Legal information
Personal data protection
Effective from 1 August 2026
1. Data controller
The controller of your personal data is Cultus Lab s.r.o., registered at Říční 456/10, 110 00 Prague 1, Company ID 09577483, operator of the CULTUS garden online shop, e-mail cultuslab@gmail.com. Processing takes place in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll., on the Processing of Personal Data.
2. What data we process
- Identification and contact details — first and last name, delivery and billing address, e-mail, phone number.
- Order details — ordered goods, price, method of payment and delivery, purchase and complaint history.
- Specifications — IP address, browser and device type, cookie data.
3. Purposes of processing and legal basis
- Order processing and delivery of goods — performance of the contract under Art. 6(1)(b) GDPR. Without this data, the order cannot be processed.
- Bookkeeping and fulfilment of tax obligations — fulfilment of a legal obligation under Art. 6(1)(c) GDPR.
- Handling complaints and defending legal claims — legitimate interest under Article 6(1)(f) GDPR.
- Sending marketing communications — consent under Article 6(1)(a) GDPR; for existing customers, legitimate interest under Section 7(3) of Act No. 480/2004 Coll. You can unsubscribe with a single click in every e-mail.
- Analytics and marketing cookies — consent under Article 6(1)(a) GDPR.
4. Retention Period
We keep order data for the duration of the contract and subsequently for the duration of the applicable limitation periods, for a maximum of 4 years. Accounting records are kept for the period stipulated by the Accounting Act. Data processed on the basis of consent is kept until the consent is withdrawn, for a maximum of 3 years.
5. Who we share your data with
We share your data only to the extent necessary with the following categories of recipients: the DHL courier company for delivery purposes, our payment gateway provider, our hosting and e-shop platform provider, our accountancy firm and, where applicable, our legal representative. We have a data processing agreement in place with every processor in accordance with Article 28 GDPR.
We do not transfer personal data outside the European Union. Should this change in the future, we will add the relevant legal safeguard under Art. 46 GDPR here.
6. Your rights
In relation to your personal data, you have the right to access, rectify, erase and restrict the processing of it, as well as the right to data portability and the right to object to processing based on legitimate interest. Any consent you have given may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.
You can exercise your rights by emailing cultuslab@gmail.com. If you believe that the processing breaches applicable regulations, you have the right to lodge a complaint with The Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
7. Security
We have adopted technical and organisational measures to protect data, in particular encrypted data transmission, access control management and regular backups. We do not carry out any automated decision-making or profiling with legal effects.