Valeacell’s Privacy Policy

This English translation is provided for your convenience. Only the German version of this text is legally binding.

Privacy Policy

Last updated: April 2026

1. Data controller

Reimund Volker Eckert
Šmeralova 212
74258 Příbor, Czech Republic
Email: info@valeacell.com
Tel: +49 (0)176 32202 133

→ [Legal notice]

2. Types of data processed

• Personal details (e.g. names, addresses)
• Contact details (e.g. email, telephone numbers)
• Content data (e.g. text entries, messages)
• Contract data (e.g. subject matter of the contract, term, customer category)
• Payment data (e.g. payment history, transaction data)
• Usage data (e.g. websites visited, interest in content, access times)
• Meta/communication data (e.g. device information, IP addresses)

3. Categories of data subjects

Visitors and users of the online service, as well as customers and prospective customers (hereinafter collectively referred to as ‘users’).

4. Purpose of processing

• To provide the online service, its functions and content
• Processing of orders and contracts
• Responding to enquiries and communicating with users
• Security measures
• Audience measurement and marketing
• Email marketing and automated communication
• Reviews and customer feedback

5. Applicable legal bases

In accordance with Article 13 of the GDPR, we provide information on the legal bases for our data processing:

• Consent (Article 6(1)(a), Article 7 of the GDPR)
• Performance of a contract (Article 6(1)(b) of the GDPR)
• Legal obligation (Article 6(1)(c) of the GDPR)
• Legitimate interests (Article 6(1)(f) of the GDPR)

6. Hosting – Hetzner Online GmbH

Our website is hosted on servers belonging to Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

Hetzner processes connection data (IP address, date and time of access, pages accessed) for the purpose of providing the infrastructure. This processing is carried out on the basis of our legitimate interests (Article 6(1)(f) of the GDPR). We have a data processing agreement with Hetzner in accordance with Article 28 of the GDPR.

7. Content delivery via Cloudflare

We use the Content Delivery Network (CDN) and security services provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Cloudflare processes connection data (in particular IP addresses) for the purposes of delivering the website, protecting it against attacks (DDoS, bots) and improving performance. Data is transferred to the USA on the basis of Standard Contractual Clauses (SCCs) in accordance with Article 46(2)(c) of the GDPR.

Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/

8. Order processing and payments – Mollie

Orders placed in our online shop are processed via PrestaShop. For payment processing, we use the services of Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands.

Mollie processes the data required for payment processing (name, address, payment details, order details) on the basis of Article 6(1)(b) of the GDPR for the performance of a contract. Mollie is PCI-DSS certified and does not process any card details on our systems.

Mollie’s Privacy Policy: https://www.mollie.com/de/privacy

9. Email marketing and marketing automation

We send emails (e.g. order confirmations, newsletters, reminders) via our own Mautic installation, which is hosted on our server in Germany. In doing so, we store your email address, name and interaction data (opens, clicks).

Processing takes place:

• upon newsletter subscription, on the basis of your consent (Article 6(1)(a) of the GDPR)
• for transactional emails (order confirmations, etc.) for the performance of a contract (Article 6(1)(b) of the GDPR)
• for customer communications, on the basis of legitimate interests (Article 6(1)(f) of the GDPR)

You can unsubscribe from the newsletter at any time via the unsubscribe link in every email.

10. Use of AI services (OpenAI API) and the chat assistant ‘Valeria’

An AI chat assistant (“Valeria”) is integrated into our website. When you use this, the messages you enter are transmitted to OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland, for processing.

Please do not enter any personal data (e.g. name, address, order numbers, payment details) into the chat.

Chat histories are stored in anonymised form for a maximum of 30 days and are then automatically deleted. IP addresses are stored exclusively as hashes and not in plain text.

We have entered into a data processing agreement (Data Processing Addendum) with OpenAI in accordance with Article 28 of the GDPR. OpenAI does not process data transmitted via the API for the purpose of training the models. Data transfers to the USA are carried out on the basis of Standard Contractual Clauses (SCCs) in accordance with Article 46(2)(c) of the GDPR.

Legal basis: Article 6(1)(f) of the GDPR (legitimate interests in providing user advice).

OpenAI Privacy Policy: https://openai.com/policies/privacy-policy/

Note: AI services from Chinese providers (e.g. DeepSeek) are not used on our website or in the customer chat, as no data processing agreement, standard contractual clauses or EU data centre are available for these services. Such services are assessed exclusively for internal, non-personal data processing.

10a. AI chatbot ‘Lea’ (Eckada Media)

Our website also features an AI-powered chatbot (“Lea”) provided by Eckada Media (Reimund Volker Eckert, Příbor, Czech Republic), which runs on servers operated by Hetzner Online GmbH in Germany.

When using the chatbot, conversation content and technical connection data (IP address, timestamps) are processed. Legal basis: legitimate interests pursuant to Article 6(1)(f) of the GDPR (provision of customer service). No data is disclosed to third parties outside the EU.

11. Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager itself does not process any personal data, but enables the integration and control of other tags (e.g. Google Analytics). Data processing by integrated tags is governed by the respective services.

Legal basis: legitimate interests (Article 6(1)(f) of the GDPR) or consent (Article 6(1)(a) of the GDPR) in the case of tracking services.

12. Google Analytics

We use Google Analytics, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse user behaviour on our website.

Google Analytics uses cookies and collects usage data (page views, time spent on site, origin, etc.). IP addresses are anonymised (IP anonymisation enabled). The data is transferred to Google servers, which may also be located in the USA; the transfer takes place on the basis of Standard Contractual Clauses (SCCs) in accordance with Article 46(2)(c) of the GDPR.

Google Analytics is used only with your consent (Article 6(1)(a) of the GDPR), which you can give or withdraw via our cookie banner.

You can object to data collection by Google Analytics at: https://tools.google.com/dlpage/gaoptout

Google Privacy Policy: https://policies.google.com/privacy

12a. Google Ads (conversion tracking and remarketing)

We use Google Ads, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This enables us to measure the success of our adverts (conversion tracking) and to display adverts for our products to you on third-party websites (remarketing).

In doing so, Google sets cookies (including _gcl_au) and processes usage data such as pages visited, orders placed and a pseudonymous identifier. We are unable to directly identify you personally through this process.

The recipient of the data is Google. The data may also be processed on servers in the USA; the transfer takes place on the basis of standard contractual clauses (Article 46(2)(c) of the GDPR) and the EU-US Data Privacy Framework.

The legal basis is exclusively your consent (Article 6(1)(a) of the GDPR, Section 25(1) of the TTDSG), which you provide via our cookie banner in the ‘Marketing’ category and which you may withdraw at any time with future effect. No Google Ads cookies are set without your consent.

Advertising settings on Google: https://adssettings.google.com
Google Privacy Policy: https://policies.google.com/privacy

12b. Payment processing via PayPal

If you select a PayPal payment method (PayPal, credit card via PayPal, Pay Later) during the ordering process, the data required for the payment will be transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg.

In particular, the following data is transmitted: name, address, email address, order and invoice amount, and order number. PayPal processes this data as an independent data controller, amongst other things for the purposes of fraud prevention and to fulfil legal obligations. PayPal embeds its own scripts on our website to display the payment buttons; cookies may be set in the process.

The legal basis is the performance of the contract or the implementation of pre-contractual measures (Article 6(1)(b) of the GDPR) as well as our legitimate interest in secure payment processing (Article 6(1)(f) of the GDPR).

Data may be transferred to third countries, based on standard contractual clauses (Article 46(2)(c) of the GDPR).

PayPal Privacy Policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

13. Signing in via Google (Google Login)

On our website, you have the option to log in using a Google account (“Sign in with Google”). The provider of this service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Data processed

When you log in via Google, the following data is transmitted to us by Google and stored in your customer account:

• First name and surname
• Email address
• Profile picture (if available)
• Google user ID (internal identifier)

We do not store passwords at any time. Authentication takes place exclusively via Google.

Purpose and legal basis

The processing serves to simplify the login and registration process in our online shop. The legal basis is your consent in accordance with Article 6(1)(a) of the GDPR, which you give by actively clicking on the ‘Sign in with Google’ button.

Data transfer

The data processed as part of the Google login is transferred to Google servers, which may also be located outside the EU/EEA. The transfer is carried out on the basis of Standard Contractual Clauses (SCCs) in accordance with Article 46(2)(c) of the GDPR.

Withdrawal

You may withdraw your consent at any time with future effect by removing the connection to Valeacell in your Google Account under Security → Third-party apps and services. Data already stored in your customer account can be deleted on request by emailing info@valeacell.com.

Google Privacy Policy: https://policies.google.com/privacy

14. Signing in via Facebook (Facebook Login)

Our website offers the option to log in using a Facebook account (“Log in with Facebook”). This service is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter “Meta”).

Data processed

When you log in via Facebook, the following data is transmitted to us by Meta and stored in your customer account:

• First name and surname
• Email address (if stored and shared in your Facebook account)
• Profile picture (if available)
• Facebook user ID (internal identifier)

We do not store passwords at any time. Authentication takes place exclusively via Meta. In addition, Meta receives the information that you have visited our website and used the Facebook login. This data processing by Meta is subject to Meta’s privacy policy and is beyond our control.

Purpose and legal basis

The processing serves to simplify the login and registration process in our online shop. The legal basis is your consent in accordance with Article 6(1)(a) of the GDPR, which you give by actively clicking on the ‘Log in with Facebook’ button.

Data transfer to third countries

Meta Platforms Ireland Limited is a subsidiary of Meta Platforms, Inc., which is based in the USA. Data transfers to the USA cannot be ruled out. These take place on the basis of Standard Contractual Clauses (SCCs) in accordance with Article 46(2)(c) of the GDPR and the EU-US Data Privacy Framework. Further information: https://www.facebook.com/legal/EU_data_transfer_addendum

Withdrawal

You may withdraw your consent at any time with future effect by removing the connection to Valeacell in your Facebook account under Settings → Security → Apps and Websites. Data already stored in your customer account can be deleted on request by emailing info@valeacell.com.

Meta/Facebook Privacy Policy: https://www.facebook.com/privacy/policy/

15. Collaboration with Trustpilot

As part of our collaboration with Trustpilot A/S, Pilestræde 58, 5, 1112 Copenhagen, Denmark, we may pass on your email address to Trustpilot following an order to invite you to leave a review.

This transfer is based on our legitimate interests (Article 6(1)(f) of the GDPR) in quality assurance and transparency. You may object to the use of your data for this purpose at any time.

Trustpilot Privacy Policy: https://legal.trustpilot.com/for-reviewers/end-user-privacy-terms

16. Cookies

We use cookies to ensure the functionality of our online shop (e.g. shopping basket, login status) and for analytics and marketing purposes.

Technically necessary cookies are set on the basis of Article 6(1)(b) and (f) of the GDPR. Analytics and marketing cookies are only set with your consent (Article 6(1)(a) of the GDPR), which you can give via our cookie banner or withdraw at any time.

A detailed overview of all cookies used can be found in our [Cookie Policy].

17. Transfers to third countries

Where data is transferred to countries outside the EU/EEA (e.g. the USA in the case of Google, Cloudflare and Meta), this is done on the basis of appropriate safeguards in accordance with Article 46 of the GDPR, in particular Standard Contractual Clauses (SCCs) pursuant to Article 46(2)(c) of the GDPR. References to the Privacy Shield are out of date and no longer applicable (ECJ, judgment of 16 July 2020, ‘Schrems II’).

18. Data processing on behalf of others

Where we engage third parties to process data, we enter into data processing agreements (DPAs) in accordance with Article 28 of the GDPR. This applies in particular to:

19. Deletion of data

Data is deleted as soon as it is no longer required for its intended purpose and there are no statutory retention obligations preventing its deletion (e.g. retention periods of 6–10 years under tax and commercial law for accounting records).

20. Rights of data subjects

You have the right to:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Lodging a complaint with a supervisory authority (Art. 77 GDPR)

For enquiries, please contact: info@valeacell.com

21. Competent supervisory authority

As you are resident in the Czech Republic, the competent supervisory authority is the Úřad pro ochranu osobních údajů (UOOU):
https://uoou.gov.cz

German customers may also contact their relevant state data protection authority.

This privacy policy was last updated in April 2026.