Privacy Policy

Marselan s.r.o. (the "Controller", "we", "us") is the data controller of the personal data processed through the Biohacker. e-commerce store. We process your personal data in accordance with Regulation (EU) 2016/679 (the GDPR) and the Czech Act No. 110/2019 Coll., on the processing of personal data.

• Marselan s.r.o.
• IČO: CZ06533141
• Podvinný mlýn 2281/12, 190 00 Prague, Czech Republic
• Privacy contact: info@biohacker-shop.eu

• Identity data — first name, last name, date of birth (where required for age-restricted products).
• Contact data — billing and shipping address, email address, telephone number.
• Transaction data — order history, payment confirmations, invoices, refunds. We do not store full payment card numbers.
• Technical data — IP address, browser type and version, device identifiers, time zone, operating system, pages viewed.
• Marketing data — newsletter preferences, consent records, interaction with our emails and campaigns.

• Contract performance — Art. 6(1)(b) GDPR: processing orders, delivery, customer support, returns.
• Legal obligation — Art. 6(1)(c) GDPR: accounting, tax, consumer protection, and product safety obligations under EU and Czech law.
• Legitimate interests — Art. 6(1)(f) GDPR: fraud prevention, store security, product improvement, direct marketing to existing customers.
• Consent — Art. 6(1)(a) GDPR: non-essential cookies, analytics, marketing emails to non-customers. You may withdraw consent at any time.

• Order and invoice records: 10 years from the end of the accounting period (Czech Act on Accounting No. 563/1991 Coll.).
• Customer accounts: 3 years from your last login; inactive accounts are then deleted or anonymised.
• Marketing data: until you withdraw consent or object.
• Cookies: up to 13 months, depending on cookie type.

We share personal data only with carefully selected processors under written data processing agreements:

• Shopify Inc. — e-commerce platform and hosting. International transfers are covered by EU Standard Contractual Clauses (SCC).
• Viva Payments S.A. — payment processing, PCI-DSS Level 1 certified.
• Shipping carriers — for example DPD, GLS, Packeta, Česká pošta, for delivery of your orders.
• Email service provider — for transactional and marketing email delivery.

Under the GDPR you have the following rights, which you can exercise at any time:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure / "to be forgotten" (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object, including against direct marketing (Art. 21)
• Right to withdraw consent at any time (Art. 7(3))

To exercise any of these rights, contact us at info@biohacker-shop.eu. You also have the right to lodge a complaint with the supervisory authority — the Czech Office for Personal Data Protection (ÚOOÚ), uoou.cz.

We use essential cookies required for the store to function (cart, checkout, security) and, with your consent, optional analytics cookies to understand how the store is used. You can review and change your preferences at any time via the cookie banner.

Some of our processors are located outside the European Economic Area. In such cases, transfers are protected by appropriate safeguards under Article 46 GDPR, in particular the European Commission's Standard Contractual Clauses (SCC). A copy of the safeguards can be requested at info@biohacker-shop.eu.