for the online store www.biomefix.eu | version 2.1 | effective from 1 August 2026

1. Data Controller

The controller of the personal data processed through the online store www.biomefix.eu is BIOMEFIX s.r.o., with the identification and contact details stated in the header of this document (hereinafter the “Controller”).

The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Act No. 110/2019 Coll., on the Processing of Personal Data, and other applicable legal regulations.

2. What Personal Data We Process

Depending on how you use the online store, we may process in particular the following categories of data:

• identification details: first name, surname, company name, company ID (IČO) and VAT ID (DIČ);
• contact details: e-mail, telephone number, billing and delivery address;
• data relating to orders and the contractual relationship: content, number and status of the order, price, method of transport and payment, order history, complaints and withdrawals;
• payment and billing details: details for issuing documents, payment status, transaction identification and account number for refunds;
• customer account data: login details in secured form, profile, saved addresses and settings;
• data from communication: content of e-mails, forms, telephone communication and related attachments;
• marketing data: e-mail, history of consents and unsubscriptions;
• technical data: IP address, device, browser, operating system, logs, time of visit and cookie identifiers.

Card payments are processed by the operator of the GoPay payment gateway as an independent controller of the personal data related to the payment transaction. The Controller does not have access to the complete payment card number or the security code; this data is entered directly into the secure environment of the GoPay payment gateway.

The Controller does not normally require special categories of personal data. However, if a customer voluntarily provides information about their health condition, allergies, intolerances, pregnancy, breastfeeding, medications used, or a previous adverse reaction to a product, in the contact form or when communicating with customer support, this data will be processed only to the extent necessary and on the basis of a separate explicit consent under Article 6(1)(a) and Article 9(2)(a) GDPR.

2.1 Voluntarily Provided Data on Health Condition

The purpose of processing is to handle the specific inquiry and to provide information about the composition, characteristics and correct method of use of the product in accordance with the manufacturer’s information. The information provided is for informational purposes only and does not replace professional medical or pharmaceutical advice, diagnosis or treatment.

Consent is voluntary and may be withdrawn at any time at info@biomefix.eu. Customers should not send their personal identification number (birth number), medical reports, laboratory results, or other data that is not necessary to handle the inquiry.

3. Purposes and Legal Bases of Processing

Purpose	Legal Basis	Typical Data
Order, conclusion and performance of the purchase contract	Art. 6(1)(b) GDPR	identification, contact, order and payment data
Accounting, taxes, complaints and statutory records	Art. 6(1)(c) GDPR	billing data, documents, complaints and payments
Customer account and customer support	Art. 6(1)(b) or (f) GDPR	profile, order and communication history
Protection of rights, fraud prevention and security	Art. 6(1)(f) GDPR	order data, logs and communication
Newsletter and direct marketing	Art. 6(1)(a) or (f) GDPR	e-mail, name and unsubscribe record
Analytical and marketing cookies	Art. 6(1)(a) GDPR	online identifiers and website usage data
Handling an inquiry containing voluntarily provided health data	Art. 6(1)(a) and Art. 9(2)(a) GDPR	content of the inquiry and necessary health data

4. Newsletter and Personalised Marketing Communication

We send marketing communications on the basis of consent or in other cases permitted by legal regulations. We use the Getsitecontrol service, operated by Getwebcraft Limited, to collect marketing contacts and display interactive banners and promotional offers. We use the Ecomail service, provided by ECOMAIL.CZ, s.r.o., to manage contacts and send e-mails.

In connection with marketing, we may process in particular your name, e-mail, the date and manner of granting consent, marketing preferences, information on previous orders, abandoned purchases, delivery, opening or clicking of e-mails, and data on website behaviour, if marketing cookies have been permitted.

On the basis of consent, we may send newsletters, abandoned cart reminders, and personalised offers. We may divide contacts into groups according to purchases, preferences and responses to communication; this evaluation has no legal or similarly significant effect. Consent may be withdrawn at any time via the link in the e-mail or at info@biomefix.eu.

5. Retention Period

• orders and contractual documentation: for the duration of the contractual relationship and thereafter generally 3 years for the protection of legal claims; if a dispute, inspection or other proceeding is ongoing, the necessary data may be retained until its conclusion;
• accounting documents generally 5 years and tax documents generally 10 years, unless a legal regulation provides otherwise;
• complaints and withdrawals: for the duration of their resolution and thereafter for the duration of the relevant limitation periods;
• customer account: until its cancellation, unless further retention is required by law or the protection of legal claims;
• marketing data: until consent is withdrawn; the e-mail may subsequently be kept on a list of unsubscribed contacts, and the record of consent retained for the period necessary to demonstrate compliance;
• general inquiries from the contact form: generally no longer than 12 months from resolution; voluntarily provided health data only for the necessary period, generally no longer than 6 months; technical and cookie data according to the specific tool and cookie settings.

6. Recipients of Personal Data

Personal data may be disclosed, to the extent necessary, in particular to the hosting provider WebSupport, suppliers of website administration and technical support, the companies ECOMAIL.CZ, s.r.o. and Getwebcraft Limited, the companies Google Ireland Limited and Meta Platforms Ireland Limited, the provider of the GoPay payment gateway, carriers and operators of pick-up points, providers of accounting, tax, legal and IT services, McCarter a.s. to the extent necessary to complete the transfer of operations and resolve older orders, and public authorities, where required by a legal regulation or a binding decision.

Some recipients process data as processors under a contract pursuant to Article 28 GDPR; others, such as banks, payment service providers, or carriers, may act as independent controllers. We do not sell personal data or provide it to third parties for their own unrelated marketing purposes.

7. Transfers to Third Countries

In connection with the Google, Meta and Getsitecontrol services, certain personal data may also be processed outside the European Economic Area, in particular in the United States of America. Transfers take place only in compliance with Chapter V GDPR, in particular on the basis of a European Commission adequacy decision, the EU–US Data Privacy Framework, standard contractual clauses, or other appropriate safeguards.

8. Your Rights

• the right to access personal data and to obtain a copy thereof;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure, where the conditions of the GDPR are met;
• the right to restriction of processing;
• the right to data portability in the case of automated processing based on consent or a contract;
• the right to object to processing based on legitimate interest and, at any time, to direct marketing;
• the right to withdraw consent at any time, without affecting the lawfulness of prior processing;
• the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz.

Rights may be exercised by e-mail at info@biomefix.eu or in writing to the Controller’s registered office address. The Controller may, in justified cases, request verification of the applicant’s identity.

9. Website Operation, Cookies and Automated Decision-Making

The website is operated on the WordPress system, the online store uses the WooCommerce platform, and hosting services from WebSupport. We use Google Tag Manager to manage measurement and advertising codes. Necessary cookies are used without consent; Google Analytics, Google Ads, Meta Pixel, and the marketing functions of Getsitecontrol are activated only after the relevant consent has been given. Details and current retention periods are set out in the Cookie Policy and in the “Cookie Settings” tool.

The Controller does not carry out automated individual decision-making or profiling that would produce legal effects concerning the customer or similarly significantly affect them.

10. Security of Personal Data

The Controller uses reasonable technical and organisational measures, in particular access rights management, secure HTTPS communication, backups, protection against malicious software, system updates, and confidentiality obligations for persons with access to the data.

11. Change of Operator of the Online Store

Until 31 July 2026, the online store www.biomefix.eu was operated by McCarter a.s., Bajkalská 25, 821 01 Bratislava, Slovak Republic, Company ID: 35 846 011. From 1 August 2026, the operator and independent controller is BIOMEFIX s.r.o. In connection with the transfer of operations, it acquired in particular data on customer accounts, contact and billing details, order and complaint history, customer communication, marketing preferences, and information on unsubscribing from marketing communication.

The data is processed for the purpose of maintaining customer accounts, ensuring continuity of customer support, handling older requests, fulfilling legal obligations, and protecting legal claims. BIOMEFIX s.r.o. uses the data for marketing communication only where it has valid and demonstrable consent. McCarter a.s. may continue to retain data relating to older orders to the extent necessary to fulfil its own legal obligations and protect legal claims. The change of controller does not affect the scope of the rights of data subjects.

12. Final Provisions

The current version of this policy is always published at www.biomefix.eu. This Privacy Policy takes effect on 1 August 2026.