Personal data protection and use of cookies
Protecting your privacy and personal data is important to us. In this document, we explain what personal data we process when you use the LucyLab website and online shop, the purposes for which we use it, the legal basis on which we process it, to whom we may disclose it, how long we keep it and what rights you have in connection with its processing.
When processing personal data, we act in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council – the General Data Protection Regulation (hereinafter the “GDPR”), Act No. 18/2018 Coll. on Personal Data Protection, as amended, and other applicable legislation of the Slovak Republic.
Who is the controller of your personal data
The controller of personal data is:
DULCIA natural, s. r. o.
Skalická cesta 9/A
831 02 Bratislava
Slovak Republic
Company ID: 44604572
Email: info@lucylab.com
LucyLab is a trade brand operated by DULCIA natural, s. r. o. The change of trade brand from Dulcia natural to LucyLab does not change the legal entity that operates the online shop and is the controller of personal data.
You can also contact us at the email address above with any questions about personal data protection or when exercising your rights.
What personal data we may process
The scope of the data processed depends on how you use our website and services. We may process in particular:
- identification data, for example your first name and surname,
- contact details, for example your email address, telephone number and delivery or billing address,
- data related to your user account,
- data on orders, purchased products, payments, shipping, returns of goods and complaints,
- data on your communication with us,
- data you voluntarily provide to us in reviews, forms or questionnaires,
- data related to the personalisation of your skincare routine, if you use this service,
- technical data, for example your IP address, device identifiers, browser type, operating system and data on your use of the website,
- data obtained through cookies and similar technologies, if you have consented to their use,
- data necessary to protect our rights, ensure the security of the website and prevent fraud.
We obtain personal data primarily directly from you. We may also obtain some technical or transaction data from service providers through which payment, shipping, analytics or another part of the operation of the online shop is carried out.
Registration and user account
If you create a user account, we process the data necessary to create, manage and secure it, in particular your first name, surname, email address, login details and data related to the use of the account.
The purpose of the processing is to enable you to use your user account, access your order history, saved details and other personalised features of the website.
The legal basis is Article 6(1)(b) GDPR – performance of a contract or taking steps at your request prior to entering into a contract.
Ordering, purchasing and delivery of goods
When you place an order, we process the data necessary to receive, confirm, pay for, pack and deliver it. This includes in particular your first name, surname, email address, telephone number, billing and delivery address, the contents of the order and data related to payment and delivery.
Without the data necessary to conclude and perform the contract, the order cannot be properly processed and delivered.
The legal basis is Article 6(1)(b) GDPR – performance of a contract.
Payments
When you pay, we process the data necessary to match the payment to the order, in particular the amount of the payment, the currency, the transaction identifier, the payment method chosen and information on the payment status.
For a standard payment by payment card, we do not obtain or store the full payment card number or the CVV/CVC security code. The data needed to authorise the card payment is processed by the relevant payment service provider in its secure payment environment.
When processing a payment, the payment service provider may act as an independent controller of personal data. The data processing terms of the specific provider are available in its own privacy policy.
When refunding a payment, we may in justified cases also process a bank account number or IBAN, if this information is necessary to make the refund.
Accounting and compliance with legal obligations
We also process data stated on orders, invoices, accounting and tax documents for the purposes of keeping accounts and fulfilling tax and other legal obligations.
The legal basis is Article 6(1)(c) GDPR – compliance with a legal obligation of the controller.
We keep this data for the period required by the relevant accounting, tax and other legislation.
Complaints, withdrawal from the contract and customer support
If you contact us in connection with an order, complaint, return of a product, withdrawal from the contract or any other request, we process the data necessary to handle your request.
This may include in particular your first name, surname, contact details, order number, details of the product purchased, the content of the communication, photos or other documents you provide to us.
Depending on the specific situation, the legal basis may be Article 6(1)(b) GDPR – performance of a contract, or Article 6(1)(c) GDPR – compliance with a legal obligation, in particular obligations arising from Act No. 108/2024 Coll. on Consumer Protection and other relevant legislation.
Skincare personalisation and MyLab
When you use the skincare personalisation service, for example through MyLab, we may process your answers concerning your skin type and its current condition, your cosmetic preferences, the concerns you want to address, the products you use and the desired scope of your skincare routine.
The purpose of the processing is to create a personalised recommendation of cosmetic products or a skincare routine based on the information you voluntarily provide to us.
Where this concerns ordinary data on cosmetic preferences and skin needs, we carry out the processing on the basis of your consent under Article 6(1)(a) GDPR.
If your answers contain data that may be considered data concerning health, for example information about a diagnosed skin condition, we process such data only on the basis of your explicit consent in accordance with Article 9(2)(a) GDPR.
You can withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.
A personalised cosmetic recommendation does not constitute a medical diagnosis, a medical consultation or individual healthcare.
Product reviews and comments
If you decide to publish a product review or comment, we may process the name, nickname or other designation you give with the review, the content of the review itself and the technical data necessary to administer it and protect it against misuse.
If the processing is based on your consent, the legal basis is Article 6(1)(a) GDPR. If processing the data is necessary to protect the website against fraudulent or abusive reviews, the legal basis may be our legitimate interest under Article 6(1)(f) GDPR.
Newsletter and marketing communication
If you voluntarily subscribe to the newsletter or other marketing communication without a previous purchase, we process your email address and any other data you have voluntarily provided on the basis of your consent under Article 6(1)(a) GDPR.
Consent is voluntary and not giving it does not affect your ability to shop in our online shop.
If you have already shopped with us, we may, under the conditions laid down by law, also use your electronic contact details to send you offers of our own similar products or services. In such a case, we process personal data on the basis of our legitimate interest under Article 6(1)(f) GDPR and in accordance with the direct marketing rules under Act No. 452/2021 Coll. on Electronic Communications.
In every electronic marketing message, we will allow you to unsubscribe from further mailings easily and free of charge. You can object to the processing of personal data for direct marketing purposes at any time.
Once you withdraw your consent or raise an objection, we will stop using the relevant contact details for that marketing purpose. We may keep information about the unsubscription to the extent necessary to ensure that your request is respected in the future as well.
Technical data, security and protection of the website
When you use the website, we may process technical data necessary for its secure operation, for example your IP address, the date and time of the request, information about your browser and device, system logs and data related to security events.
The purpose is to ensure the functionality and security of the website, to prevent fraud, misuse and unauthorised access and to deal with technical or security incidents.
The legal basis is as a rule our legitimate interest under Article 6(1)(f) GDPR, consisting in the secure operation of our information systems and the protection of our rights, customers and services.
Cookies and similar technologies
We use cookies and similar technologies on the website. A cookie is a small data file that may be stored on your device when you visit the website.
When using cookies, we also act in accordance with Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications.
Essential cookies
Essential cookies ensure the basic functioning of the online shop, for example keeping the contents of the shopping cart, secure login, the correct functioning of the ordering process, the security of the site or saving your cookie choices.
If these cookies are necessary for the transmission of communication or to provide a service you have explicitly requested, your consent is not required for storing them.
Preference and functional cookies
These cookies may allow the website to remember your preferences and provide enhanced features. If they are not necessary to provide the service, we activate them only after you have given your consent.
Analytical cookies
Analytical cookies help us understand how visitors use our website, which pages they visit and how they move around the site. We use this information to evaluate traffic and improve the website.
We use analytical cookies that are not essential only on the basis of your prior consent.
Marketing cookies
Marketing cookies and similar technologies may be used to measure the effectiveness of advertising, to display more relevant advertisements and to create or evaluate advertising audiences.
We activate marketing cookies only on the basis of your prior consent.
On your first visit to the website, you can choose which categories of cookies you allow. Optional cookies must not be activated before the relevant consent has been given.
You can change your decision or withdraw your consent at any time later via the Cookie settings link available on the website. Withdrawing consent must be as easy as giving it.
The current list of cookies used, their purpose, provider and expiry period is shown in the cookie management tool. The set of cookies used may change depending on the technical and marketing services used.
To whom we may disclose personal data
We do not disclose personal data to third parties without a reason. However, to the extent necessary to provide our services, it may be processed or received in particular by:
- providers of hosting, servers, information systems and technical support,
- providers of e-commerce and cloud infrastructure,
- providers of payment services and payment gateways,
- banks and financial institutions, if necessary to make a payment or refund,
- courier, postal, pick-up point and logistics companies,
- providers of accounting, tax, auditing and legal services,
- providers of email, SMS and marketing communication,
- providers of analytics and advertising tools, if you have given the relevant consent,
- providers of customer support and review management tools,
- public authorities, courts or other authorised bodies, if we are obliged to provide the data by law or by a final decision.
Depending on the nature of the service, individual recipients may act as our processors or as independent controllers of personal data.
We provide processors only with the data necessary to provide the specific service, and we govern the processing of personal data with appropriate contractual and security measures.
Transfer of personal data outside the European Economic Area
Some providers of technology, analytics, cloud or marketing services may also operate outside the European Union or the European Economic Area.
If the use of such a service involves the transfer of personal data to a third country, we carry it out only when the conditions of Chapter V of the GDPR are met, in particular on the basis of a European Commission decision on an adequate level of protection or through appropriate contractual and security safeguards, for example standard contractual clauses.
How long we keep personal data
We do not keep personal data longer than necessary for the purpose for which it was obtained.
The retention period depends on the specific purpose of the processing:
- we keep data necessary to process an order for the duration of the contractual relationship and then for the period necessary to protect and exercise legal claims,
- we keep accounting and tax documents for the period laid down by the relevant legislation,
- we keep user account data for as long as the account exists and then only to the extent that further retention is necessary or required by legislation,
- we keep data from customer communication while the request is being handled and then for the period necessary to protect legal claims,
- we process data based on consent until the consent is withdrawn or the purpose of the processing ceases to exist,
- we process data used for direct marketing until consent is withdrawn, an objection is raised or the relevant purpose ceases to exist,
- we process data obtained through optional cookies according to the expiry period of the specific cookie or until consent is withdrawn; the specific period is stated in the cookie settings,
- we may keep data necessary to demonstrate compliance with our legal obligations to a reasonable extent even after the original processing has ended.
After the relevant period has expired, we will delete or anonymise the data, unless further retention is required by legislation or for the protection of legal claims.
Your rights in the processing of personal data
Depending on the circumstances of the processing, you have in particular the following rights under the GDPR:
- the right of access to personal data – you can obtain confirmation of whether we process your personal data and information about its processing,
- the right to rectification – you can ask us to correct inaccurate or complete incomplete personal data,
- the right to erasure – under the conditions laid down in the GDPR, you can ask for your personal data to be erased,
- the right to restriction of processing – in the cases laid down in the GDPR, you can request a temporary restriction of processing,
- the right to data portability – if the statutory conditions are met, you can obtain your data in a structured, commonly used and machine-readable format or ask for it to be transferred to another controller,
- the right to object – you can object to processing based on our legitimate interest,
- the right to object to direct marketing at any time – if you object to processing for direct marketing purposes, we will no longer process your personal data for this purpose,
- the right to withdraw consent – if we process personal data on the basis of your consent, you can withdraw it at any time,
- the right to lodge a complaint or a request to initiate proceedings with the supervisory authority.
Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.
When you exercise a right, we may reasonably require verification of your identity so that we do not disclose personal data to an unauthorised person.
How you can exercise your rights
You can exercise your rights via the email address info@lucylab.com.
We handle requests without undue delay and within the time limits laid down by the GDPR. If a request is complex or there are a large number of requests, the time limit may be extended under the conditions of the GDPR; we will inform you of any such extension and the reasons for it.
The right to contact the supervisory authority
If you believe that the processing of your personal data has infringed the law, you have the right to submit a request to initiate proceedings or a complaint to:
Office for Personal Data Protection of the Slovak Republic
Website: dataprotection.gov.sk
Before submitting a complaint to the authority, you can contact us at info@lucylab.com and we will try to resolve your request.
Automated decision-making and profiling
In the normal use of the online shop, we do not carry out automated individual decision-making that would produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.
Some features of the website may automatically evaluate the preferences you enter and recommend products or a skincare routine on that basis. Such a recommendation does not in itself constitute a decision with legal or similarly significant effects.
If you have consented to marketing or analytical cookies, the data may also be used to create marketing segments or tailor advertising content. We carry out such processing only within the scope of the relevant consent.
Children's personal data
Our services are not primarily intended for children.
If the processing of personal data is based on consent in relation to the offer of information society services directly to a child, a person under the age of 16 cannot give such consent independently under Slovak rules. In such a case, the consent or authorisation of the holder of parental rights and responsibilities is required.
If we find that we have obtained a child's personal data in a manner that does not comply with the legislation, we will take appropriate measures to delete it.
Security of personal data
We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss, misuse, disclosure or destruction.
Access to personal data is restricted to persons who need it to perform their work or contractual duties and who are bound by a duty of confidentiality or a corresponding contractual obligation.
We continuously and appropriately adapt our security measures to the nature of the data processed, the technologies available and the risks identified.
Links to third-party websites and services
Our website may contain links to third-party websites or services. Once you go to such a website, the processing of your personal data is governed by the rules of the third party concerned.
We are not responsible for the content and personal data protection practices of websites operated by independent third parties.
Changes to this policy
We may change this policy from time to time, in particular in the event of changes in legislation, the services used, technologies or the way personal data is processed.
The current version will always be published on our website together with the date of the last update.
Contact
If you have any questions about the processing of personal data or the use of cookies, or if you wish to exercise any of your rights, please contact us:
DULCIA natural, s. r. o. – LucyLab
Skalická cesta 9/A
831 02 Bratislava
Slovak Republic
Company ID: 44604572
Email: info@lucylab.com
This personal data protection and cookie policy is effective from 10 September 2026.