1. Who controls your data
The controller of your personal data is SWISS MEDLAB LTD, registered office at 128 City Road, London EC1V 2NX, United Kingdom, registered at Companies House (England and Wales) under company number 17295411 (the “Controller”). SWISS LAB is the Controller's own brand.
For anything concerning personal data, write to bok@swiss-medlab.shop or use the contact form on the home page.
2. What we collect
- Account data — e-mail address, full name, phone number.
- Delivery data — street, postcode, town, country.
- Order data — products ordered, amounts, order status and history.
- Records of consents and declarations — when they were given and which version of the document they related to.
- Technical data — cart contents and your cookie choices stored in your browser's local storage, plus analytics data if you consent to it.
We do not collect special categories of data — in particular we never ask for health data, and we ask you not to include any in orders or messages.
3. Purposes and legal bases
- Running your account and fulfilling orders — Art. 6(1)(b) GDPR (performance of a contract). Providing this data is voluntary but necessary to conclude and perform the contract.
- Accounting and tax obligations — Art. 6(1)(c) GDPR (legal obligation).
- Handling complaints, establishing and defending claims, keeping the site secure and retaining research-use declarations — Art. 6(1)(f) GDPR (legitimate interest of the Controller).
- Marketing and newsletter — Art. 6(1)(a) GDPR (consent). Consent is voluntary and you may withdraw it at any time; withdrawal does not affect processing carried out beforehand.
4. Who we share data with
We share data only with providers we need in order to run the shop, under data-processing agreements:
- database and authentication infrastructure provider (servers in the European Union),
- application hosting provider,
- transactional e-mail provider (servers in the European Union),
- carriers and postal operators handling delivery,
- our accountants and, where needed, legal advisers.
We do not sell personal data and we do not pass it to third parties for their marketing.
5. Transfers outside the EEA
We aim to process data within the European Economic Area. The Controller is established in the United Kingdom, for which the European Commission has issued an adequacy decision. Where we use a provider that processes data outside the EEA without such a decision, the transfer relies on the European Commission's standard contractual clauses or another mechanism under Chapter V GDPR.
6. How long we keep data
- Account data — until the account is deleted.
- Order data and accounting records — for the period required by tax law.
- Records of consents and research declarations — until claims become time-barred, as evidence that they were given.
- Data processed on marketing consent — until that consent is withdrawn.
7. Your rights
You have the right to:
- access your data and receive a copy,
- have inaccurate or incomplete data corrected,
- have your data erased (the “right to be forgotten”),
- restrict processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw consent at any time — without affecting the lawfulness of earlier processing,
- lodge a complaint with the supervisory authority for your place of residence (in the UK: the Information Commissioner's Office).
To exercise these rights write to bok@swiss-medlab.shop. You can also switch marketing consent off yourself in your account panel.
8. Automated decisions
We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you.
9. Cookies
How we use cookies and similar technologies is described in our separate Cookie Policy.
10. Changes to this policy
The Controller may update this policy. We will announce material changes on the site or by e-mail. The version published on the site at the time you use it applies.