LEGAL INFORMATION
Privacy Policy
Information about the data used by the store and connected profiles.
Document version: 2026-09-18Controller and requests
The identified seller is the controller for its store, orders and customer support. Use the email below for privacy requests. For a profile operated by a separate business, the identity and responsibilities of that business must be stated in its own service information.
Orders and enquiries
We use your name, email, delivery contact, address or pickup point, products, chosen destination link and payment/delivery references to handle your requested purchase (GDPR Article 6(1)(b)). Required information is marked in the form; without necessary delivery information we cannot fulfil the order. Accounting and statutory records are processed under legal obligations (Article 6(1)(c)). Relevant enquiry messages are used to answer you or prepare a quotation. Do not include unnecessary sensitive information.
Accounts and public profiles
Account access uses an email sign-in link instead of a stored password. The platform stores account identifiers, sessions, tag ownership and profile fields to provide the requested service. Public fields can be read by anyone with the public link and may be copied by others. Keep private activation links separate. Pet information can identify a person when combined with owner contact details.
Service emails and marketing
At the current launch, ZORULAB does not operate a newsletter or promotional mailing list. Sign-in links, order confirmations, withdrawal acknowledgements and product-status messages are transactional emails needed to provide the requested service, not subscriptions. If direct marketing is introduced later, it must use an appropriate legal basis and every marketing message must provide an easy, free way to object or unsubscribe.
Security and analytics
Limited authentication and security records support our legitimate interest in preventing misuse (Article 6(1)(f)). Hosting providers process network information such as IP addresses to deliver and protect the service. Optional store analytics uses consent (Article 6(1)(a)); refusing it does not prevent a purchase. Connected profile scan records contain a tag identifier and time; they are not continuous location tracking. We do not use these records to make solely automated decisions with legal or similarly significant effects.
Service providers and international transfers
Cloudflare provides hosting, database and security services. Stripe processes payments and Packeta receives delivery details; their independent processing is described in their own notices. Resend delivers sign-in and service emails; an Ireland sending region does not mean all email metadata stays in the EU. Business email correspondence is also processed by the mailbox provider. The older store uses infrastructure supplied through ChatGPT Sites. Telegram is used only for minimised operational alerts such as an order number, payment state and fulfilment status; delivery labels, addresses and customer contact details are excluded. Providers may process information outside the EEA; applicable adequacy decisions or contractual safeguards must cover those transfers. Ask the controller for the applicable safeguards and provider information.
How long data is needed
Accounting documents are retained for the statutory period, generally ten years following the year concerned under Slovak accounting rules. This does not justify retaining every profile, message or browser identifier for ten years. Other data should be retained only while needed to perform the service, resolve an enquiry or protect a specific legal claim. A deletion request is reviewed individually; necessary legal records may be retained with restricted use. This notice does not claim that all deletion is already automatic.
Your rights
Depending on the applicable conditions, you may request access, correction, erasure, restriction and portability, object to legitimate-interest processing and withdraw consent without affecting earlier lawful processing. Requests are normally answered within one month. If a permitted extension is necessary, we must inform you within that month and explain why. Identity checks must be proportionate. You may complain to the Slovak data protection authority at dataprotection.gov.sk. Agreement to purchase terms is not consent to optional analytics or marketing.
Slovak data protection authority — contact
Include an order reference if available. Never send card details, passwords or secret activation codes.