Legal documents
Privacy policy
What data we process, why, for how long and what rights you have. We do not process health data and we do not ask for it.
Last updated: 17 Aug 2026
1. Controller
[TO BE COMPLETED — company name], [TO BE COMPLETED — address],
Company ID [TO BE COMPLETED].
Contact for data protection matters: [TO BE COMPLETED — e-mail].
Processing is governed by the GDPR, Regulation (EU) 2016/679, and by Act
No. 18/2018 Coll. on the protection of personal data.
2. What data we process
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Fulfilling an order | name, address, e-mail, phone | performance of a contract | 10 years (accounting) |
| Invoicing and accounting | billing details, company ID, tax ID | legal obligation | 10 years |
| Delivery | name, address, phone | performance of a contract | until delivery + complaint period |
| Age 18+ confirmation | record of confirmation, hash of the IP address | legitimate interest | 3 years |
| Answering enquiries | e-mail and the content of the message | legitimate interest | 1 year |
| Newsletter | consent | until consent is withdrawn |
3. What we do NOT process
This matters for our range:
- We do not process health data and we do not ask for it. Nowhere in the ordering process is there a field for a diagnosis, an intended use or a state of health.
- Health data is a special category of data under article 9 of the GDPR and has no place in an order for a research substance. If you write such information into a note, we will delete it.
- We do not process data about children — purchase is possible only from the age of 18.
4. Who we share data with
We do not sell personal data and we do not provide it for third-party marketing.
We share it only with recipients necessary for the service to work:
- Hosting: [TO BE COMPLETED — Websupport, s. r. o., Slovakia]
- Carrier: [TO BE COMPLETED — e.g. Packeta, GLS]
- Payment gateway: [TO BE COMPLETED]
- Invoicing system: [TO BE COMPLETED]
- Accountant: [TO BE COMPLETED]
We do not transfer data outside the European Economic Area. Should that become
necessary, we will add the legal basis for the transfer here.
5. Your rights
You have the right:
- of access to the data we hold about you;
- to rectification of inaccurate data;
- to erasure, where we no longer need the data for the purpose for which we obtained it (data we must keep for accounting purposes is an exception);
- to restriction of processing;
- to portability of the data in a structured format;
- to object to processing based on legitimate interest;
- to withdraw consent at any time, where processing is based on consent.
Send your request to [TO BE COMPLETED — e-mail]. We will reply within one month.
6. Complaints
If you believe we are processing data incorrectly, you may lodge a complaint
with the Office for Personal Data Protection of the Slovak Republic,
Hraničná 12, 820 07 Bratislava,
7. Security
- Transmission is encrypted with HTTPS.
- Only people who need the data for their work have access to it.
- IP addresses recorded with the age confirmation are stored hashed, not in readable form — that is enough as proof of the confirmation and is a smaller intrusion into privacy.
8. Cookies
The use of cookies is described in a separate document,
Notice about this document
This document is a draft prepared together with the website and contains places
marked [TO BE COMPLETED]. The list of recipients in article 4 must be completed
according to the services actually used — nothing you do not use may remain
there, and nothing you do use may be missing.