Privacy Policy

1. Data controller

The controller of your personal data is OxySolve Mateusz Rusyn, ul. Przemysława 4 lok. 45, 44-300 Wodzisław Śląski, VAT ID 6472584106, REGON 381281073.

Contact for data protection matters: [email protected].

We have not appointed a data protection officer - please use the address above for all data protection matters.

2. What data we collect

Order data: recipient's full name, phone number, delivery address or InPost parcel locker code, email address, and the parcel tracking number once dispatched. For business purchases, additionally the company name, VAT ID and address.

Declarations made at purchase: your confirmation that you are buying the Products solely for laboratory research purposes, and your acceptance of the Terms & Conditions - each stored together with the date and the version of the wording you accepted.

Account data: email address, language, account creation date, last login date and active sessions. Accounts are passwordless - we store no customer passwords.

Newsletter: email address, language, and whether and when the subscription was confirmed.

Points programme: your points balance and the history of its changes - date, number of points, reason for the credit or redemption, and the related order code.

Product reviews: rating, review text, the signature you choose to sign with, and the order code proving the purchase.

Back-in-stock notifications: email address and the Product concerned.

Withdrawals and complaints: the data provided in the form together with the order code.

Import request data: request description, quantity and optionally contact details.

Technical data: IP address, browser information and server logs - to the extent necessary for security and correct operation of the service.

3. Purposes and legal bases

Order fulfilment and delivery - Art. 6(1)(b) GDPR (performance of a contract).

Payment handling and confirmation - Art. 6(1)(b) GDPR.

Operating the customer account and single-use link login - Art. 6(1)(b) GDPR.

Operating the points programme - Art. 6(1)(b) GDPR.

Sending the newsletter - Art. 6(1)(a) GDPR (your consent, confirmed by clicking the link).

Notifying you when a Product is back in stock - Art. 6(1)(a) GDPR (your consent).

Collecting and publishing product reviews - Art. 6(1)(a) GDPR (consent given by submitting the review for publication).

Verifying that a review comes from someone who actually bought the Product - Art. 6(1)(c) GDPR (the obligation to publish only verified reviews under consumer law implementing the Omnibus Directive).

Preserving evidence of the terms on which the sale took place - the research-use declaration and the acceptance of the Terms - Art. 6(1)(f) GDPR (establishment, exercise and defence of legal claims) and Art. 6(1)(c) GDPR.

Accounting and tax obligations - Art. 6(1)(c) GDPR (legal obligation).

Handling withdrawals and complaints - Art. 6(1)(c) GDPR.

Service security and legal claims - Art. 6(1)(f) GDPR (legitimate interest).

Non-essential cookies - Art. 6(1)(a) GDPR (your consent).

4. Account, newsletter, points and reviews

The account is passwordless. You log in with a link sent to your email; the link is single-use and short-lived. The account is created only when the link is used, so entering someone else's address in the form creates no record for that person. A login session expires after 30 days, or earlier if you log out.

The newsletter uses double opt-in: signing up does nothing until you confirm it by clicking the link. Every message contains an unsubscribe link - unsubscribing takes effect immediately and requires no login.

Points are credited for paid orders, published reviews, creating an account and confirming a newsletter subscription. We keep the crediting history as a ledger so that every change to your balance can be explained. Points have no monetary value other than being exchangeable for a discount code in the Store.

Reviews: the rating, the review text and the signature you provide are publicly visible. The signature can be any label you choose - it does not have to be your real name. The order code is never shown publicly; it serves solely to verify that the review comes from someone who bought that Product. Reviews are published only after checking, and we do not publish sponsored reviews.

Please note that a published review is public content - search engines and other services may store a copy of it. Removing a review from the Store does not remove such copies from systems we do not control.

5. Recipients of data

InPost S.A. - the data needed to deliver the parcel.

Stripe Technology Europe, Ltd. (Ireland) - payment processing.

Resend - Plus Five Five, Inc. (United States) - transactional email delivery. The content of the messages we send you passes through this provider's systems, i.e. your email address, the recipient's name, the order code and its contents. This involves a transfer outside the EEA - see section 10.

Hetzner Online GmbH (Germany) - hosting. The application server and database are located within the European Economic Area.

If you contact us via WhatsApp, your phone number and message content are processed by WhatsApp Ireland Limited (Meta) as the provider of that messaging service - on the same basis as contacting us by email. Using this channel is optional; you can email us instead.

If you consent to analytics or marketing cookies, data about your activity in the Store is additionally received by Google Ireland Limited (Google Analytics 4 / Google Tag Manager) and Meta Platforms Ireland Limited (Meta Pixel). The scope of that data is described in our Cookie Policy. You can withdraw consent at any time by clicking “Cookies” in the footer.

We do not sell your data. Apart from the analytics and marketing tools described above, which operate solely on the basis of your consent, we do not share your data with third parties for marketing purposes.

6. Retention periods

The order record - code, date, amount, payment method and ordered items - is retained for the period required by accounting and tax law, as a rule 5 years from the end of the tax year, and for the limitation period for contractual claims.

Order address and contact data - name, phone number, address or parcel locker code, email address, company details and tracking number - is deleted automatically 400 days after the order was placed, provided the order has already been completed (delivered or cancelled). After that clean-up the record retains only the commercial history, with nothing that identifies you.

In the same cycle we delete the identifiers stored with the order for advertising measurement: Meta cookie identifiers, IP address and browser information.

The declaration that you are buying solely for laboratory research purposes, and your acceptance of the Terms, form part of the order record and are retained for as long as the record itself. They are removed neither by the automatic 400-day clean-up nor by an erasure request you submit. The reason is singular: they are the evidence of the terms on which the sale took place, and without them we could not demonstrate on what terms it was concluded. The retained wording is identical for every order - apart from the date and version number it contains none of your data.

The IP address and browser information recorded at the moment of this declaration are retained longer than the rest of the address data - up to 6 years from the order date (the limitation period for contractual claims) - as evidence that the declaration was not ticked automatically. After that period we delete the IP address and browser information themselves; the declaration's wording, version and date remain.

Account data is retained until you ask us to delete the account. A login session expires after 30 days, and a login link expires shortly after issue and on first use.

The points history is tied to the account - deleting the account also deletes the points ledger.

Newsletter subscription data is retained until you unsubscribe.

A review is retained until you ask us to remove it.

A back-in-stock request is fulfilled once, and the address is deleted from our database as soon as the notification has been sent - you provided it for a single purpose, and once that purpose is met we have no basis to keep it. You can also withdraw the request earlier by writing to us.

Server logs are retained for as long as necessary to keep the service secure and diagnosable.

7. Data security

Address and contact details provided with your order, as well as email addresses linked to an account, the newsletter and back-in-stock notifications, are encrypted in the database (AES-256-GCM).

Email addresses are additionally stored as an irreversible hash. The hash is used solely to locate the right record without decrypting the address itself.

Customer accounts are passwordless, so we store no passwords or password hashes.

The connection to the Store is encrypted (HTTPS/TLS), and access to the operations panel is protected by a server-side session that can be revoked.

8. Your rights

You have the right to: access your data, rectify it, erase it (“right to be forgotten”), restrict processing, data portability, object to processing, and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).

To exercise these rights, write to [email protected].

You can request erasure of order personal data by providing your order code - shipping and contact data will be permanently deleted and the order record anonymised for accounting purposes. The record of the declarations made at purchase is retained alongside it, on the terms described in section 6.

Deleting your account also deletes your points history. Orders placed before the account was deleted remain in the accounting records on the terms described in section 6.

You can withdraw consent to the newsletter, back-in-stock notifications and non-essential cookies yourself - via the unsubscribe link in the message and the “Cookies” button in the footer respectively.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (ul. Stawki 2, 00-193 Warsaw).

9. Is providing data voluntary?

Providing delivery data is voluntary but necessary to fulfil your order. Without it we cannot process and ship your order.

The account, newsletter, points programme, reviews and back-in-stock notifications are entirely optional and are not a condition of purchase. You can place an order without creating an account.

Making the declaration that you are buying solely for laboratory research purposes is, however, a condition of the contract - without it we do not accept the order.

10. Transfers outside the EEA and profiling

The Store's application server and database are located within the European Economic Area.

Data leaves the EEA in two situations. First, transactional email: our provider is Resend (Plus Five Five, Inc.), established in the United States, so the content of the messages we send you - including your email address, the recipient's name, the order code and its contents - is processed there as well. The transfer rests on two bases at once: the Standard Contractual Clauses under Art. 46(2)(c) GDPR (Module Two, incorporated into the data processing agreement concluded with the provider), and the provider's certification under the EU-U.S. Data Privacy Framework. This path operates independently of cookie consent, because without it an order confirmation cannot be sent.

Second, analytics and marketing tools that operate solely with your consent: data about your activity may be transferred to the United States, where Google and Meta base such transfers on Standard Contractual Clauses and on the EU-U.S. Data Privacy Framework. The same applies to WhatsApp if you choose to contact us through that channel. You can withdraw consent at any time.

We do not use automated decision-making producing legal effects concerning you. Marketing tools operating with your consent may profile you for ad targeting - you can object by withdrawing your marketing cookie consent.

11. Changes to this policy

We may update this policy. Last updated: 26.08.2026.

In this update we described the customer account, the newsletter, the points programme, reviews and back-in-stock notifications, stated concrete retention periods for each category of data, and clarified which data is transferred outside the European Economic Area and on what basis.

In the 26.08.2026 update we added the IP address and browser information recorded with the research-use declaration, and set a separate 6-year retention period for them.