Privacy notice

Ralex Lab (KVK 42086186) is the controller for personal data processed through this shop. Questions or requests: hello@ralexlab.com.

What we collect and why

• Orders: name, email, delivery address, optional phone and gift note, and what you ordered: to deliver your order and send order emails (performance of the contract). Street, postcode, phone and gift notes are encrypted in our database.
• Payments: handled by Mollie; we receive only the payment status and method, never card or bank details.
• Invoices: kept for 7 years because Dutch tax law requires it (legal obligation).
• Account (optional): name, email, a password stored only as a strong one-way hash, and a saved delivery address if you add one: to show your orders and fill in checkout (contract). You can change or delete your account at any time.
• Newsletter: your email (and, if you give them on the pre-launch page, your first name and country), only after you confirm the subscription (consent). Unsubscribe at any time from any letter.
• Back-in-stock email: your email, to tell you once when the tracker is available again (consent). We delete it after that email.
• Withdrawals and complaints: your name, order and message: to handle your request and prove we did (legal obligation).
• Reviews: the name and city you choose to show with your review (consent); you can ask us to remove it at any time.
• Practitioner requests: the details you send us, to reply (legitimate interest).
• Security: technical logs and a one-way hash of your IP address (never the address itself) to prevent abuse and fraud (legitimate interest).

What we don't do

No tracking cookies, no analytics, no advertising pixels, no third-party scripts, no selling of data and no automated decisions about you. Our "not a robot" check runs in your browser without any third party.

Cookies

We use only the cookies the shop needs to work. They don't need your consent:

• cart: what's in your cart (30 days);
• security token: protects forms against cross-site attacks (until you close the browser);
• account session: keeps you signed in, only if you sign in (up to 30 days);
• gift note: carries your gift note to checkout, only if you order a gift (1 day);
• cookie choice: remembers what you chose in the cookie banner (6 months).

Optional analytics and marketing cookies stay off unless you allow them. We don't use any at the moment. You can change or withdraw your choice at any time in the cookie settings.

Who processes data for us

• Mollie B.V. (Netherlands): payments
• PostNL (Netherlands): shipping
• Google Ireland (Google Workspace): our mailboxes and sending emails
• Contabo (Germany): hosting

We have data processing agreements with them. Google may process data outside the EU under the EU–US Data Privacy Framework and standard contractual clauses; everything else stays in the EU.

How long we keep data

• Unpaid orders: personal data removed after 30 days.
• Customers: anonymised 3 years after the last order, unless you have an account or are subscribed to the newsletter.
• Invoices and credit notes: 7 years.
• Shipping labels: 90 days; tracking events: 30 days.
• Newsletter sign-ups that were never confirmed, or cancelled: 30 days.
• Back-in-stock requests: deleted 30 days after the email, or after a year if the tracker doesn't come back.
• Practitioner requests: 2 years.
• Accounts: until you delete them (never confirmed: 5 days).
• Technical logs: 30 days, without email or IP addresses.

Your rights

You can ask for access to, correction or deletion of your data, restriction of or objection to processing, and a copy to take elsewhere. You can withdraw consent at any time without affecting earlier processing. We reply within one month. You may also complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority.

Security

All traffic is encrypted (HTTPS). Sensitive fields are encrypted in the database, the admin area is not reachable from the public internet, and access requires a passkey or a second factor.

Earlier versions

• Version 1, 13 October 2026: First version