Privacy Policy

1. Introduction

This Privacy Policy explains how Merulab ("we", "us", "our") collects, uses, and protects your personal data when you use our website and services. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and Czech data protection laws.

2. Data Controller

3. Data We Collect

We collect and process the following personal data:

• Identity data: Name, email address
• Contact data: Shipping address, phone number
• Transaction data: Order history, payment information
• Account data: Login credentials, preferences
• Technical data: IP address, browser type, device information, cookies

4. Purpose of Processing

We process your personal data for the following purposes:

• To fulfill orders and provide our services
• To communicate with you about your orders
• To comply with legal obligations (invoicing, tax records)
• To improve our website and services
• To answer messages you send us, and to email you once when a product you asked about is back in stock
• To ask you once, a few days after delivery, to review the products you bought. You can refuse at checkout or from the email itself

5. Legal Basis for Processing

We process your data based on:

• Contract performance: Processing necessary to fulfill your orders
• Legal obligation: Processing required by law (e.g., tax records)
• Legitimate interest: improving our services, preventing fraud, and one review request after delivery, which you can refuse
• Consent: back-in-stock notifications you request; withdraw it any time by replying to us

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected.

Order and invoice data is retained for 10 years as required by Czech tax law. Account data is retained until you delete your account. Marketing data is retained until you unsubscribe or withdraw consent.

Back-in-stock requests are deleted as soon as the notification is sent. Contact form messages are kept only as long as the conversation needs them.

View and download counts on projects and models are anonymous. To count each visitor only once a day, we keep a one-way hash of the IP address and browser for up to 48 hours; the address itself is not stored for this.

Published reviews show the name you choose and stay until you ask us to remove them. Addresses that asked for no more review requests are kept only to honour that choice.

7. Third-Party Sharing

We may share your data with:

• Shipping carriers to deliver your orders
• Payment processors to handle transactions
• Hosting and technical service providers

8. Your Rights

Under GDPR, you have the following rights:

• Right to access: Request a copy of your personal data
• Right to rectification: Correct inaccurate data
• Right to erasure: Request deletion of your data
• Right to restriction: Limit how we use your data
• Right to data portability: Receive your data in a portable format
• Right to object: Object to processing based on legitimate interest

To exercise any of these rights, please contact us at our email address.

9. Cookies

Our website uses cookies to ensure proper functionality, remember your preferences, and improve your experience.

Essential cookies are necessary for the website to function. Analytics cookies are loaded only after you accept the cookie banner. You can manage your cookie preferences through your browser settings.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at contact@merulab.com.