Privacy Policy

1. Data Controller

The data controller for your personal data is:

2. Personal Data We Collect

We collect the following personal data when you use our website and place orders:

• Identifying data: name, surname, email address
• Shipping data: delivery address, phone number
• Payment data: processed directly by Stripe Inc. We do not store credit card data on our servers
• Browsing data: IP address, browser type, pages visited, visit duration (via cookies and analytics tools)
• Communication data: messages sent via contact forms or custom requests

3. Purpose of Processing

• Order fulfilment: managing purchases, shipping, and after-sales support
• Communications: order status updates, responding to support requests
• Service improvement: aggregated usage analytics to improve user experience
• Legal obligations: fiscal obligations as required by applicable laws
• Direct marketing: only with your explicit consent

4. Legal Basis for Processing

We process your personal data based on:

• Contract performance (Art. 6(1)(b) GDPR): necessary for order management and service delivery
• Consent (Art. 6(1)(a) GDPR): for promotional communications and non-essential cookies
• Legitimate interest (Art. 6(1)(f) GDPR): for fraud prevention and service improvement
• Legal obligation (Art. 6(1)(c) GDPR): for fiscal and regulatory compliance

5. Third-Party Sharing

Your personal data may be shared with the following data processors:

All data processors are bound by data protection agreements (DPAs) compliant with the GDPR. For transfers to the USA, standard contractual clauses (SCCs) approved by the European Commission are in place.

6. Retention Period

• Order data: 10 years (fiscal obligations)
• Account data: until the account is deleted by the user
• Browsing data: 26 months (Google Analytics)
• Marketing communications: until consent is withdrawn

7. Your Rights

Under the GDPR (Regulation EU 2016/679), you have the right to:

• Access: obtain confirmation of data processing and receive a copy
• Rectification: correct inaccurate data or complete incomplete data
• Erasure: have your personal data deleted (right to be forgotten)
• Restriction: restrict the processing of your data
• Portability: receive your data in a structured, machine-readable format
• Objection: object to the processing of your personal data
• Withdraw consent: withdraw consent at any time without affecting the lawfulness of prior processing

To exercise your rights, contact us at support@hephioslab.com. We will respond within 30 days of receiving your request.

You also have the right to lodge a complaint with your local Data Protection Authority.

8. Cookies

Our website uses essential technical cookies and third-party analytics cookies (Google Analytics). Technical cookies are always active; analytics cookies are only installed with your consent via the cookie banner on the site.

You can manage your cookie preferences at any time from your browser settings. For more information, see our Cookie Policy.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data from unauthorised access, loss, destruction, or alteration. These include: SSL/TLS encryption for all communications, need-to-know data access controls, regular backups, and system activity monitoring.

10. Changes to This Policy

We reserve the right to update this policy at any time. In the event of material changes, we will notify you via the website. The date of the last update is shown at the top of this page.

11. Contact

For any questions about this policy or the processing of your personal data, you can contact us at: