Privacy Policy
DATA PROTECTION AND COOKIE NOTICE
Privacy principles and information on personal data protection provided by the Controller to the Data Subject when obtaining personal data from the Data Subject, and Cookie Information of the online store https://www.biovoxel.tech/
I. Controller
1.1. The identity and contact details of the Controller are:
Business name: Biovoxel Technologies s.r.o.
Registered office: Kamenná 3, Bratislava – city district Devín 841 10, Slovak Republic
Registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Insert No. 167932/B
Company ID: 55302882
Tax ID: 2121943538
VAT ID: SK2121943538
The Seller is a payer of value-added tax
1.2. The e-mail and telephone contact details of the Controller are:
E-mail: info@biovoxel.tech
Tel.: +421 904 408 895
1.3. The Controller's address for sending correspondence:
Biovoxel Technologies s.r.o., Kamenná 3, 841 10 Bratislava, Slovakia
1.4. In accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the "Regulation"), further in accordance with Act No. 18/2018 Coll. on the Protection of Personal Data and on amendments to certain acts, as amended, and in accordance with Act No. 452/2021 Coll. on Electronic Communications, as amended, the Controller hereby provides the Data Subject – (the Buyer) – from whom the Controller (the Seller) obtains personal data concerning them, with the following information, instructions and explanations:
II. References
2.1. These privacy principles and information on personal data protection form part of the General Terms and Conditions published on the Seller's Website.
2.2. The Merchant informs consumers that there are no special relevant codes of conduct which the Seller has undertaken to comply with, where a code of conduct means an agreement or a set of rules defining the conduct of a Seller who has undertaken to comply with that code of conduct in relation to one or more particular commercial practices or business sectors, where these are not laid down by law or by another legal regulation or measure of a public authority which the Seller has undertaken to comply with, and on the manner in which the consumer may become acquainted with them or obtain their wording.
III. Duration
3.1. The Controller retains the Data Subject's personal data only for the period strictly necessary for the purposes of performing the contract and their subsequent archiving within the statutory periods imposed on the Controller by legal regulations. If the Data Subject has consented to receiving promotional e-mails and similar offers, the Data Subject's personal data are processed for these purposes until the Data Subject withdraws their consent. However, for a maximum period of 10 years.
IV. Personal data processed
4.1. On its website, the Controller processes the following personal data: first name, surname, place of residence, e-mail address, telephone number, billing address, delivery address, data obtained from cookies, IP addresses.
4.2. In connection with the individual forms and functions of the website, the Controller further processes in particular:
4.2.1. in the contact form (Quick contact, available on the Contact page): first name, e-mail address, where applicable a telephone number, and the content of the question or message, for example an enquiry about the training models, surgical guides or 3D printing offered,
4.2.2. when subscribing to the newsletter (BioVoxel newsletter): e-mail address, on the basis of consent granted upon subscription,
4.2.3. when registering and managing a user account (Create an Account / Log In): first name, surname, e-mail address, telephone number, billing and delivery address, password (in encrypted form) and order history.
V. Contact details of the person responsible for supervising personal data protection
5.1. The Controller has not appointed a data protection officer in accordance with Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
5.2. The Controller is at the same time the Seller within the meaning of the term defined in the General Terms and Conditions of this website.
VI. Purposes of processing the Data Subject's personal data and the period of processing
6.1. The purposes of processing the Data Subject's personal data are in particular:
6.1.1. recording, creating and processing contracts and client data for the purpose of concluding contracts with third parties.
6.1.2. processing accounting documents and documents related to the Controller's business activity.
6.1.3. compliance with legal regulations in connection with the archiving of documents and records, e.g. under Act No. 431/2002 Coll. on Accounting, as amended, and other relevant regulations.
6.1.4. the Controller's activity in connection with fulfilling the Data Subject's request, order, contract and similar instruments, including handling questions and requests sent through the contact form on the website.
6.1.5. setting up and managing the Data Subject's user account, including order history.
6.1.6. ensuring the operation, functionality and security of the website and of the purchasing process on the Upgates platform, including management of cookie consent.
6.1.7. measuring and evaluating website traffic and displaying personalised advertising (e.g. through Google Analytics and Meta/Facebook Pixel), on the basis of the Data Subject's consent granted through the cookie consent management tool.
6.1.8. Newsletter, marketing and similar promotional activities of the Controller, including sending the newsletter through the subscription form. Where the Data Subject has granted the Controller consent to marketing and similar promotional activities.
VII. Legal basis for processing the Data Subject's personal data
7.1. Where the Controller carries out processing of personal data based on the Data Subject's consent, such processing will commence only after that consent has been granted by the Data Subject.
7.2. Where the Controller processes the Data Subject's personal data for the purposes of negotiating pre-contractual relations and concluding and performing a purchase contract and the related delivery of goods, products or services. The Data Subject is obliged to provide personal data for the proper performance of the purchase contract; otherwise performance cannot be ensured. Personal data for that purpose are processed without the Data Subject's consent.
7.3. Where personal data are processed through analytical and marketing cookies (e.g. Google Analytics, Meta Pixel, YouTube), the legal basis for processing is the Data Subject's consent granted through the cookie consent management tool on the website. The legal basis for processing personal data through strictly necessary cookies (in particular cookies ensuring the functionality of the Upgates platform) is the Controller's legitimate interest in ensuring the functionality and security of the website.
VIII. Recipients or categories of recipients of personal data
8.1. The recipients of the Data Subject's personal data will be, or may at least be:
8.1.1. the statutory bodies of the Controller or their members.
8.1.2. persons performing work for the Controller under an employment or similar relationship.
8.1.3. the Controller's commercial representatives and other persons cooperating with the Controller in the performance of the Controller's tasks. For the purposes of this document, all natural persons performing dependent work for the Controller on the basis of an employment contract or agreements on work performed outside an employment relationship shall be regarded as employees of the Controller.
8.1.4. The recipients of the Data Subject's personal data will also be the Controller's collaborators, business partners, suppliers and contractual partners, in particular: the accounting company, the company providing services relating to the creation, hosting and maintenance of the e-shop platform, the company providing legal services to the Controller, the company providing consultancy to the Controller, companies providing transport and delivery of products to buyers and third parties, marketing companies, companies operating social networks, companies providing payment gateways and other payment methods.
8.1.5. The recipients of personal data will also be the courts, law enforcement authorities, the tax office and other state authorities, where so provided by law. The personal data will be provided by the Controller to those authorities and state institutions on the basis of and in accordance with the legal regulations of the Slovak Republic.
8.1.6. List of third parties – processors and recipients who process the Data Subject's personal data:
UPGATES s.r.o. – third party providing and operating the Upgates e-shop platform (hosting, technical operation and website tools, including the cookie consent management tool) – confirmed directly on the website by the note "Powered by Upgates Shops".
Slovenská pošta, a.s., Partizánska cesta 9, 975 99 Banská Bystrica, Company ID: 36631124 – third party providing transport services
Direct Parcel Distribution SK, s.r.o., with registered office at Technická 7, 82104 Bratislava, Company ID: 35834498 – third party providing transport services
Packeta Slovakia s. r. o., with registered office at Sliačska 1E, 831 02 Bratislava – city district Nové Mesto, Company ID: 48136999 – third party providing transport services
Comgate a.s., Aupark, Gočárova třída 1754/48b, 500 02 Hradec Králové, Company ID: 279 24 505 – third party providing the COMGATE payment gateway
LASSARD, s. r. o., Rostovská 22, 831 06 Bratislava – city district Rača – third party providing accounting services
United Kingdom Entity: eBay (UK) Limited, 1 More London Place, London, SE1 2AF, United Kingdom – third party providing intermediation of the sale of goods
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – provider of the Google Analytics tool.
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland – provider of the Meta (Facebook) Pixel tool.
Google LLC, D/B/A YouTube, 901 Cherry Ave, San Bruno, CA 94066, USA – provider of the YouTube service, whose embedded videos are used on the website.
IX. Information on the transfer of personal data to third countries and the period of their retention:
9.1. Applicable. The Controller transfers personal data of individuals in the form of cookies to third countries, to the following entities:
GOOGLE Pixels: Google HQ. 1600 Amphitheatre Parkway. Mountain View, CA 94043, USA. Further information on privacy protection can be found at:
https://business.safety.google/privacy/
https://business.safety.google/privacy/google-services/
https://business.safety.google/privacy/display-advertising/
META Pixels: Facebook Ireland Ltd. 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Ireland. Further information on privacy protection can be found at: https://www.facebook.com/about/privacy/
9.2. In the event of a transfer of personal data to a third country, the Controller, or the relevant tool provider, ensures appropriate safeguards in accordance with Article 46 of the Regulation, in particular through standard contractual clauses approved by the European Commission.
X. Information on the existence of the relevant rights of the Data Subject:
10.1. The Data Subject has, among others, the following rights, whereby:
10.1.1. Point 10.1 is without prejudice to other rights of Data Subjects.
10.1.2. The Data Subject's right of access to data under Article 15 of the Regulation, the content of which is: the right to obtain from the Controller confirmation as to whether it processes the Data Subject's personal data and, if so, to what extent. At the same time, if they are processed, the right to ascertain their content and to request from the Controller information on the reason for their processing, in particular information on: the reason for their processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations, the envisaged period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period, the existence of the right to request from the Controller rectification of personal data concerning the Data Subject or their erasure or restriction of processing, and the existence of the right to object to such processing, the right to lodge a complaint with a supervisory authority, where the personal data were not obtained from the Data Subject, any available information as to their source, the existence of automated decision-making including profiling referred to in Article 22(1) and (4) of the Regulation and, in those cases, at least meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing of personal data for the Data Subject, the appropriate safeguards under Article 46 of the Regulation relating to the personal data where the personal data are transferred to a third country or an international organisation.
10.1.3. the right to obtain a copy of the personal data undergoing processing, subject to the condition that the right to obtain a copy of the personal data processed must not adversely affect the rights and freedoms of others.
10.1.4. the Data Subject's right to rectification under Article 16 of the Regulation, the content of which is the right: to have the Controller rectify, without undue delay, inaccurate personal data concerning the Data Subject. The right to have incomplete personal data of the Data Subject completed, including by means of providing a supplementary statement by the Data Subject, the Data Subject's right to erasure of personal data (the "right to be forgotten") under Article 17 of the Regulation, the content of which is:
10.1.5. the right to obtain from the Controller the erasure of personal data concerning the Data Subject without undue delay where one of the following grounds applies: the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, the Data Subject withdraws the consent on which the processing is based, provided that there is no other legal basis for processing the personal data, the Data Subject objects to the processing of personal data under Article 21(1) of the Regulation and there are no overriding legitimate grounds for the processing of personal data, or the Data Subject objects to the processing of personal data under Article 21(2) of the Regulation, the personal data have been unlawfully processed, the personal data must be erased for compliance with a legal obligation under European Union law or the law of a Member State to which the Controller is subject, the personal data have been collected in relation to the offer of information society services under Article 8(1) of the Regulation;
10.1.6. the right to have the Controller which has made the Data Subject's personal data public, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers which are processing the personal data that the Data Subject has requested the erasure by them of any links to, or copy or replication of, those personal data, whereby the right to erasure of personal data with the content of the rights under Article 17(1) and (2) of the Regulation shall not arise to the extent that processing of the personal data is necessary:
10.1.7. for exercising the right of freedom of expression and information.
10.1.8. for compliance with a legal obligation which requires processing under European Union law or the law of a Member State to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.
10.1.9. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) of the Regulation, as well as Article 9(3) of the Regulation.
10.1.10. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes under Article 89(1) of the Regulation, in so far as the right referred to in Article 17(1) of the Regulation is likely to render impossible or seriously impair the achievement of the objectives of that processing of personal data; or for the establishment, exercise or defence of legal claims;
10.1.11. the Data Subject's right to restriction of processing of personal data under Article 18 of the Regulation, the content of which is:
10.1.12. the right to obtain from the Controller restriction of processing of personal data where one of the following applies: the accuracy of the personal data is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the personal data, the processing of personal data is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead, the Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims, the Data Subject has objected to processing under Article 21(1) of the Regulation, pending verification whether the legitimate grounds of the Controller override those of the Data Subject;
10.1.13. the right that, where processing of personal data has been restricted, such personal data processed under restriction shall, with the exception of storage, be processed only with the Data Subject's consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State;
10.1.14. the right to be informed in advance of the lifting of the restriction of processing of personal data;
10.1.15. the Data Subject's right to the fulfilment of the notification obligation towards recipients under Article 19 of the Regulation, the content of which is: the right to have the Controller communicate to each recipient to whom the personal data have been disclosed any rectification or erasure of personal data or restriction of processing carried out under Article 16, Article 17(1) and Article 18 of the Regulation, unless this proves impossible or involves disproportionate effort, the right to have the Controller inform the Data Subject about those recipients if the Data Subject requests it;
10.1.16. the Data Subject's right to data portability under Article 20 of the Regulation, the content of which is: the right to receive the personal data concerning the Data Subject which they have provided to the Controller, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the Controller, where:
a/ the processing is based on the Data Subject's consent under Article 6(1)(a) of the Regulation or Article 9(2)(a) of the Regulation, or on a contract under Article 6(1)(b) of the Regulation, and at the same time
b/ the processing is carried out by automated means, and at the same time:
10.1.17. the right to receive personal data in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the Controller shall not adversely affect the rights and freedoms of others;
10.1.18. the right to have personal data transmitted directly from one controller to another controller, where technically feasible;
10.1.19. the Data Subject's right to object under Article 21 of the Regulation, the content of which is:
10.1.20. the right to object at any time, on grounds relating to the Data Subject's particular situation, to the processing of personal data concerning them which is carried out on the basis of Article 6(1)(e) or (f) of the Regulation, including objecting to profiling based on those provisions of the Regulation;
10.1.21. where the right to object at any time, on grounds relating to the Data Subject's particular situation, to the processing of personal data concerning them which is carried out on the basis of Article 6(1)(e) or (f) of the Regulation, including objecting to profiling based on those provisions of the Regulation, is exercised, the right to have the Controller no longer process the Data Subject's personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or grounds for the establishment, exercise or defence of legal claims
10.1.22. the right to object at any time to the processing of personal data concerning the Data Subject for direct marketing purposes, including profiling to the extent that it is related to direct marketing; whereby, if the Data Subject objects to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for such purposes;
10.1.23. in the context of the use of information society services, the right to exercise the right to object to the processing of personal data by automated means using technical specifications;
10.1.24. the right to object, on grounds relating to the Data Subject's particular situation, to the processing of personal data concerning the Data Subject where the personal data are processed for scientific or historical research purposes or statistical purposes under Article 89(1) of the Regulation, except where the processing is necessary for the performance of a task carried out for reasons of public interest;
10.1.25. the Data Subject's right relating to automated individual decision-making under Article 22 of the Regulation, the content of which is:
10.1.26. the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal effects concerning the Data Subject or similarly significantly affects them, with the exception of the cases under Article 22(2) of the Regulation, i.e. with the exception of cases where the decision is: (a) necessary for entering into, or performance of, a contract between the Data Subject and the Controller, (b) authorised by European Union law or the law of a Member State to which the Controller is subject and which also lays down suitable measures to safeguard the rights and freedoms and legitimate interests of the Data Subject, or (c) based on the Data Subject's explicit consent.
XI. Information on the Data Subject's right to withdraw consent to the processing of personal data:
11.1. The Data Subject is entitled to withdraw their consent to the processing of personal data at any time, without this affecting the lawfulness of processing of personal data based on consent granted before its withdrawal.
The Data Subject is entitled to withdraw their consent to the processing of personal data at any time – in full or only in part. Partial withdrawal of consent to the processing of personal data may concern a particular type of processing operation / processing operations, whereby the lawfulness of the processing of personal data in respect of the remaining processing operations remains unaffected. Partial withdrawal of consent to the processing of personal data may concern a particular specific purpose of processing of personal data / particular specific purposes of processing of personal data, whereby the lawfulness of the processing of personal data for the other purposes remains unaffected.
The Data Subject may exercise the right to withdraw consent to the processing of personal data in paper form to the Controller's address recorded as its registered office in the commercial register at the time of withdrawal of consent to the processing of personal data, or in electronic form by electronic means (by sending an e-mail to the Controller's e-mail address stated in the identification of the Controller in this document).
XII. Information on the Data Subject's right to lodge a complaint with a supervisory authority:
12.1. The Data Subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement, if they consider that the processing of personal data concerning them infringes the Regulation, all this without prejudice to any other administrative or judicial remedy.
The Data Subject has the right to be informed by the supervisory authority with which the complaint has been lodged, as the complainant, of the progress and the outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the Regulation.
12.2. The supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Centrum II; Galvaniho 7/B; 821 04 Bratislava, Slovakia.
Tel.: + 421 2 32 31 32 14, Email: statny.dozor@pdp.gov.sk,
XIII. Information relating to automated decision-making, including profiling:
13.1. Since in the Controller's case there is no processing of the Data Subject's personal data in the form of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation, the Controller is not obliged to provide the information under Article 13(2)(f) of the Regulation, i.e. information about automated decision-making, including profiling, and about the logic involved, as well as the significance and the envisaged consequences of such processing of personal data for the Data Subject. Not applicable.
XIV. Personal data protection and the use of cookies. Information and explanation of cookies, scripts and pixels
14.1. The operator of the website provides the following brief explanation of the function of cookies, scripts and pixels:
14.1.1. Cookies are text files containing a small amount of information which are downloaded to your device when you visit a website. Thanks to this file, the website retains information about your actions and preferences for a certain period (such as login name, language, font size and other display settings), so that you do not have to re-enter them on your next visit to the website or when browsing its individual pages
A script is a piece of program code used for the correct and interactive functioning of web pages. This code runs on the operator's server or on your device.
Pixels are small, invisible pieces of text or images on a web page used to monitor website traffic. In order for this to happen, various data are stored by means of pixels.
14.1.2. Cookies are divided into
Strictly necessary cookies – ensure the proper functioning of the Controller's website and its use. These cookies are used without consent.
Functional cookies – relate to users' choices regarding the use of cookies on the website, including the options to accept, reject or customise cookie settings based on their privacy preferences.
Statistical cookies – the Controller obtains statistics on the use of its web pages. These cookies are used only with consent.
Advertising cookies – used to create advertising profiles and for similar marketing activities. These cookies are used only with consent.
14.2. How to control cookies:
14.2.1. You can control and/or delete cookies as you see fit – for details see aboutcookies.org. You can delete all cookies stored on your computer or another device, and you can set most browsers to prevent them from being stored. You can also change your preferences regarding individual cookie categories at any time directly on the Controller's website through the cookie consent management tool ("Cookies settings" in the website footer).
14.3.1. Cookies used
Strictly necessary cookies
| Cookie | Placement / duration | Description / purpose |
| cookiesRules | First party / persistent | Upgates platform cookie. Stores the Data Subject's consent settings in the website cookie bar. |
| UPGATES_PHPSESSID | First party / session | Upgates platform cookie. Ensures the correct functioning of the session (shopping cart, login, product comparison, order). |
| nette-browser | First party / session | Upgates platform cookie relating to the correct functioning of the website session. |
| visitedPopup | First party / persistent | Upgates platform cookie. Ensures the correct display of a pop-up window and prevents it from appearing repeatedly. |
Statistical cookies
| Cookie | Placement / duration | Description / purpose |
| _ga | First party / 1 year 1 month | Google Analytics cookie used to distinguish unique users by assigning a randomly generated number as a client identifier; it is used to calculate visitor, session and campaign data. |
| _ga_YLF7WFDZ8J | First party / 1 year 1 month | Google Analytics (GA4) cookie used to persist session state. |
Advertising cookies
| Cookie | Placement / duration | Description / purpose |
| _fbp | First party / 3 months | Meta Pixel cookie used by Meta to deliver advertising products based on the visit to the website. |
| VISITOR_INFO1_LIVE | Third party (YouTube) / 6 months | YouTube cookie that tracks the user's preferences for YouTube videos embedded on the website; it may also determine whether the visitor is using the new or an older version of the YouTube interface. |
| YSC | Third party (YouTube) / session | YouTube cookie used to track views of embedded videos. |
14.3.2. Cookies made available to third parties:
Google HQ. 1600 Amphitheatre Parkway. Mountain View, CA 94043, USA. Further information on privacy protection can be found at:
https://business.safety.google/privacy/
https://business.safety.google/privacy/google-services/
https://business.safety.google/privacy/display-advertising/
Google LLC, D/B/A YouTube, 901 Cherry Ave. San Bruno, CA 94066, USA. Further information on privacy protection can be found at: https://support.google.com/analytics/topic/2919631?hl=en&ref_topic=1008008
META Pixels: Facebook Ireland Ltd. 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Ireland. Further information on privacy protection can be found at: https://www.facebook.com/about/privacy/
XV. Special provisions
15.1. These Privacy Principles and Information on Personal Data Protection and Cookie Information form an inseparable part of the General Terms and Conditions and the Complaints Procedure. The documents – the General Terms and Conditions and the Complaints Procedure of this Website – are published on the domain of the Seller's Website.
XVI. Final provisions
16.1. These Privacy Principles become valid and effective upon their publication on the Seller's Website on 29.09.2026
This e-shop is certified by https://www.pravoeshopov.sk