La Herba · Privacy

GDPR – how we protect your privacy

As we prioritise the protection of our customers' personal data, we approach its collection responsibly and in accordance with personal data protection regulations, particularly Regulation (EU) 2016/679 (GDPR) and relevant national data protection laws. Below, we describe what personal data is collected when you visit and use the services of laherba.eu, the purposes and legal basis for which we use this data, and the further conditions of its processing.

Data controller

Laherba, s.r.o.

Company ID (IČ)

11836172

Encryption

SSL

Contact

info@laherba.eu

Data controller

Who processes your data

The controller of the information systems in which your personal data is processed is:

Laherba, s.r.o.
Korunní 108, 101 00 Prague 10
Czech Republic
IČ: 11836172

Data security

How we keep it safe

Your personal data is securely transmitted using SSL (Secure Socket Layer) encryption. We protect our websites and systems with appropriate technical and organisational measures against loss, destruction, alteration and dissemination of data by unauthorised persons.

Web hosting services are provided by ROYAL MEDIA s.r.o.

Tracking, analytics and cookies

I. Traffic tracking, analysis and marketing

We use cookies – small text files stored on your device – in several places on our e-shop. Cookies cannot be assigned to a specific person and do not contain direct personal data. The cookies we use are divided into:

Always active

Strictly necessary (technical) cookies

They are essential for the basic functionality of the e-shop (e.g. shopping cart function, login).

Legal basis: our legitimate interest (Art. 6(1)(f) GDPR), as the purchase cannot be made without them. These files are activated automatically.

Only with your consent

Analytical, marketing and preference cookies

They serve for statistical evaluation, measuring advertising effectiveness and content personalisation. This includes services like Google Analytics, Google Ads (AdWords) and Facebook Pixel.

Legal basis: exclusively your explicit consent (Art. 6(1)(a) GDPR), which you provide via the cookie banner (opt-in).

II. Consent and withdrawal of consent

You decide what is switched on

Obtaining consent (opt-in): analytical, marketing and preference cookies are activated only after you grant your active consent in the cookie bar/banner. Refusing these cookies does not prevent you from using the basic functions of the e-shop or making a purchase.

Data collected: these tools and cookies collect pseudonymised data such as browser type and version, operating system, referrer URL, IP address (shortened), access time and clicks.

Third-party cookies: the laherba.eu pages also contain links and integrated content from other websites (e.g. YouTube, Facebook). If the page being viewed uses a third-party analysis tool, you may receive cookies from these services, over which Laherba, s.r.o. has no control.

Acquisition, processing and use of personal data

What we process and why

We collect only the data necessary for the provision of our services, based on clearly defined legal grounds:

Performance of the purchase contract

Order processing, communication

Data

Name and surname, e-mail, postal/invoicing address, telephone number.

Legal basis

Art. 6(1)(b) – performance of a contract

Retention

For the duration of the contractual relationship and subsequently for the period required to fulfil legal obligations (e.g. 10 years for VAT purposes).

Accounting and legal compliance

Data

Invoicing details, data from documents.

Legal basis

Art. 6(1)(c) – compliance with a legal obligation

Retention

For the period stipulated by relevant legal regulations (e.g. 10 years under the VAT Act).

Customer account registration

Account management

Data

Name and surname, e-mail, address, telephone number.

Legal basis

Art. 6(1)(b) – performance of a contract

Retention

For the duration of the registration/account, unless you request cancellation.

Log files and technical security

Security and functionality of the e-shop

Data

IP address, date/time of access, referrer URL.

Legal basis

Art. 6(1)(f) – legitimate interest

Retention

Only the time necessary to ensure system security.

Sending newsletters

Double opt-in

Data

E-mail address, IP address.

Legal basis

Art. 6(1)(a) – your consent

Retention

Until consent is withdrawn (unsubscribing).

Note: for sending newsletters, we use the double opt-in method, requiring you to click on an activation link in the e-mail.

Recipients and processors

Who may receive your data

Your personal data may only be provided to third parties if necessary for the performance of the purchase contract or our legal obligations. Categories of recipients and processors include:

Hosting

Web hosting & e-shop

ROYAL MEDIA s.r.o.

Delivery

Shipping companies

The postal service, Packeta (Zásielkovňa) and courier services – according to your choice.

Payments

Payment provider

Comgate (payment gateway) for processing cashless payments.

Analytics & marketing

Based on your consent

Google Ireland Ltd., Meta Platforms Ireland Ltd. (Facebook).

Professional services

Legal & accounting

Providers of legal and accounting services.

Data subject rights

Your rights

You have the right to withdraw your consent to data processing at any time (e.g. by unsubscribing from the newsletter or changing cookie settings). The withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Subject to the requirements set out in the GDPR, you have the right to:

Access

Access your personal data.

Rectification

Rectification of incorrect personal data.

Erasure

Erasure of personal data (“right to be forgotten”), especially if no longer necessary for the purposes for which it was collected.

Restriction

Restriction of processing (blocking).

Objection

Object to processing, especially for direct marketing purposes.

Portability

Data portability to another controller (if technically feasible).

Exercising rights and complaints

How to contact us

You can exercise your rights by e-mail at info@laherba.eu or by post to the company's registered address.

Identity verification

If you exercise any of your rights and we cannot verify your identity, we reserve the right to request additional information. It will be used exclusively for identity verification in the sense of Art. 12 GDPR and deleted immediately after verification.

Data Protection Officer

Given the nature of the processing, Laherba, s.r.o. is not obliged to appoint a DPO.

Complaint

You have the right to lodge a complaint with the Office for Personal Data Protection of the Czech Republic (uoou.cz) if you believe that we process your personal data in violation of the law.

18+ only

The services provided within laherba.eu, for which the consent of the person concerned is required according to these terms, are not intended directly for persons under the age of 18.