Privacy policy

ELYXEER Online Store

Effective Date: August 1, 2026

1. Data Controller

AMPM Labs s.r.o.
Company Registration No. (IČO): 23552751
VAT No. (DIČ): CZ23552751
Registered Office: Dlouhá 730/35, Staré Město, 110 00 Prague 1, Czech Republic
E-mail: info@elyxeer.com
Website: www.elyxeer.com

The Company has not appointed a Data Protection Officer. For any questions regarding personal data protection, please contact us at info@elyxeer.com.

2. Personal Data We Process

Depending on how you use ELYXEER services, we may process the following categories of personal data:

• identification and contact details, including your name, surname, e-mail address, telephone number, billing address, and delivery address;

• order, subscription, payment, shipping, return, and complaint-related information;

• customer account and subscription settings;

• communications with customer support;

• technical information regarding the use of the website, including IP address, device information, browser information, and cookies;

• records of consents, withdrawals of consent, and objections to direct marketing.

As a rule, we do not process complete payment card details. Such information is processed by the relevant payment service provider. We receive only the information necessary to confirm and manage payments, such as transaction status or payment method identifiers.

We do not request information concerning customers’ health. If a customer voluntarily provides such information in connection with an inquiry or complaint, we will process it only to the extent necessary for handling the relevant matter and will not use it for marketing purposes.

3. Purposes, Legal Bases and Retention Periods

Purpose	Legal Basis	Categories of Data	Retention Period
Order processing, delivery, payment and customer communication	Performance of a contract	Identification, contact, order, payment and delivery data	For the duration of the contractual relationship and generally for 3 years thereafter; longer in the event of a dispute
Management of subscriptions and customer accounts	Performance of a contract	Account, subscription, delivery and payment identifier data	For the duration of the account or subscription and generally for 3 years thereafter
Accounting, tax compliance and other legal obligations	Legal obligation	Orders, invoicing and payment data	For the period required by applicable law, generally up to 10 years
Complaints, withdrawals, returns and protection of legal claims	Performance of a contract, legal obligation and legitimate interest	Order records, communications and complaint-related information	For the duration of the matter and generally for 3 years thereafter; longer in the event of a dispute
Customer support and inquiries	Performance of a contract or legitimate interest	Contact details and communications	For the duration of the matter and generally for 3 years thereafter
Marketing of similar products to existing customers	Legitimate interest and applicable electronic communications laws	E-mail address, purchase history and preferences	Until objection or unsubscribe request; no longer than reasonably necessary following the last purchase
Newsletter communications to non-customers	Consent	E-mail address and consent records	Until consent is withdrawn; consent records may be retained for evidentiary purposes
Website operation, security and fraud prevention	Legitimate interest	IP address, technical and security logs	Generally no longer than 12 months unless longer retention is necessary due to a security incident
Analytics and marketing cookies	Consent	Online identifiers and website usage data	According to the relevant cookie settings and until consent is withdrawn

4. Orders and Subscriptions

We use the information provided in your order to conclude and perform the purchase contract, process payments, issue invoices, dispatch products, and handle related communications.

For recurring subscriptions, we process data necessary to administer recurring payments and regular deliveries. Complete payment card details remain with the payment service provider. Where a subscription is modified, paused, or cancelled, we retain the records necessary to comply with legal obligations and protect legal claims.

5. Recipients of Personal Data

We disclose personal data only to the extent necessary. Recipients and processors may include:

• Mailstep and other warehousing, fulfilment and logistics providers;

• carriers and parcel collection point operators, such as PPL, DHL, Zásilkovna, or another carrier selected during checkout;

• payment gateway providers, banks and recurring payment providers;

• providers of e-commerce platforms, hosting, cloud, IT, security and customer support services;

• providers of e-mail marketing, analytics and online advertising services, to the extent permitted by your consent settings;

• accountants, tax advisors, legal advisors, auditors and insurers;

• public authorities where disclosure is required by law.

Orders placed through Pilulka.cz are processed by the operator of that platform in accordance with its own privacy policy. This Privacy Policy applies to personal data processed by AMPM Labs s.r.o., particularly in connection with the website www.elyxeer.com.

6. Transfers Outside the European Economic Area

Certain providers of technical, cloud, analytics or marketing services may process personal data outside the European Economic Area (EEA). Where such transfers occur, we ensure an adequate level of protection through appropriate safeguards, including adequacy decisions adopted by the European Commission, Standard Contractual Clauses, or other lawful transfer mechanisms. Further information is available upon request.

7. Marketing Communications

We may send existing customers information about our own similar products and services. You may object to such communications at any time free of charge or unsubscribe using the link included in each marketing communication.

We send newsletters to non-customers only on the basis of consent. Consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal, nor does it affect the performance of orders or subscriptions.

8. Cookies and Similar Technologies

The Website uses strictly necessary cookies required for operation, security, shopping cart functionality, user authentication and order management. These cookies may be used without consent where permitted by applicable law.

Analytics, personalization and marketing cookies are used only in accordance with the visitor’s choices in the cookie banner. Consent must be capable of being refused and later modified or withdrawn as easily as it was granted through the cookie settings available on the Website.

A detailed list of cookies, including providers, purposes and retention periods, is available in the cookie settings interface or a separate cookie notice and must reflect the actual technical configuration of the Website.

9. Automated Decision-Making

We do not engage in automated individual decision-making that produces legal effects concerning you or similarly significantly affects you.

Subject to consent where required, marketing tools may create basic audience segments to enable the delivery of more relevant content and advertising.

10. Your Rights

Subject to applicable legal requirements, you have the right to:

• obtain confirmation as to whether we process your personal data and request access to such data;

• request correction of inaccurate personal data or completion of incomplete personal data;

• request erasure of personal data where it is no longer necessary or where processing is unlawful;

• request restriction of processing;

• receive personal data you have provided to us in a structured, commonly used and machine-readable format and, where applicable, transmit it to another controller;

• object to processing based on legitimate interests; you may object to direct marketing at any time;

• withdraw consent at any time where processing is based on consent;

• lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů).

For information regarding the Authority, please visit:

Office for Personal Data Protection (ÚOOÚ)

Requests may be submitted to info@elyxeer.com. Before responding, we may take reasonable steps to verify your identity. We will respond without undue delay and, in most cases, within one month.

11. Security of Personal Data

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, loss, disclosure or misuse. Access to personal data is limited to individuals who require such access for the performance of their duties, and our service providers are contractually required to maintain appropriate safeguards.

12. Obligation to Provide Data

Providing the information designated as mandatory during checkout is necessary for entering into and performing the contract. Without such information, we cannot properly process orders, payments, deliveries or subscriptions.

Providing information for newsletters, analytics or marketing purposes is voluntary and refusal will not affect your ability to purchase products.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, particularly where our services, service providers, or legal obligations change.

The current version will always be available on www.elyxeer.com. Where a change materially affects how personal data is processed, we will provide appropriate notice.