Privacy Policy
The protection of personal data is of paramount importance to us. For this reason, we continuously review and analyse all personal data processing activities and ensure their compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter referred to as the “GDPR”), as well as with applicable national legal regulations in the field of personal data protection.
Your personal data is processed by the controller:
AVE SALUS s. r. o.
Registered office: Na Štyridsiatku 7731/4, 811 06 Bratislava – Staré Mesto
Company ID: 57 477 167
Registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, File No.: 196705/B
Contact email: ave@avesalus.com
(hereinafter referred to as the “Controller”)
This Privacy Policy informs you about how and why your personal data is processed, as well as about your rights. Where retention periods are expressed in years, such period shall expire on the last day of the relevant calendar year.
1. Purpose, Legal Basis and Retention Period
Ordering and purchase of goods via the e-shop
Purpose
To process your order, deliver goods, handle complaints and perform related contractual obligations.
Legal basis
Performance of a contract (Article 6(1)(b) GDPR).
Retention period
Duration of the contract and 4 years thereafter.
Customer account
Purpose
To enable account-based ordering and store order history.
Legal basis
Performance of a contract and pre-contractual relations (Article 6(1)(b) GDPR).
Retention period
For the duration of the account.
Direct marketing
Purpose
To offer similar products to existing customers.
Legal basis
Legitimate interest (Article 6(1)(f) GDPR).
You have the right to object at any time to such processing.
Retention period
Duration of contractual relationship and 2 years thereafter.
Advertising and newsletter
Purpose
To send marketing communications where direct marketing does not apply.
Legal basis
Consent (Article 6(1)(a) GDPR).
Retention period
Until withdrawal of consent, max. 2 years.
Suppliers and contractual partners
Purpose
Contract performance and communication.
Legal basis
Performance of a contract (Article 6(1)(b) GDPR).
Retention period
Duration of contract and 4 years thereafter.
Contact persons
Purpose
To ensure proper performance of contracts with business partners.
Legal basis
Legitimate interest (Article 6(1)(f) GDPR).
Retention period
Duration of contract and 4 years thereafter.
Accounting
Purpose
Compliance with accounting obligations.
Legal basis
Legal obligation (Article 6(1)(c) GDPR).
Retention period
10 years.
Taxation
Purpose
Compliance with tax obligations.
Legal basis
Legal obligation (Article 6(1)(c) GDPR).
Retention period
Typically 10 years.
Legal claims
Purpose
Enforcement or defence of legal claims.
Legal basis
Legitimate interest (Article 6(1)(f) GDPR).
Retention period
Until expiry of limitation periods.
Records management
Purpose
Management of correspondence and documentation.
Legal basis
Legal obligation (Article 6(1)(c) GDPR).
Retention period
Typically 3 years.
Essential cookies
Purpose
Ensure functionality and security of the website.
Legal basis
Legitimate interest (Article 6(1)(f) GDPR).
Retention period
Up to 7 days.
Non-essential cookies
Purpose
Analytics, marketing and personalisation (e.g. Google Analytics).
Legal basis
Consent (Article 6(1)(a) GDPR).
Retention period
Until withdrawal of consent, max. 1 year.
Social media
Purpose
Operation and administration of social media pages and analytics.
Legal basis
Legitimate interest (Article 6(1)(f) GDPR).
Retention period
Duration of page existence, max. 5 years.
IT security
Purpose
Protection of systems and data (e.g. IP address processing).
Legal basis
Legitimate interest (Article 6(1)(f) GDPR).
Retention period
Up to 6 months.
GDPR compliance
Purpose
Handling requests, incidents and compliance obligations.
Legal basis
Legal obligation (Article 6(1)(c) GDPR).
Retention period
5 years.
2. Recipients of Personal Data
We do not disclose your personal data to third parties except where necessary. Data may be processed by:
- IT and hosting providers
- accounting and marketing service providers
Such entities act as processors and are bound by contractual obligations.
Legal professionals (lawyers, auditors) act as independent controllers.
Personal data may also be disclosed to public authorities where required by law.
Where data is transferred outside the European Economic Area, appropriate safeguards in accordance with GDPR are ensured.
3. Your Rights
You have the following rights:
- Right of access – obtain confirmation and access to your data
- Right to rectification – correct inaccurate data
- Right to erasure – request deletion where applicable
- Right to restriction – limit processing
- Right to object – object to legitimate interest processing
- Right to data portability – receive data in structured format
- Right to withdraw consent – at any time
- Right to lodge a complaint with a supervisory authority
Supervisory authority contacts:
https://www.edpb.europa.eu/about-edpb/about-edpb/members_en
4. Requirement to Provide Data
Providing personal data based on consent is voluntary.
Where processing is required for contract or legal obligations, failure to provide data may result in inability to perform the contract or comply with legal obligations.
Failure to accept essential cookies may affect website functionality.
The Controller reserves the right to amend this Privacy Policy. The updated version will be published on the website and, where applicable, communicated via email.
This Privacy Policy becomes effective on 19 March 2026.