Privacy and cookies

PERSONAL DATA PROCESSING POLICY

and use of cookies in the Kolagin® e-shop

Controller: HELITECH s.r.o.

Website: www.kolagin.com

Contact: info@kolagin.com

Effective date: 2 September 2026

At a glance: We use data only to the extent necessary to operate the e-shop, process orders and communicate with you and, depending on your choices, to send news and measure or personalise the website. We do not activate optional cookies without prior consent.

Who controls your data

The personal data controller is HELITECH s.r.o., with its registered office at Kubatova 1240/6, 370 04 České Budějovice, company ID 28140621, VAT ID CZ28140621, registered in the Commercial Register maintained by the Regional Court in České Budějovice, Section C, File 19903 (referred to as “we” or the “controller”).

We operate the Kolagin® e-shop at www.kolagin.com. For personal data protection matters, you can contact us at info@kolagin.com or write to our registered office. We have not appointed a data protection officer.

What data we process and why

Orders, payments, delivery and complaints

We mainly process your first and last name, billing and delivery addresses, email, telephone number, order details, selected delivery and payment methods, complaint details and related correspondence. For business customers, we also process the business name, company ID and VAT ID. We do not normally obtain full payment card details; these are processed by the relevant payment service provider.

Purpose and legal basis: we need the data to enter into and perform the purchase contract and to handle orders, payments, delivery, withdrawal from the contract and complaints under Article 6(1)(b) GDPR. We retain data in accounting and tax documents to comply with legal obligations under Article 6(1)(c) GDPR. To the extent necessary, we may also retain data for the establishment, exercise or defence of legal claims on the basis of our legitimate interest under Article 6(1)(f) GDPR.

Retention period: we retain ordinary order data for the duration of contract performance and usually for 3 years afterwards. Data in accounting and tax documents is retained for the statutory period, usually 5 or 10 years depending on the type of document. If a complaint, dispute or inspection is ongoing, we may retain the relevant data until it has been finally concluded and the claims settled.

Customer account

If you create a customer account, we process login and contact details, order history and your saved settings to operate the account. The legal basis is performance of a contract under Article 6(1)(b) GDPR. We maintain the account until it is closed. Data that we must keep in connection with orders, legal obligations or the protection of legal claims is retained for the periods stated above even after the account is closed.

Contact form, email and telephone

When you contact us, we process the information you provide, typically your name, email, telephone number and message content. If the communication concerns an order or another contract, the legal basis is Article 6(1)(b) GDPR. For other enquiries, the basis is our legitimate interest in handling correspondence under Article 6(1)(f) GDPR. We usually delete correspondence that does not lead to a contract within 12 months of resolving the enquiry; we retain it longer only where necessary to protect legal claims.

Newsletter and commercial communications

If you subscribe to the newsletter outside a purchase, we process your email on the basis of consent under Article 6(1)(a) GDPR. You can withdraw consent at any time by using the unsubscribe link in any email or by writing to info@kolagin.com.

If you are our customer, we may send you offers for our own similar products and services under Section 7(3) of Act No. 480/2004 Coll., unless you opted out when we collected your email or afterwards. In this case, processing is based on our legitimate interest under Article 6(1)(f) GDPR. You can object at any time free of charge; we will then stop sending you commercial communications.

We retain newsletter contacts until consent is withdrawn, an objection is raised or you unsubscribe, but no longer than the mailing demonstrably serves its purpose. We then retain only the necessary unsubscribe record to ensure that we do not contact you again contrary to your choice.

Operation, security and protection of rights

To the extent necessary, we process technical logs and information about access, fraud, unpaid orders and security incidents. The purpose is to operate the e-shop securely, prevent misuse, recover debts and protect both our rights and yours. The legal basis is legitimate interest under Article 6(1)(f) GDPR. Records are retained only for a period proportionate to the purpose and risk, normally no more than 12 months, unless longer retention is necessary for a specific incident or claim.

DNA test orders

Important information about genetic data: When a DNA test is purchased through the e-shop, HELITECH s.r.o. processes only the ordinary data needed to fulfil the order. The biological sample and genetic data are processed by the relevant laboratory. The laboratory sends the test result directly to the customer; HELITECH s.r.o. does not receive, access or retain test results or genetic data. Before sample collection, the relevant laboratory provides the customer with details of how the biological sample and genetic data are processed, including information about the controller, purposes, legal bases under Articles 6 and 9 GDPR, recipients and retention periods. Genetic data and test results are not used for marketing or advertising profiling.

If the test is intended for a minor, the order and necessary consents are handled by their legal representative in accordance with the laboratory's terms and applicable law.

Who receives the data

We do not share personal data indiscriminately. To the extent necessary for the purpose concerned, recipients may include:

• Shoptet, a.s., company ID 28935675, as the provider of the e-commerce platform and related technical services;
• providers of hosting, IT support, security, backups and website administration;
• carriers, collection points and other parties responsible for delivery according to your chosen delivery method;
• payment service providers, banks and benefit programmes (such as Shoptet Pay or Pluxee), according to your chosen payment method;
• the provider of the email system and commercial email distribution;
• accounting, tax, legal and, where appropriate, debt collection advisers;
• analytics and advertising service providers, only if you have enabled the relevant cookies or another valid legal basis applies;
• public authorities where disclosure is required by law or necessary to protect legal claims.

We enter into appropriate personal data processing agreements with processors. Certain recipients, such as carriers, banks or payment service providers, may act as independent controllers to a certain extent and are also governed by their own privacy policies.

Transfers outside the European Economic Area

We prefer processing within the European Economic Area. However, some technical, analytics or advertising services may involve transfers to, or remote access from, countries outside the EEA. In such cases, we use lawful mechanisms under the GDPR, in particular European Commission adequacy decisions, the EU–US Data Privacy Framework for certified recipients or standard contractual clauses supplemented by additional safeguards where necessary.

Cookies and similar technologies

Cookies are small files stored on your device. They may enable basic e-shop functions, remember choices, measure traffic or assist with advertising. Pixels, local storage and other identifiers may perform similar functions.

Cookie categories

• Necessary cookies enable the shopping cart, checkout, security, login and storage of your choices. Consent is not required for these technologies where they are necessary for a service you have requested. They cannot be switched off using the cookie banner, but you can block them in your browser; the website may then not function correctly.
• Preference cookies remember choices beyond those necessary for basic operation. We use them only with your consent.
• Analytics cookies help us measure website traffic and usage, for example through Google Analytics. We use them only with your consent.
• Marketing cookies and pixels, such as Meta tools, are used to measure campaigns, limit repeated advertising and, where applicable, personalise advertising. We use them only with your consent.

Storing or reading optional cookies is based on your prior consent under Section 89(3) of Act No. 127/2005 Coll.; subsequent processing of personal data is based on consent under Article 6(1)(a) GDPR. Consent is not a condition of purchase.

How to manage cookies

On your first visit, the cookie banner lets you accept all optional cookies, reject them or choose individual categories. You can change your choice or withdraw consent at any time using the “Cookie settings” link on the website. Withdrawal does not affect the lawfulness of processing before consent was withdrawn.

The current list of specific cookies, their providers, purposes and lifetimes is available directly in the detailed cookie banner settings. This list reflects the technologies actually in use and may change with the e-shop's settings. You can also manage cookies in your browser; deleting them may mean the website no longer remembers your previous choice.

Automated decision-making

We do not carry out automated individual decision-making that produces legal effects concerning you or similarly significantly affects you. If we use advertising or analytics tools in accordance with your choices, marketing segments may be created; such profiling is not used as the basis for decisions with legal or similarly significant effects on you.

Your rights

Subject to the conditions laid down in the GDPR, you have in particular the right to:

• obtain confirmation of whether we process your data and request access to it;
• request correction of inaccurate data or completion of incomplete data;
• request erasure where the data is no longer needed or processing is unlawful;
• request restriction of processing;
• receive the data in a structured, commonly used and machine-readable format and, where applicable, have it transferred to another controller if the conditions for portability are met;
• withdraw consent at any time where processing is based on consent;
• object to processing based on legitimate interest; you may object to direct marketing at any time, after which we will stop that processing;
• lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz.

You can send a request to info@kolagin.com or our registered office. To protect your data, we may verify your identity in a proportionate manner. We will respond without undue delay, normally within one month; in complex cases, this period may be extended under the conditions of the GDPR.

Security and policy updates

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or misuse. Access is limited to people who need it to perform their duties.

We may reasonably update this policy, particularly when services, suppliers or legal requirements change. The current version is always published at www.kolagin.com. If a change substantially affects your rights, we will notify you in an appropriate way.

This policy is effective from 2 September 2026.