearing, motor, or cognitive impairments from fully utilizing online services.

This obligation applies to the vast majority of e-shops that sell goods or services to consumers. The law provides an exception for so-called micro-enterprises, i.e., companies with fewer than 10 employees and an annual turnover or annual balance sheet total of up to EUR 2 million.

What specific steps do you need to take and what do you risk if you do nothing?

Accessibility in practice means that your e-shop must be designed and programmed to be perceivable, operable, understandable, and robust for all users. Specific requirements include, for example:

• Full keyboard navigability of the website (without the need to use a mouse).

• Providing text alternatives (so-called alt texts) for images so that screen readers can read them.

• Sufficient color contrast between text and background.

• Captions and transcriptions for video and audio content.

• Logical and predictable page structure with correctly used headings.

In addition to technical adjustments, you will also need to have a publicly available document on your website describing how you meet the accessibility requirements. Failure to comply with these obligations risks sanctions. The supervisory authority will be the Czech Trade Inspection Authority (ČOI), which can impose a fine of up to CZK 10 million or, in extreme cases, even suspend the operation of your service.

However, investing in accessibility is not just a regulatory compliance cost. It is a direct investment in marketing and growth. An accessible website is better rated by search engines (better SEO), is more user-friendly for everyone (including seniors), and therefore has a higher conversion rate and reaches a wider market.

ARROWS provides legal consultations on obligations arising from the EAA and helps prepare legally required documentation. To audit your obligations, write to us at consultation@arws.cz.

Your brand is your most valuable asset: How to protect it effectively?

In a crowded online space, a strong and well-protected brand is a key factor for success. It is not just a logo or a name; it is the reputation, customer trust, and value you have built over the years. Legal brand protection should therefore not be seen as an expense, but as a strategic investment in the stability and future value of your company.

Trademark vs. company name: Why registration in the Commercial Register alone is not enough?

Many entrepreneurs mistakenly believe that registering their company name in the Commercial Register provides them with sufficient protection. However, this is a dangerous misconception. A company name only protects that exact name and does not prevent competitors from using a very similar or confusingly similar designation for their products or services.

In contrast, a registered trademark gives you the exclusive right to use the given designation (name, logo, slogan) for specific classes of products and services. It provides you with a strong legal tool to defend yourself against anyone trying to imitate or parasitize on your brand. A trademark is an intangible asset that increases the value of your company in the eyes of investors and during a potential sale.

How does trademark registration work in the Czech Republic and the entire EU?

The registration process varies depending on the territory where you want to protect your brand.

• National registration in the Czech Republic: The application is filed with the Industrial Property Office (IPO). The basic administrative fee is CZK 5,000 for protection in up to three classes of products and services for a period of 10 years. If the proceedings go smoothly (e.g., without opposition from third parties), registration takes approximately 6 to 9 months.

• European registration (EU trademark): If you target multiple markets in the European Union, it is more efficient to file a single application with the European Union Intellectual Property Office (EUIPO). This gives you protection in all EU member states. The basic fee starts at EUR 850 for one class.

Furthermore, for small and medium-sized enterprises (SMEs), there is a European grant program called the SME Fund, which can cover up to 75% of the administrative fees for trademark registration.

ARROWS manages the complete registration process for both national and European trademarks, including processing grants. For a free check of your brand, write to us at consultation@arws.cz.

Domain name as a battlefield: How to resolve disputes and defend against cybersquatting?

Registering a domain name alone does not guarantee full legal protection of the name. In the event of a dispute, older rights generally take precedence, which is typically a registered trademark. If someone registers a domain that is identical or confusingly similar to your trademark, you will most likely be able to successfully defend yourself.

A common problem is cybersquatting – the speculative registration of domain names with the aim of later selling them at a profit to the trademark owner or parasitizing on their reputation. One of its forms is typosquatting, where a speculator registers a domain with a typo (e.g., arows.cz instead of arws.cz) and relies on user errors.

If such a dispute arises, there are several options for resolution: from an out-of-court settlement to specialized alternative dispute resolution (ADR) at the CZ.NIC association, to court proceedings.

Our legal team specializes in domain disputes and representation in domain name transfer proceedings. Connect with us at consultation@arws.cz and get a tailored legal solution.

Selling abroad: How to protect your brand in international markets?

When expanding into foreign markets, it is crucial to realize that the protection of industrial property rights is territorial. A Czech trademark will not protect you in Germany, and a European trademark does not apply in Switzerland or the USA. Before entering a new market, it is therefore essential to conduct a search and secure the registration of your brand in that country as well.

Neglecting this step can lead to your hard-earned brand already being taken in the new market, forcing you to undergo a costly and customer-confusing rebranding.

ARROWS, thanks to its international network ARROWS International, built over more than ten years, ensures the registration and protection of brands worldwide. We handle cases with an international element daily and are ready to support your global expansion.

Conclusion: Legal certainty as a competitive advantage

Operating a successful e-shop is a complex discipline where marketing, logistics, technology, and, last but not least, law intersect. As this article has shown, key areas such as GDPR, rules for advertising and discounts, the new digital accessibility obligation, and brand protection require constant attention.

However, a proactive approach to legal obligations is not a cost, but a strategic investment. A secure e-shop that communicates transparently with customers and protects their data and its brand builds trust, minimizes the risk of expensive disputes and fines, and creates a stable foundation for future growth.

ARROWS provides comprehensive legal services for e-shops, backed by years of experience in serving our clients. Our portfolio includes more than 150 joint-stock companies, 250 limited liability companies, and 51 municipalities and regions. We pride ourselves on speed, high quality, and a deep understanding of our clients' businesses. We can also connect them if we see interesting business or investment opportunities.

Whether you are dealing with a specific problem or want to preventatively secure your e-shop for future growth, we are here for you. Write to us at consultation@arws.cz to arrange an initial consultation.