Privacy and Personal Data Protection Policy

2. Personal Data We Collect

The personal data we process depends on how you use our website and services.

We may process, for example, the following categories of information:

• Identification and contact details – name, billing and shipping address, e-mail address and telephone number;
• Customer and account information – account-related information, login details and account preferences;
• Order and transaction information – products ordered, quantities, order value, shipping method, payment method, invoicing information and order history;
• Business customer information – company name, VAT number and other information required for invoicing or a B2B relationship;
• Payment-related information – payment status, transaction identifiers and other information required to confirm payment;
• Communication information – messages sent to customer support, e-mails, returns and complaint information;
• Marketing preferences – your choices relating to newsletters, direct marketing and consent;
• Technical and usage data – IP address, browser type, device information, operating system, log information and website usage information;
• Cookie and similar technology data, where their use is permitted by applicable law and your choices.

Where payments are processed through an external payment provider, we generally do not receive your complete payment card details. Such information is processed within the secure payment environment of the relevant payment provider.

3. Sources of Personal Data

We obtain personal data mainly:

• directly from you when you place an order, create an account, complete a form or contact us;
• automatically when you use our website, for example through logs, cookies and similar technologies;
• from payment, shipping and other service providers to the extent necessary to process your order, payment, delivery, return or another service requested by you.

5. Cookies & Similar Technologies

Our website uses cookies and similar technologies for the technical operation and security of the online store, remembering preferences and, depending on your choices, analytics and marketing.

Cookies strictly necessary for the operation of the website may be used without separate consent where permitted by law.

Non-essential cookies and tracking technologies are used only in accordance with applicable law and your cookie preferences. Further information about cookies, their purposes and how to manage your preferences is available in our Cookie Policy.

6. Recipients of Personal Data

We do not sell your personal data.

We may disclose or make personal data available only to the extent necessary for the relevant service or purpose, including to the following categories of recipients:

• payment service providers, banks and payment systems;
• postal, shipping and courier services;
• e-commerce hosting, IT, security and technical service providers;
• e-mail, customer support and newsletter service providers;
• analytics and marketing service providers where their use is consistent with applicable law and your choices;
• accountants, tax advisers, lawyers and other professional advisers;
• authorities, courts or other parties where disclosure is required by law or a lawful order.

Service providers may process personal data only to the extent necessary to perform their tasks and in accordance with applicable contractual and data protection obligations.

7. Transfers Outside the European Economic Area

Some service providers we use may be located outside the European Economic Area (EEA) or may process data in countries outside the EEA.

Where personal data is transferred outside the EEA, we ensure that the transfer has an appropriate legal basis and safeguards in accordance with applicable data protection law.

Depending on the circumstances, such mechanisms may include a European Commission adequacy decision, Standard Contractual Clauses approved by the European Commission or another transfer mechanism permitted by applicable law.

8. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal obligations.

When determining retention periods, we consider, among other things:

• the duration of the customer relationship and contract;
• the time required to process an order, delivery, return or complaint;
• statutory retention periods for accounting, tax and other records;
• applicable limitation periods for legal claims;
• security and fraud-prevention requirements;
• withdrawal of consent or objection to direct marketing.

Newsletter and consent-based marketing data is generally processed until you withdraw your consent or otherwise request that processing stop, unless there is another lawful basis for retaining the data.

When personal data is no longer required, it is deleted, anonymised or otherwise handled in accordance with applicable law.

10. Right to Lodge a Complaint

If you believe that your personal data has been processed in breach of applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.

The Slovenian supervisory authority for HEILTROPFEN LAB d.o.o. is:

Information Commissioner of the Republic of Slovenia
Dunajska cesta 22
SI-1000 Ljubljana
Slovenia
E-mail: gp.ip@ip-rs.si
Website: www.ip-rs.si

11. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, alteration or damage.

Security measures are assessed in relation to the nature of the data processed, the purposes of processing and the identified risks.

However, no transmission over the internet or electronic storage system can provide absolute security.

12. Children's Personal Data

Our online store is not directed at children, and we do not knowingly seek to collect children's personal data unnecessarily.

Where processing of personal data is based on a child's consent in relation to an information society service offered directly to the child, we comply with applicable age and parental-authorisation requirements.

Under Slovenian law, such consent given by the child is generally valid from the age of 15. For children under 15, the approval of a parent, guardian or other person exercising parental responsibility is required where applicable law requires it.

13. Changes to This Privacy Policy

We may update this Privacy Policy if our personal data processing practices, services or applicable legal requirements change.

The current version will be published on this page. Where appropriate, significant changes may also be communicated by other suitable means.