La Herba · Privacy

GDPR – how we protect your privacy

As we prioritise the protection of our customers' personal data, we approach its collection responsibly and in accordance with personal data protection regulations, particularly Regulation (EU) 2016/679 (GDPR) and the Slovak Act No. 18/2018 Coll. on Personal Data Protection. Below, we describe what personal data is collected when you visit and use the services of laherba.eu, the purposes and legal basis for which we use this data, and the further conditions of its processing.

Data controller

Laherba, s.r.o.

Company ID (IČO)

54304610

Encryption

SSL

Contact

laherba@laherba.eu

Data controller

Who processes your data

The controller of the information systems in which your personal data is processed is:

Laherba, s.r.o.
Karpatské námestie 10/A
831 06 Bratislava
Slovak Republic
IČO: 54304610 · DIČ: 2121645746
E-mail: laherba@laherba.eu

Data security

How we keep it safe

Your personal data is securely transmitted using SSL (Secure Socket Layer) encryption. We protect our websites and systems with appropriate technical and organisational measures against loss, destruction, alteration and dissemination of data by unauthorised persons.

Web hosting services are provided by ROYAL MEDIA s.r.o.

Tracking, analytics and cookies

I. Traffic tracking, analysis and marketing

We use cookies – small text files stored on your device – in several places on our e-shop. Cookies cannot be assigned to a specific person and do not contain direct personal data. The cookies we use are divided into:

Always active

Strictly necessary (technical) cookies

They are essential for the basic functionality of the e-shop (e.g. shopping cart function, login).

Legal basis: our legitimate interest (Art. 6(1)(f) GDPR), as the purchase cannot be made without them. These files are activated automatically.

Only with your consent

Analytical, marketing and preference cookies

They serve for statistical evaluation, measuring advertising effectiveness and content personalisation. This includes services like Google Analytics, Google Ads and Meta Pixel (Facebook).

Legal basis: exclusively your explicit consent (Art. 6(1)(a) GDPR), which you provide via the cookie banner (opt-in).

II. Consent and withdrawal of consent

You decide what is switched on

Obtaining consent (opt-in): analytical, marketing and preference cookies are activated only after you grant your active consent in the cookie bar/banner. Refusing these cookies does not prevent you from using the basic functions of the e-shop or making a purchase.

Withdrawing consent: you can change or withdraw your consent at any time in the cookie settings, as easily as you gave it.

Data collected: these tools and cookies collect pseudonymised data such as browser type and version, operating system, referrer URL, IP address (shortened), access time and clicks.

Third-party cookies: the laherba.eu pages also contain links and integrated content from other websites (e.g. YouTube, Facebook). If the page being viewed uses a third-party analysis tool, you may receive cookies from these services, over which Laherba, s.r.o. has no control.

Acquisition, processing and use of personal data

What we process and why

We collect only the data necessary for the provision of our services, based on clearly defined legal grounds:

Performance of the purchase contract

Order processing, communication

Data

Name and surname, e-mail, postal/invoicing address, telephone number.

Legal basis

Art. 6(1)(b) – performance of a contract

Retention

For the duration of the contractual relationship and the warranty period, and subsequently for the period required to fulfil legal obligations.

Accounting and legal compliance

Invoices and accounting records

Data

Invoicing details, data from documents.

Legal basis

Art. 6(1)(c) – compliance with a legal obligation

Retention

10 years under the Slovak Accounting Act (Act No. 431/2002 Coll.).

Customer account registration

Account management

Data

Name and surname, e-mail, address, telephone number.

Legal basis

Art. 6(1)(b) – performance of a contract

Retention

For the duration of the registration/account, unless you request cancellation.

Claims and withdrawals

Handling complaints and returns

Data

Name, contact details, order details, bank account (IBAN) for refunds.

Legal basis

Art. 6(1)(c) – legal obligation under consumer protection law

Retention

For the duration of the claim and the related statutory periods.

Log files and technical security

Security and functionality of the e-shop

Data

IP address, date/time of access, referrer URL.

Legal basis

Art. 6(1)(f) – legitimate interest

Retention

Only the time necessary to ensure system security.

Sending newsletters

Double opt-in

Data

E-mail address, IP address.

Legal basis

Art. 6(1)(a) – your consent

Retention

Until consent is withdrawn (unsubscribing).

Note: for sending newsletters, we use the double opt-in method, requiring you to click on an activation link in the e-mail. You can unsubscribe at any time via the link in each e-mail.

Recipients and processors

Who may receive your data

Your personal data may only be provided to third parties if necessary for the performance of the purchase contract or our legal obligations. Categories of recipients and processors include:

Hosting

Web hosting & e-shop

ROYAL MEDIA s.r.o.

Delivery

Shipping companies

Slovenská pošta, Packeta (Zásielkovňa), DPD and other courier services – according to your choice.

Payments

Payment provider

Comgate (payment gateway) for processing cashless payments.

Analytics & marketing

Based on your consent

Google Ireland Ltd., Meta Platforms Ireland Ltd. (Facebook).

Professional services

Legal & accounting

Providers of legal and accounting services.

Transfers outside the EU: some providers of analytics and marketing tools (Google, Meta) may transfer data to the USA. Such transfers take place only on the basis of the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Data subject rights

Your rights

You have the right to withdraw your consent to data processing at any time (e.g. by unsubscribing from the newsletter or changing cookie settings). The withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Subject to the requirements set out in the GDPR, you have the right to:

Access

Access your personal data.

Rectification

Rectification of incorrect or incomplete personal data.

Erasure

Erasure of personal data (“right to be forgotten”), especially if no longer necessary for the purposes for which it was collected.

Restriction

Restriction of processing (blocking).

Objection

Object to processing based on legitimate interest, especially for direct marketing purposes.

Portability

Data portability to another controller (if technically feasible).

Exercising rights and complaints

How to contact us

You can exercise your rights by e-mail at laherba@laherba.eu or by post to Laherba, s.r.o., Karpatské námestie 10/A, 831 06 Bratislava, Slovak Republic. We will respond without undue delay, no later than within one month.

Identity verification

If you exercise any of your rights and we cannot verify your identity, we reserve the right to request additional information. It will be used exclusively for identity verification in the sense of Art. 12 GDPR and deleted immediately after verification.

Data Protection Officer

Given the nature of the processing, Laherba, s.r.o. is not obliged to appoint a DPO.

Complaint

You have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava (dataprotection.gov.sk), or with the supervisory authority in the EU country of your residence.

18+ only

The services provided within laherba.eu, for which the consent of the person concerned is required according to these terms, are not intended directly for persons under the age of 18.

Last updated: 9 October 2026