EnglishDeutsch

Legal information

Privacy policy

This page explains how Celvadis OÜ processes personal data in line with the General Data Protection Regulation (GDPR).

Last updated:

This English version is provided for convenience. For consumers in Germany, the German version applies.

1. Controller

Celvadis OÜ
Pärnu mnt 139b-⁠14, 11317 Tallinn, Estonia
Registry code 17608378
Represented by the management board, Felix Maximilian Weisshaar
Email: privacy@celvadis.com · Phone: +372 5368 6640

We have not appointed a data protection officer, as there is no legal obligation to do so. Please send any data protection inquiries to privacy@celvadis.com.

2. Overview

We process personal data only to the extent necessary to operate this website, respond to your inquiries, process orders and comply with legal obligations. This website does not use any tracking or analytics tools or advertising cookies, and it does not embed third-party content such as fonts, maps or videos from external servers.

3. Hosting and server log files

This website is operated on a server of a hosting provider in the European Union. When you access the website, the server automatically processes information transmitted by your browser: IP address, date and time of access, page accessed, amount of data transferred, referrer URL, browser type and operating system.

The purpose is the technical provision and security of the website (defence against attacks, error analysis). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of the website. The log files are deleted after eight days at the latest, unless they are needed to investigate a security incident. We have concluded a data processing agreement with the hosting provider.

4. Content delivery network and security

To deliver the website, protect it against attacks and encrypt the connection, we use a service provider based in the USA. Your requests are routed through the service provider’s servers, and technical data such as your IP address and access information are processed.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing the website securely and quickly. The service provider is certified under the EU-⁠US Data Privacy Framework; in addition, standard contractual clauses of the European Commission are in place. You can obtain a copy of the standard contractual clauses by writing to privacy@celvadis.com. We have concluded a data processing agreement with the service provider. The service provider stores this data only for as long as necessary to deliver and protect the website and then deletes it automatically.

The service provider also instructs your browser to send it a technical error report (e.g. the address requested, type of error, time) when a page request fails. Your browser stores the setting required for this for up to seven days. This serves the stable and secure delivery of the website; the legal basis is Art. 6(1)(f) GDPR and Section 25(2) no. 2 TDDDG.

5. Contact by email, phone and form

If you contact us by email, via a form on this website or by phone, we process the data you provide (e.g. name, email address, phone number, order number, company, content of your message) in order to respond to your inquiry.

The legal basis is Art. 6(1)(b) GDPR where your inquiry relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

  • Email: Our mailboxes are operated by an email provider in the European Union.
  • Forms: The forms on this website do not transmit any data to our server and do not store anything. When you click ‘Prepare email’, your email program opens with a prepared message. Only when you send it is it transmitted to us via your own email provider.
  • Phone and voicemail: Our phone number is operated via a telephone service provider. Voicemail messages are forwarded as audio files to our customer service mailbox.
  • Storage period: We delete inquiries once they have been fully dealt with, provided that no statutory retention obligations apply. We retain commercial and tax-relevant correspondence for the statutory periods (depending on the rule, up to ten years from the end of the calendar year).

6. Orders and customer service

If you buy a product from us (via an online marketplace, a pharmacy platform or a web shop), we process the data required to perform the contract: name, delivery address, contact details, products ordered, payment and shipping status. For purchases via a marketplace or a pharmacy platform, we receive this data from the respective platform operator. The legal basis is Art. 6(1)(b) GDPR; invoice and accounting data are retained on the basis of Art. 6(1)(c) GDPR.

We store order data until the statutory warranty and limitation periods have expired. We retain invoices and accounting records for as long as commercial and tax law requires, depending on the rule up to ten years from the end of the calendar year.

  • Shipping: For delivery, we pass your name and delivery address on to our fulfilment partner and the relevant shipping company. Our fulfilment partner processes the data on our behalf.
  • Marketplaces: For purchases via a marketplace, the privacy notice of the respective marketplace operator also applies; the operator is independently responsible for the data it processes.
  • Payment: Payments are processed by the respective payment service providers or marketplaces. We do not receive full card details.
  • Recalls and safety warnings: If a product you bought is affected by a recall or safety warning, we use your contact details to inform you directly. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 19 of Regulation (EC) No 178/2002 or Art. 35 of Regulation (EU) 2023/988, and otherwise Art. 6(1)(f) GDPR (protecting the health and safety of our customers).

7. Business partners (manufacturers, trade, suppliers)

We process the data of contact persons at manufacturers, retailers, pharmacies and service providers in order to initiate and carry out the business relationship and to screen business partners (e.g. identity, company data, checks against EU sanctions lists). For these checks we also use publicly available sources such as commercial registers and the EU sanctions lists.

The legal basis is Art. 6(1)(b) GDPR where you yourself are our contractual partner (e.g. as a sole trader). For contact persons of companies, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in communicating with our business partners and in initiating and carrying out the cooperation. Business partner screening, including checks against EU sanctions lists, is based on Art. 6(1)(c) GDPR in conjunction with the EU sanctions regulations and on Art. 6(1)(f) GDPR (legitimate interest in working only with reliable partners).

We store the data of contact persons for the duration of the business relationship and thereafter where statutory retention obligations apply. We delete inquiries that do not lead to a cooperation no later than twelve months after the last contact.

8. Cookies

This website does not set any cookies itself. You can find details in our cookie notice.

9. Recipients and transfers to third countries

We only pass on personal data where this is necessary for the purposes stated, to: hosting provider, service provider for the delivery and protection of the website, email provider, telephone provider, fulfilment and shipping partners, marketplace operators, payment service providers, our accountant and tax adviser, companies of our group, insofar as they provide administrative or IT services for us, and authorities where we are legally obliged to do so. We will give you the names of the service providers we use on request to privacy@celvadis.com.

Personal data is only transferred to countries outside the EU/EEA on the basis of an adequacy decision (e.g. EU-⁠US Data Privacy Framework) or appropriate safeguards (standard contractual clauses). You can obtain a copy of the standard contractual clauses by writing to privacy@celvadis.com.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object (Art. 21, see below). To exercise these rights, please contact privacy@celvadis.com.

Right to object

Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can send your objection informally to privacy@celvadis.com.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence or where our company has its registered office. The supervisory authority responsible for us is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee.

11. Obligation to provide data

You are not obliged to provide us with any data. However, without the information required for an order or inquiry, we cannot process your order or inquiry. No automated decision-making, including profiling, takes place.