Privacy policy

This Privacy Policy takes effect on 10 August 2026.

This privacy policy is issued in accordance with the General Data Protection Regulation and the Czech Personal Data Processing Act by Naturlabs s.r.o., Company ID: 24654736, VAT ID: CZ24654736, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 444856, with its registered office at Chudenická 1058/32, Hostivař, 102 00 Praha 10.

1. Definitions

1.1. “GDPR”: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, as amended on the date of issue of this Policy;

1.2. “Customer”: Any natural or legal person who enters into a contractual relationship with our company by concluding a Purchase Contract;

1.3. “Purchase Contract”: A contract for the purchase of goods concluded under Section 2079 et seq. of Act No. 89/2012 Coll., the Civil Code, in which our company acts as the seller and the Customer as the buyer;

1.4. “Controller”: The company Naturlabs s.r.o., Company ID: 24654736, with its registered office at Chudenická 1058/32, Hostivař, 102 00 Praha 10;

1.5. “Policy”: This privacy policy, governing the processing of our customers' personal data.

2. Introductory provisions

2.1. This Policy defines the rights and obligations between the Controller and the Customer in the personal data processing that takes place in connection with transactions under the Purchase Contract.

2.2. The Customer must read these data protection rules carefully before sending an order and concluding the Purchase Contract.

2.3. This Policy and the Purchase Contract are concluded in the Czech language and are governed by the generally binding legislation of the Czech Republic.

3. Personal data controller

3.1. The personal data controller is Naturlabs s.r.o.

3.2. If you have questions or wish to exercise your data protection rights, you can contact us at the company's registered office, by email at office@naturlabs.cz or by phone at +420 793 992 624.

4. Purpose of personal data processing

4.1. The main reason for processing personal data is the proper performance of all obligations arising from the Purchase Contract, both towards Customers who are natural persons and towards natural persons acting on behalf of Customers who are legal persons.

4.2. We also process personal data to comply with the legal obligations imposed on the Controller by binding legislation and for the necessary protection of our company's legitimate interests.

4.3. The Controller also processes personal data to the extent of email address and name for direct marketing, in the form of sending commercial communications (newsletters). This is done either on the basis of legitimate interest towards existing Customers or on the basis of the voluntary and explicit consent of a website visitor.

5. Legal basis for personal data processing

5.1. The legal bases for processing personal data are:

1. performance of the Purchase Contract by the Controller within the meaning of Article 6(1)(b) GDPR;
2. compliance with legal obligations that apply to the Controller under Article 6(1)(c) GDPR;
3. the legitimate interests of the Controller under Article 6(1)(f) GDPR, consisting in the possibility to establish, exercise or defend the Controller's legal and commercial claims arising from the Purchase Contract; and
4. voluntary and explicit consent to the processing of personal data for marketing and sending commercial communications under Article 6(1)(a) GDPR, where the newsletter subscription takes place outside the context of concluding a Purchase Contract (for example by subscribing in the E-shop).

6. Scope of personal data processing

6.1. The Controller processes the identification, address and contact data of the Customer (or of persons representing the Customer), information the Customer provides to the Controller and data collected in the course of performing contractual obligations.

6.2. Data is handled strictly to a reasonable and relevant extent, limited to the minimum necessary for the stated purpose of processing.

7. Recipients and processors of personal data

7.1. To run the e-shop, the Controller is entitled to pass personal data to selected external partners in the following categories:

• providers of legal services and lawyers;
• administrators, developers and operators of our website;
• providers of IT systems, hosting services and software tools;
• accounting advisers, auditors and tax specialists;
• providers of logistics, postal and courier services for the purpose of delivering the ordered goods;
• operators of analytics and advertising tools, in particular Google Ireland Limited, Meta Platforms Ireland Ltd. and Seznam.cz, a.s., exclusively to the extent of data obtained through cookies and similar technologies on the basis of your consent given in the cookie banner. You will find details, including an overview of individual cookies, in the Cookie Policy.

7.2. Your personal data will not be passed on or made available in any way to any third parties other than those listed above without your knowledge.

8. Personal data retention period

8.1. We store personal data only for as long as strictly necessary for the purpose for which it was collected. The specific retention periods are as follows:

• Data processed for the performance of the contract (under clause 5.1(a)) is kept until all obligations under the Purchase Contract have been fully settled and have ceased. This does not limit the Controller's right to subsequently use this data to a minimal extent for the purposes under other clauses of this Policy;
• Data processed to comply with legal obligations, including direct marketing towards existing Customers (under clause 5.1(b)), is kept for the entire period required of the Controller by the relevant legislation (for example the Accounting Act or the VAT Act).
• Data processed to protect legitimate interests (under clause 5.1(c)) is kept for a maximum of 10 years from the time all obligations under the Purchase Contract ceased. However, if judicial, administrative or other proceedings are started in which the Controller defends its rights against the Customer, the period is extended and does not end before those proceedings are finally concluded.
• Data processed on the basis of your marketing consent (under clause 5.1(d)) is kept for 5 years from when it was given, or until you withdraw your consent. You can unsubscribe from commercial communications at any time by clicking the link in every email we send.

9. Your rights as a data subject

9.1. In connection with the protection of your privacy, you can:

• request access to your personal data from the Controller under Article 15 GDPR;
• request the Controller to correct inaccurate data or erase it completely under Articles 16 and 17 GDPR;
• request the Controller to restrict the processing of your data under Article 18 GDPR;
• request the Controller to transfer your data to another controller under the conditions of Article 20 GDPR;
• object to the Controller to the processing of your personal data in accordance with Article 21 GDPR.

9.2. If you believe that we are handling your data unlawfully, you have every right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (ÚOOÚ).

Prague, 10 August 2026.