Privacy Policy
What we collect, why we collect it, who touches it, and the control you keep over it — stated plainly, with the legal basis named for every purpose.
Last updated — 2026-07-28
1. Who is the controller of your personal data
The data controller is redlight.doctor s.r.o., Company ID (IČO) 21247129, registered office at Na Příkopě 988/31, Staré Město, 110 00 Prague 1, Czech Republic, registered with the Municipal Court in Prague, section C, file 398889 (the "we", "controller" or "operator").
For any data-protection matter, contact us at info@redlight.doctor or by phone at +420 731 682 980.
No Data Protection Officer (DPO) has been appointed; we are not legally required to appoint one.
2. What personal data we process
- Identification and contact data: name, e-mail, phone, delivery and billing address.
- Order and payment data: order contents, purchase history, payment metadata. Card data itself is processed by the payment provider — we never receive or store it.
- Communication data: the content of messages, enquiries and complaints you send us.
- Customer-account data, if you choose to create an account.
- Review data you voluntarily submit.
- Technical and behavioural data: IP address, device and browser type, cookie and similar identifiers, on-site interactions — only to the extent covered by your cookie consent (see the Cookie Policy).
3. Purposes and legal bases
For every purpose we name the legal basis under Article 6 GDPR.
| Purpose | Legal basis |
|---|---|
| Order fulfilment, delivery, customer account | Performance of a contract — Art. 6(1)(b) |
| Complaints, statutory defect and withdrawal rights | Contract + legal obligation — (b), (c) |
| Accounting, tax and archiving duties | Legal obligation — (c) |
| Marketing to existing customers about similar goods | Legitimate interest — (f); you may object at any time |
| Newsletter to interested persons | Consent — (a); double opt-in, revocable at any time |
| Analytics cookies (e.g. GA4) | Consent — (a) |
| Marketing cookies and pixels (e.g. Meta Pixel) | Consent — (a) |
| Publishing a review | Consent or contract, depending on how it was collected — (a)/(b) |
| Protecting our rights, fraud prevention, site security | Legitimate interest — (f) |
4. Recipients and processors
We share your data only with vetted processors bound by data-processing agreements, and only to the extent necessary.
| Processor | Role | Data | Location |
|---|---|---|---|
| Shopify | E-commerce platform, hosting, checkout, accounts | name, e-mail, address, order, payment metadata | EU / US |
| Shopify Payments | Payment processing | payment data | EU / US |
| Klarna | Pay-later / instalments, if selected | name, contact, order data | EU |
| DPD | Delivery | name, address, phone, e-mail | EU |
| Klaviyo | E-mail marketing and transactional e-mail | name, e-mail, interactions | US |
| Judge.me | Collecting and displaying reviews | name, e-mail, review content | EU / US |
Data may also be shared with our advisers (accounting, legal) and with public authorities where the law requires it.
We currently engage no analytics or advertising processor. If that changes, this table and the Cookie Policy will be updated before any such processor receives a single request, and nothing in those categories will run without your consent.
5. Transfers outside the EU/EEA
Some processors — Shopify, Klaviyo, Google and Meta among them — may process data in the United States or other countries outside the European Economic Area. Such transfers are safeguarded by Standard Contractual Clauses approved by the European Commission and, where applicable, by the processor's certification under the EU–US Data Privacy Framework, or by other appropriate safeguards under Article 46 GDPR.
6. Retention periods
- Order and contract data: for the term of the contract and thereafter for the statutory limitation periods during which claims may be raised.
- Accounting and tax records: for the period required by Czech accounting and tax law.
- Consent-based data (newsletter, analytics and marketing cookies): until you withdraw consent, and no longer than the retention period configured for each tool.
- Data kept to defend legal claims: for the relevant limitation period.
When data is no longer needed for any of the purposes above, we delete it or irreversibly anonymise it.
7. Your rights
As a data subject you have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, to object to processing based on legitimate interest (including direct marketing), and to withdraw consent at any time — withdrawal does not affect the lawfulness of processing carried out before it.
Exercise any of these rights at info@redlight.doctor. We respond within the statutory time limit.
You also have the right to lodge a complaint with the supervisory authority: the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
8. Is providing data mandatory?
Providing the data necessary to conclude and perform the contract — delivery details, for instance — is a contractual requirement; without it we cannot process your order. Providing data for marketing purposes is entirely voluntary and refusing has no effect on your purchase.
9. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you, within the meaning of Article 22 GDPR.