This policy explains what personal data we collect when you use erohe-lab.com, why, and what rights you have.
Who is responsible
Veeprho Pharmaceuticals s.r.o., Radiová 1122/1, Hostivař, 102 00 Praha 10, Czech Republic (EU), Company ID 02614774, is the controller of your personal data. Contact us at sales@erohe-lab.com.
What we collect and why
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| Orders, delivery and invoices | Name, company, company ID, VAT number, billing and delivery address, email, phone, order details | Contract (GDPR Art. 6(1)(b)); legal obligation for invoices (Art. 6(1)(c)) | Invoices and accounting records 10 years; other order data 4 years after delivery |
| VAT number check | VAT number and the result from the EU VIES register | Legal obligation (Art. 6(1)(c)) | With the invoice, 10 years |
| Your account | Name, company, email, country, password (stored as a one-way hash that we cannot read), order history | Contract (Art. 6(1)(b)) | Until you close the account, or 12 months after its last use |
| Quote requests and messages | Name, company, email, country, your message | Steps before a contract (Art. 6(1)(b)) | 1 year if no order follows |
| Free samples | Name, company, email, delivery address, the samples sent | Legitimate interest in sending samples to labs and preventing abuse (Art. 6(1)(f)) | 2 years |
| Follow-up after a sample | Your consent, if you tick the box (Art. 6(1)(a)) | Until you withdraw consent | |
| Product news to customers | Legitimate interest, only about products similar to those you bought, with an opt-out in every email | Until you opt out | |
| Protecting forms from spam | A scrambled (hashed) IP address | Legitimate interest in security (Art. 6(1)(f)) | 1 hour |
We need your name, address and email to accept and deliver an order. Without them we cannot sell to you. All other data is optional.
Card payments
Card payments are processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, as an independent controller. We never see or store your card number. See PayPal’s privacy statement.
Who receives your data
- Our web host, SiteGround, which stores the shop and its database.
- Cloudflare, Inc., which delivers the website and protects it from attacks.
- PayPal, for card payments.
- CookieYes Limited, which records your cookie choices.
- The carrier that delivers your order.
- Our accountant, and tax authorities where the law requires it.
We do not sell personal data, and we do not use it for advertising profiles.
Transfers outside the EU
Cloudflare is based in the United States and CookieYes in the United Kingdom. Transfers to Cloudflare are covered by the EU-US Data Privacy Framework and, as a fallback, the European Commission’s standard contractual clauses. Transfers to CookieYes are covered by the Commission’s adequacy decision for the United Kingdom. You can ask us for a copy of the clauses.
Your rights
You can ask us for a copy of your data, and to correct, delete or restrict it. You can object to processing based on legitimate interest, ask for your data in a portable format, and withdraw consent at any time. You can object at any time to product news; use the unsubscribe link in any email or write to us, and we stop at once. Email us from the address you used with us; we reply within one month.
You can also complain to the data protection authority in the EU country where you live or work, or to the Czech authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 727/27, 170 00 Praha 7, [email protected], uoou.gov.cz.
Cookies
We use only the cookies the shop needs. Our cookie policy lists them.
Last updated 3 October 2026