1. Data controller

The controller determines the purposes and means of personal-data processing in connection with operating the online store.

2. Personal data we process

Depending on how the store is used, we process data such as name, e-mail, telephone number, billing and delivery details, selected country and language, order contents and history, prices, discounts and payment references, carrier and pickup-point data, communications, complaints, withdrawals and returns, customer-account and LP VIP data, e-mail verification status and necessary technical, security and operational data. Passwords are stored only in irreversibly hashed form; one-time verification codes are time-limited.

3. Purposes and GDPR legal bases

We process personal data primarily: (a) to take steps at your request and perform the contract, including the order, account, communications, delivery, payment, withdrawals and complaints – Article 6(1)(b) GDPR; (b) to comply with accounting, tax and other legal obligations – Article 6(1)(c); (c) for website and account security, fraud/abuse prevention, basic server-side traffic statistics, record keeping, legal claims and proportionate customer-relationship administration – Article 6(1)(f); and (d) where a genuinely optional feature is based on consent, Article 6(1)(a). We do not require consent for processing necessary for a contract or legal obligation.

Data marked as required during checkout is contractually necessary to enter into and perform the contract or to comply with a related legal obligation. Without such data, the order generally cannot be concluded, delivered or properly processed. Optional data is identified as optional.

4. Sources of personal data

Most data is obtained directly from you when placing an order, registering, managing your account or communicating with us. Other data is generated while using the store or processing an order, such as payment, shipping and order status. Where data is received from a carrier, bank, pickup-point provider or another partner in connection with your order, it is processed only as necessary.

5. Recipients and processors

Where necessary, data may be shared with hosting and IT providers, e-mail infrastructure providers, accounting services, banking/payment providers, the selected carrier and pickup network, address-verification providers and other suppliers necessary to operate the store or fulfil an order. Where a processor is used, appropriate contractual and security safeguards under Article 28 GDPR are required. Data may be disclosed to public authorities where required by law.

6. Transfers outside the EEA

We prefer providers and processing within the European Economic Area. If a specific provider transfers personal data outside the EEA, this may occur only in accordance with the GDPR, for example on the basis of an adequacy decision or appropriate safeguards under Article 46 GDPR. Information about the applicable mechanism will be provided on request where relevant.

7. Retention periods

Personal data is retained only as long as necessary for its purpose. Order, invoicing and payment data is kept for contract performance and then for applicable accounting and tax retention periods. Complaint, withdrawal, return and communication records may be retained as necessary to demonstrate compliance and establish, exercise or defend legal claims. Customer-account profile data is kept while the account exists and afterwards only to the extent required for legal obligations or claims. Security and verification records are kept only for a technically and legally proportionate period according to their purpose. When the purpose ends, data is deleted or anonymised unless further retention is required by law.

8. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction, portability and to object to processing based on legitimate interests. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of earlier processing. Requests can be sent to the controller’s privacy e-mail; we may reasonably verify your identity before responding.

9. Complaint to a supervisory authority

You have the right to lodge a complaint with a competent supervisory authority, in particular in the Member State of your habitual residence, place of work or the alleged infringement. For a controller established in Czechia, the lead national authority is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz. A data subject in Slovakia may also contact the Slovak Office for Personal Data Protection where permitted by the GDPR.

10. Automation, LP VIP and decision-making

The store may automatically calculate prices, discounts, LP VIP tiers, shipping availability or technical risk signals. These operational calculations do not constitute solely automated decision-making producing legal or similarly significant effects on the customer within Article 22 GDPR. If such decision-making is introduced in the future, this Policy will be updated before it is deployed.

11. Cookies and similar technologies

The store uses technical cookies and session data necessary for the cart, language, sign-in, security, remembering the research-access acknowledgement and basic site operation. For basic traffic measurement we use our own server-side analytics without analytics cookies and without storing an analytics identifier in the browser. To estimate unique and returning visitors, the server briefly processes standard connection data (IP address, user-agent and browser language) and converts it into a pseudonymous hash; the raw IP address is not stored in analytics tables. The data is used only for our own statistics, operation and improvement of the website and is not provided to advertising networks.

12. Security

We use technical and organisational measures appropriate to the nature of the store, including encrypted HTTPS transport, access controls, password hashing, CSRF protection and separation of administrative permissions. No system can guarantee absolute security, so safeguards are kept under review and adapted to risk.

13. Persons under 18

The online store and research catalogue are intended for persons aged 18 or over, and we do not knowingly collect children’s personal data for customer accounts or orders. If we learn that an account or order was created by a person who does not meet the access conditions, proportionate steps may be taken, including blocking the account, without affecting statutory data-subject rights.

14. Legal framework and changes

Processing is governed primarily by Regulation (EU) 2016/679 (GDPR), Czech Act No. 110/2019 on Personal Data Processing and applicable electronic-communications rules. For Slovak data subjects, Act No. 18/2018 Z. z. as in force in 2026 is also taken into account where applicable. This Policy is effective from 6 September 2026 and may be updated if the store’s operation or legal requirements change.