Privacy Policy
Provisional version — This document is currently under legal review. For any questions, contact [email protected].
1. Controller
The controller responsible for data processing is VITALORA s.r.o. (Cannabuben), Kamenická 801/15, 170 00 Praha 7, Czech Republic. Contact: [email protected].
2. Data we process
We process the data you provide when ordering (name, address, email, phone) to process your order, as well as technical data (IP address, browser) for the secure operation of the site.
3. Purpose & legal basis
Your data is processed to fulfil the contract (order processing, delivery, payment), to comply with legal obligations, and — with your consent — for newsletter and analytics.
4. Cookies & analytics
We use necessary cookies and, with your consent, Google Analytics 4 (anonymised) and PostHog. You can manage your choices via the cookie banner at any time.
Using PostHog may involve a transfer of personal data to the USA (a third country). PostHog Inc. is certified under the EU-U.S. Data Privacy Framework (including the UK Extension and the Swiss-U.S. Data Privacy Framework); the European Commission has issued an adequacy decision for this under Art. 45 GDPR. In addition, EU Standard Contractual Clauses (Art. 46 GDPR) are agreed in the data processing agreement (DPA) as a further safeguard.
5. Sharing
Data is shared only with service providers required to fulfil your order (e.g. shipping carriers PPL, payment provider) and only to the extent necessary.
6. Your rights
You have the right to access, rectify, erase, restrict and port your data, and to object to processing. To exercise these rights, contact [email protected].
7. Retention
We retain personal data only as long as necessary for the stated purposes or as required by statutory retention periods.
8. Cart reminders
If you tick the box for offers, news and cart reminders at checkout, we store your email address together with your cart. If you do not complete your order, we remind you of your cart by email, at most three times (after about 1 hour, 24 hours and 72 hours); the last email contains a discount code. The legal basis is your consent under Art. 6(1)(a) GDPR. Emails are sent via our email service provider Brevo (Brevo SAS, Paris, France) as our processor. You can withdraw your consent at any time: by unticking the box at checkout, via the unsubscribe link in every email, or by writing to [email protected]. If you place your order, the reminders stop automatically.