Privacy / Personal data protection
1. Data Controller
The controller of your personal data is:
· Business name: Anderson Lab s.r.o.
· Company ID (IČO): 23263253
· Registered office: Uralská 689/7, 160 00 Prague
· Email: pece@until.cz
(hereinafter referred to as the "controller" or "we")
2. What Personal Data We Process
As part of operating our e-shop and selling candles, diffusers, and related goods, we process the following personal data:
a) Identification and contact details
· First and last name
· Delivery and billing address
· Email address
· Phone number
· Company ID / VAT ID (in the case of business customers)
b) Order data
· Information about purchased products (candles, diffusers, refills, etc.)
· Order history, purchase value
· Payment and delivery method
c) Technical and operational data
· IP address and browser type
· Cookies and website traffic data
· Date and time of access to the website
3. Purposes and Legal Bases for Processing
We process your personal data on the basis of the following legal grounds under the GDPR (EU Regulation 2016/679):
a) Performance of a contract (Art. 6(1)(b) GDPR)
Processing is necessary for concluding and performing the purchase contract – i.e. accepting the order, processing payment, delivering the goods (candles, diffusers), and handling any complaints and returns.
b) Compliance with a legal obligation (Art. 6(1)(c) GDPR)
We are obliged to retain tax documents (invoices) and accounting records for the period set by law (generally 10 years) under Act No. 563/1991 Coll. on Accounting and Act No. 235/2004 Coll. on VAT.
c) Legitimate interest (Art. 6(1)(f) GDPR)
On the basis of legitimate interest, we process your data for the purpose of fraud prevention, improving our product offering, and personalizing website content.
d) Consent (Art. 6(1)(a) GDPR)
If you have given us your consent, we send you news, promotions, and inspiration in the area of candles and aromatherapy by email (newsletter). You may withdraw your consent at any time by clicking the link in the email or via the contact details below.
4. Recipients of Personal Data
We share your personal data only to the extent necessary with the following categories of recipients:
· Carriers and courier services (PPL, Zásilkovna, etc.) – for the purpose of delivering ordered goods
· Payment gateways and banks – for processing payments
· Accounting and tax advisors – for meeting accounting and tax obligations
· IT service and hosting providers – for operating the e-shop and providing technical support
· Marketing tools (e.g. Mailchimp, Klaviyo) – only when sending the newsletter with your consent
We do not transfer your data to third countries outside the EU/EEA without your knowledge or without appropriate safeguards.
5. Retention Period of Personal Data
· Data related to an order: for the duration of the contractual relationship and a further 3 years for any complaints
· Tax documents and accounting records: 10 years as required by law
· Customer account: for the duration of its activity, and 1 year after the account is cancelled
· Newsletter (consent): until consent is withdrawn
· Cookies: according to browser settings and consent, generally 1–2 years at most
6. Your Data Protection Rights
As a data subject, you have the following rights under the GDPR:
· Right of access – you have the right to know what personal data we process about you
· Right to rectification – you have the right to request the correction of inaccurate or incomplete data
· Right to erasure ("right to be forgotten") – under the conditions set out in the GDPR
· Right to restriction of processing – in cases stipulated by law
· Right to data portability – to receive a copy of your data in a machine-readable format
· Right to object – in particular to processing for marketing purposes
· Right to withdraw consent – at any time, without affecting prior processing
You can exercise your rights in writing by email at pece@until.cz. We will respond to your request without undue delay, no later than within 30 days.
You also have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (ÚOOÚ), with its registered office at Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
7. Cookies
Our website uses cookies to ensure proper functionality, analyse traffic, and display relevant content. On your first visit to the website, we inform you about the use of cookies and ask for your consent to the use of optional cookies.
· Essential cookies: ensure the basic functions of the website (cart, login) – do not require consent
· Analytical cookies (e.g. Google Analytics): traffic tracking – require consent
· Marketing cookies: targeted advertising – require consent
You can change or withdraw your cookie consent at any time in the cookie settings on our website.
8. Security of Personal Data
We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. The website is protected by SSL/TLS encryption, access to data is limited to authorised persons, and our staff are bound by confidentiality.
9. Changes to These Terms
We may update these privacy terms from time to time. We will inform you of any material changes by email or by a notice on the website. We recommend that you review these terms regularly.
10. Effectiveness
These privacy terms are effective from 1 March 2026.
Thank you for your trust, and we wish you a pleasant shopping experience at until.