Privacy policy
Privacy policy
1. Who processes your data and how to contact us
The controller is PANAKEIA SK s. r. o., Žabinská 2081/2, 911 05 Trenčín, Slovak Republic, company registration number 52576418. You can send questions and requests concerning personal data to panakeia@panakeia.sk or our postal address; our telephone contact is +421 948 735 144.
This policy explains processing when you visit https://www.panakeia-shop.com, shop, communicate with us, and in marketing and related administration. The rules are governed in particular by the General Data Protection Regulation (GDPR).
2. What data we use and for what purposes
| Purpose | Data | Legal basis |
|---|---|---|
| Ordering, payment and delivery | Name, contact details, billing and delivery addresses, order contents, payment and delivery information. | Performance of a contract or steps taken at your request before entering into a contract, Article 6(1)(b) GDPR. |
| Customer account | Account data, login and contact details, orders and settings. | Providing the account under the agreed terms, Article 6(1)(b) GDPR; protecting the account and system on the basis of legitimate interests, Article 6(1)(f). |
| Enquiries, support, returns and complaints | Contact details, communication content and supporting information necessary to handle the particular request. | Performance of a contract or pre-contractual steps, legal obligations and, depending on the request, legitimate interests in communication and protecting claims, Article 6(1)(b), (c) or (f). |
| Accounting, tax and statutory records | Orders, invoices, payments and data necessary to fulfil a legal obligation. | Legal obligation, Article 6(1)(c) GDPR. |
| Newsletter and offers | Email address, subscription settings and information on responses to communications within the scope of the applicable legal basis. | Consent, Article 6(1)(a) GDPR. We use the exception for offers of our own similar goods to existing customers only when the applicable national conditions are met and opting out is free of charge. |
| Analytics and personalisation | Technical data, identifiers, visits, interactions and purchase history to the extent permitted by consent settings and the applicable legal basis. | Your consent for optional tracking and cookies; for internal work with business data, the applicable legal basis stated for that purpose. |
| Security, prevention of misuse and protection of legal claims | Technical logs, transaction information and supporting information relating to an incident or claim. | Legitimate interests in secure operation and protecting claims, Article 6(1)(f), or a legal obligation where applicable. |
Data necessary for a purchase is required to enter into and perform the contract. Without it, we may be unable to process your order. Consent to optional marketing and tracking is voluntary; you may refuse or withdraw it.
3. Suppliers and recipients
To operate the shop, we use suppliers of the ecommerce platform and its content, hosting, communication and marketing, payment and delivery services, sales records, search, analytics and internal administration. Public authorities or professional advisers may also receive data when required by law or to protect legal claims. The specific services used, their purposes and relevant information are listed in the following overview.
| Recipient / service | Purpose | Categories of data | Role | Seat / transfer |
|---|---|---|---|---|
| Shoptet a.s. (e-shop platform) | Operation of the e-shop, hosting, processing of orders and customer accounts | Identification and contact data (name, address, e-mail, telephone), order data, technical data about the visitor | Processor | Prague, Czech Republic (EU) |
| Payment provider: Shoptet Pay; Global Payments s.r.o. | Processing of online payments (card payment, Apple Pay, Google Pay, instant bank payment) | Identification data, e-mail, order and payment data (amount, transaction identifier) | Independent controller | Prague, Czech Republic (EU) |
| GLS General Logistics Systems Slovakia s.r.o. | Delivery of ordered goods (courier to an address, GLS pick-up points and boxes) | Name, delivery address, telephone, e-mail, shipment data (including the amount for cash on delivery) | Independent controller | Budča, Slovak Republic (EU) |
| Packeta Slovakia s. r. o. (Zásielkovňa) | Delivery of ordered goods to Packeta pick-up points and boxes | Name, address of the pick-up point, telephone, e-mail, shipment data (including the amount for cash on delivery) | Independent controller | Bratislava, Slovak Republic (EU) |
| Slovenská pošta, a.s. | Delivery of shipments | Name, delivery address, telephone, e-mail, shipment data | Independent controller | Banská Bystrica, Slovak Republic (EU) |
| Mailchimp (The Rocket Science Group LLC) | E-mail communication and newsletter | E-mail address, name, data on e-mail delivery and interaction with e-mails | Processor | USA; transfer to a third country is possible; see provider's information. |
| Ecomail (Ecomail.cz, s.r.o.) | E-mail communication: newsletter, automated e-mails (e.g. regarding an order or an abandoned cart), segmentation | E-mail address, name, order history, data on viewed pages and the cart, data on interaction with e-mails | Processor | Prague, Czech Republic (EU) |
| Leadhub | Analysis of behaviour on the website and of purchases, segmentation, product recommendations, pop-up windows, marketing automation | Online identifiers (cookies), pages viewed and events on the website, order and product data, e-mail address (if known) | Processor | Seat and possible transfer to a third country: see provider's information. |
| daren & curtis, s.r.o. | Marketing and advertising services | Data necessary for the provision of marketing services (scope according to the contract) | Processor | Bratislava, Slovak Republic (EU) |
| TOSTAD s. r. o. | Marketing and advertising services | Data necessary for the provision of marketing services (scope according to the contract) | Processor | Prešov, Slovak Republic (EU) |
| Google: Analytics 4 and Tag Manager (Google Ireland Limited) | Measurement of traffic and behaviour on the website, tag management | Online identifiers (cookies), IP address, device and browser data, pages viewed and events (including purchase) | Processor | Ireland (EU); transfer to a third country is possible; see provider's information. |
| Google: Ads, Floodlight (Campaign Manager 360) and advertising network | Conversion measurement, remarketing and ad serving | Online identifiers (e.g. _gcl_au, IDE), IP address, device data, pages viewed, events (e.g. add to cart, purchase and its value) | Independent controller | Ireland (EU); transfer to a third country is possible; see provider's information. |
| Google: Maps and YouTube (embedded content) | Display of an embedded map (e.g. on the contact page) and of videos | IP address, device and browser data, online identifiers | Independent controller | Ireland (EU); transfer to a third country is possible; see provider's information. |
| Meta Platforms Ireland Limited (Meta Pixel, Facebook SDK) | Conversion measurement, remarketing and targeted advertising on Facebook and Instagram | Online identifiers (e.g. _fbp), IP address, device data, pages viewed, events (cart, purchase and its value); with server-side transmission of events, contact data (e.g. e-mail, telephone) in hashed form may also be transmitted | Independent or joint controller (depending on the provider's terms) | Ireland (EU); transfer to a third country is possible; see provider's information. |
| TikTok Technology Limited (TikTok Pixel) | Conversion measurement, remarketing and targeted advertising on TikTok | Online identifiers (e.g. _ttp), IP address, device data, pages viewed, events (cart, purchase and its value) | Independent or joint controller (depending on the provider's terms) | Ireland (EU); transfer to a third country is possible; see provider's information. |
| Pinterest Europe Ltd. (Pinterest Tag) | Conversion measurement, remarketing and targeted advertising on Pinterest | Online identifiers (e.g. _pin_unauth), IP address, device data, pages viewed, events (cart, purchase and its value) | Independent or joint controller (depending on the provider's terms) | Ireland (EU); transfer to a third country is possible; see provider's information. |
| Microsoft Ireland Operations Limited (Microsoft Clarity) | Analysis of visitor behaviour (session recordings, heatmaps, clicks and scrolling) | Online identifiers, IP address, device and browser data, interactions with the page (clicks, mouse movement, scrolling), pages viewed | Processor; within the scope of Microsoft's advertising functions, independent controller (see the provider's terms) | Ireland (EU); transfer to a third country is possible; see provider's information. |
| Hotjar Ltd. | Analysis of visitor behaviour (session recordings, heatmaps) | Online identifiers, IP address, device and browser data, interactions with the page, pages viewed | Processor | Malta (EU); possible transfer to a third country: see provider's information. |
| Glami (Glami pixel) | Conversion measurement and advertising on the Glami comparison platform | Online identifiers, products and pages viewed, order data (e.g. value and products) | Independent controller | Seat and possible transfer to a third country: see provider's information. |
| Dognet | Tracking of referrals and calculation of commissions in the affiliate programme | Online identifier of the visitor (PAPVisitorId), order data (identifier, value) | Processor | Seat and possible transfer to a third country: see provider's information. |
| Heureka Group a.s. (Heureka, Verified by Customers) | Verified by Customers (Overené zákazníkmi) programme and shop reviews, display of the Heureka badge | Buyer's e-mail address and order data (for sending a satisfaction questionnaire), technical data when the badge is displayed | Independent controller | Prague, Czech Republic (EU) |
| Smartsupp (Smartsupp.com, s.r.o.) | Live chat with customer support | Content of the communication, name and e-mail (if provided), online identifier, IP address, pages visited | Processor | Brno, Czech Republic (EU) |
| Luigi's Box | Search and recommendations on the website, search analytics | Search queries, online identifier, views and clicks in the product list | Processor | Seat and possible transfer to a third country: see provider's information. |
| Wisepops | Pop-up windows (e-mail collection, notifications) | Online identifiers, visit data, e-mail address (if entered in the form) | Processor | France (EU); possible transfer to a third country: see provider's information. |
| Pobo (Pobo Page Builder) | Display of page content created in Pobo Page Builder and measurement of its use | Technical device data, session identifier, interactions with the content | Processor | Seat and possible transfer to a third country: see provider's information. |
| Ellity (mehub), bonus programme | Bonus programme (recording and redemption of bonuses) | Customer identifier, data on orders and bonuses earned, technical data | Processor | Seat and possible transfer to a third country: see provider's information. |
| Metricool | Measurement of website traffic and of the performance of marketing campaigns | Online identifiers, IP address, pages viewed | Processor | Seat and possible transfer to a third country: see provider's information. |
| Smartform (address autocomplete) | Address autocomplete when filling in the order | The address you enter, technical data | Processor | Seat and possible transfer to a third country: see provider's information. |
4. Artificial intelligence tools
We process all our customer data using artificial intelligence tools. We use OpenAI (ChatGPT and Codex) and Anthropic (Claude), through both business and personal accounts.
Processing by these providers also depends on the service used, contractual terms and settings. Provider information is available in OpenAI's privacy policy and Anthropic's privacy policy. Information on specific recipients and transfers is provided in the overview above and the next section.
5. Transfers outside the European Economic Area
Some services used involve processing outside the EEA, including in the USA. For each relevant service, the recipient overview states the applicable transfer mechanism and how to obtain information about safeguards. The GDPR permits, in particular, transfers based on an adequacy decision or appropriate safeguards, such as standard contractual clauses. You may request information on the relevant safeguards and a copy of them using our contact details.
6. How long we retain data
We determine retention periods according to the purpose, legal obligations and periods for exercising and protecting claims. We process data necessary for an order while handling it and subsequently to the extent needed for complaints, statutory records or legal claims. We retain accounting records for the applicable statutory periods. We do not automatically retain an ordinary enquiry without a purchase for ten years merely because you contacted us.
| Purpose / category of data | Retention period | Reason |
|---|---|---|
| Communication via the contact form (name, e-mail, telephone) | For a maximum of 10 years from the last communication, unless further cooperation is established | Pre-contractual communication at your request (Art. 6(1)(b) GDPR); the period is set out in the privacy policy |
| Order and performance of the contract (billing and contact data, order data) | During the delivery of the goods or service and then for 10 years from the last delivery of goods or provision of service | Performance of the contract and compliance with legal obligations, in particular accounting and tax obligations, and handling of complaints (Art. 6(1)(b) and (c) GDPR) |
| Newsletter to customers (e-mail address) | 10 years from the last purchase or until unsubscription | Legitimate interest in marketing communication to customers (Art. 6(1)(f) GDPR); you can unsubscribe at any time |
| Record of your cookie choice | 6 months (CookiesConsent cookie) | Remembering and demonstrating your choice; necessary for the functioning of the cookie banner |
| Analytics tools (traffic statistics, session recordings, search analytics) | According to the cookie period in the cookie table; data at the provider for the duration of the purpose, at most according to statutory time limits | We run analytics cookies only with your consent; the period is based on the tool's settings |
| Marketing and advertising tools (remarketing, conversion measurement, affiliate programme) | According to the cookie period in the cookie table; data at the provider for the duration of the purpose, at most according to statutory time limits | We run advertising cookies only with your consent; the period is based on the tool's settings |
| Customer support (e-mail, telephone, chat) | For the duration of the purpose, at most according to statutory time limits | Communication about the order status, complaints or your questions |
| Bonus programme | For the duration of participation in the programme, at most according to statutory time limits | Keeping records of bonuses and their redemption |
| Customer reviews and the Verified by Customers programme | For the duration of the purpose, at most according to statutory time limits | Collection and publication of customer reviews |
For marketing consent, the duration of the consent and purpose applies; we stop marketing following withdrawal or objection. We may retain the minimum necessary record of an opt-out to respect it. The lifespan of cookies and similar identifiers is stated for the relevant category or service.
7. Personalisation and profiling
When personalising offers and marketing communications, we may group customers according to purchases and interactions, for example purchase frequency or product interests. This is profiling for the stated marketing purpose. You may object at any time, free of charge, to direct marketing, including related profiling; we must then stop using the data for that purpose.
A person makes decisions on order refusal, complaint handling and refunds.
8. Cookies and similar technologies
Details are available on the Cookies page and in the consent settings. Necessary technologies provide the shop functionality you request. We use optional analytics, advertising and personalised tracking according to your consent. You can change or withdraw consent through the cookie settings.
9. Your rights
Subject to the conditions of the GDPR, you have rights to information and access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests. You may withdraw consent at any time; withdrawal does not have retroactive effect. For a decision based solely on automated processing that has legal or similarly significant effects, you have rights under Article 22 GDPR, including the relevant safeguards.
Send your request to panakeia@panakeia.sk. We will generally inform you of its handling within one month. If a lawful extension is necessary, we will inform you of it and the reasons within that period.
You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic or the supervisory authority in the country of your habitual residence, workplace or the alleged infringement. Contact details are available in the official list of data protection authorities. Your right to bring proceedings before a court remains unaffected.
10. Effective date and changes
This policy takes effect on 25 October 2026. If the purpose or method of processing changes substantially, we will provide the relevant information before the new processing begins.