Privacy Policy
Effective from: 26 February 2026 | Version 1.0 | Sanazia / IB products s.r.o.
Contents
- Who is the controller
- What personal data we process
- Purpose and legal basis of processing
- Retention period
- Third parties and processors
- Cookies and analytics tools
- Your rights
- Exercising your rights and contact
1. Who is the controller
The controller of your personal data within the meaning of Art. 4(7) GDPR is the company:
IB products s.r.o. (operating the Sanazia brand)
Registered office: Tomanova 19, Bratislava, Vajnory District, 831 07
IČO: 55 336 809
DIČ: 2121954483
IČ DPH: SK2121954483
Registered in the Commercial Register of the Bratislava III Municipal Court, Section: Sro, Insert No.: 168248/B
E-mail: info@sanazia.sk
IB products s.r.o. operates the e-commerce brand Sanazia, through which it sells personalised dietary supplements and vitamin programmes on the websites sanazia.sk, sanazia.cz and sanazia.com. In this document we refer to the company as "Sanazia", "we" or "us".
2. What personal data we process
We only process the personal data that is necessary to provide our services. The scope depends on which features of our website you use.
| Category | Specific data | Source |
|---|---|---|
| Identification and contact | First name, surname, e-mail address, phone number | Directly from you when registering or ordering |
| Address and billing | Delivery address, billing address, country | Directly from you when ordering |
| Transaction | Order history, subscription, payment status | Automatically on purchase |
| Personalisation (test) | Preferences, lifestyle, diet, areas of health interest | Directly from you when completing the online test |
| Communication | Content of messages with customer support | Directly from you during communication |
| Technical and analytics | IP address, browser type, device, cookies, on-site behaviour | Automatically when visiting the website |
We do not process payment data (card number, CVV) directly. This sensitive payment information is processed exclusively by the Stripe, Inc. payment gateway, which is certified to the PCI DSS standard.
3. Purpose and legal basis of processing
Each purpose of processing is tied to a specific legal basis under Art. 6 GDPR. Below is an overview of all the purposes for which we process your data.
Performance of a contract, Art. 6(1)(b) GDPR
This legal basis applies to all activities directly related to your order or contractual relationship with Sanazia. Without processing on this basis, we would not be able to provide you with our services.
| Purpose | Description |
|---|---|
| Processing your order | Accepting, confirming, packing and delivering the goods to your address. |
| Managing your subscription | Recording and managing your subscription relationship, including recurring payments and regular deliveries. |
| Customer support | Handling your questions, complaints and requests relating to orders or products. |
| Managing your customer account | Creating and managing your account on the website, including your order history. |
Consent, Art. 6(1)(a) GDPR
Based on your voluntary, freely given consent, which you may withdraw at any time, we process data for the following purposes. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.
| Purpose | Description |
|---|---|
| Personalisation (online test) | Analysing your answers from the online test (the RevenueHunt tool) in order to recommend the most suitable dietary supplements. Providing this data is voluntary. |
| E-mail marketing | Sending newsletters, news, personalised offers and business communications via the Mailchimp tool. You can withdraw your consent at any time by clicking the "Unsubscribe" link in the footer of every e-mail. |
| Marketing cookies | Using analytics and marketing cookies (Google Analytics, Meta Pixel) to measure traffic, personalise advertising and analyse its effectiveness. |
Legitimate interest, Art. 6(1)(f) GDPR
Based on our legitimate interest, we process data in cases where this interest outweighs your rights and freedoms, and where you would reasonably expect such processing.
| Purpose | Legitimate interest |
|---|---|
| Improving our services | Anonymised analysis of purchasing behaviour to optimise our range, pricing and user experience. |
| Protecting legal claims | Keeping records in case of legal disputes, debt recovery or defence in proceedings. |
| Security and fraud prevention | Detecting and preventing fraudulent transactions and misuse of our services. |
Legal obligation, Art. 6(1)(c) GDPR
We keep your billing and transaction data in accordance with the requirements of Act No. 431/2002 Z. z. on accounting and Act No. 222/2004 Z. z. on value added tax.
4. Retention period
We retain personal data only for as long as is necessary to fulfil the purpose for which it was obtained, or for as long as required by law.
| Type of data / Purpose | Retention period |
|---|---|
| Order data and customer account | For the duration of the contractual relationship and for 3 years thereafter (statute of limitations). |
| Invoices and tax records | 10 years from the end of the accounting period in which the document was issued (statutory obligation). |
| Consent to e-mail marketing | Until consent is withdrawn. After 3 years of inactivity, we may ask you to renew it. |
| Data from the online test (personalisation) | Until consent is withdrawn, but for no longer than 3 years from when it was provided. |
| Communication with customer support | 3 years from the closure of the request. |
| Analytics and marketing cookies | According to the settings of the specific tool, usually 13 months (Google Analytics) or until consent is withdrawn. |
Once the relevant retention period has elapsed, your personal data is securely deleted or anonymised, unless the law requires it to be kept for longer.
5. Third parties and processors
To ensure our services function properly, we work with verified partners, processors, who process your data on our behalf and solely on our instructions. We have a data processing agreement in place with every processor in accordance with Art. 28 GDPR.
| Partner / Tool | Purpose | Registered office |
|---|---|---|
| WordPress / WooCommerce | Operation of the e-commerce platform, management of orders and the customer account. | USA (Automattic, Inc.) |
| Stripe, Inc. | Secure processing of online payments. We do not have direct access to card payment data. | USA / Ireland (EU branch) |
| Mailchimp (Intuit Inc.) | Sending e-mail campaigns and newsletters. | USA |
| RevenueHunt | Operation of the online personalisation test and generation of product recommendations. | EU |
| Google Analytics (Google LLC) | Analysis of website traffic and user behaviour. | USA |
| Meta Pixel (Meta Platforms, Inc.) | Measuring the effectiveness of advertising campaigns on Facebook and Instagram. | USA / Ireland (EU branch) |
| Carriers (e.g. Slovenská pošta, GLS, DPD) | Delivery of your order to the address you provide. | SR / EU |
Transfer of data to third countries. Some of our partners (e.g. Mailchimp, Google, Meta) are based in the United States of America. The transfer of your personal data to the USA takes place exclusively in accordance with the GDPR, on the basis of standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR) or other appropriate safeguards. We do not sell your data to third parties for their own marketing purposes.
6. Cookies and analytics tools
Our website uses cookies, small text files stored on your device. They are used to ensure the site functions properly, analyse traffic and display relevant advertising.
| Type of cookie | Purpose | Consent |
|---|---|---|
| Necessary (functional) | Ensure the basic functions of the website: shopping basket, login, session security. Without them the website would not work properly. | Not required |
| Analytics | Help us understand how visitors use the website and improve its content. We use Google Analytics with IP address anonymisation. | Required |
| Marketing | Enable personalised advertising to be shown on other platforms (Facebook, Instagram) via Meta Pixel. | Required |
On your first visit to our website, we will ask for your consent to the use of analytics and marketing cookies via the cookie banner. Your consent is voluntary and you can change or withdraw it at any time in the cookie settings on our website.
7. Your rights
As a data subject, in connection with the processing of your personal data you have the following rights guaranteed by the GDPR. You can exercise these rights at any time, free of charge and without giving a reason (subject to the exceptions laid down by law).
Right of access (Art. 15 GDPR)
You have the right to obtain confirmation as to whether we process your personal data, and if so, to access it, including a copy of the data processed and information about how it is processed.
Right to rectification (Art. 16 GDPR)
You have the right to have inaccurate or incomplete personal data concerning you corrected without undue delay.
Right to erasure, the "right to be forgotten" (Art. 17 GDPR)
You have the right to request the erasure of your personal data, for example if the purpose for which it was processed no longer applies, you have withdrawn your consent, or you object to the processing. This right does not apply where processing is required by law.
Right to restriction of processing (Art. 18 GDPR)
You have the right to request the temporary restriction of the processing of your data, for example if you contest the accuracy of the data or you have lodged an objection to the processing.
Right to data portability (Art. 20 GDPR)
You have the right to receive the personal data you have provided to us on the basis of consent or a contract in a structured, commonly used and machine-readable format, and to transmit it to another controller.
Right to object (Art. 21 GDPR)
You have the right to object at any time to the processing of your personal data based on legitimate interest, including profiling. Once you have lodged an objection, we will stop processing your data for that purpose unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent
Where the processing of your data is based on consent, you have the right to withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.
Right to lodge a complaint with a supervisory authority
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority:
Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky)
Hraničná 12, 820 07 Bratislava 27
Tel.: +421 2 3231 3214
E-mail: statny.dozor@pdp.gov.sk
Web: www.dataprotection.gov.sk
8. Exercising your rights and contact
You can exercise your rights by sending a request to the contact details below. The request may be submitted by e-mail or in writing. We will respond to your request without undue delay, and no later than within one month of receiving it. In justified cases (due to the complexity or number of requests), we may extend this period by a further two months, of which we will inform you.
To protect your data, we reserve the right to verify your identity before dealing with your request.
IB products s.r.o. (the Sanazia brand)
Tomanova 19, Bratislava, Vajnory District, 831 07
E-mail: info@sanazia.sk
Web: www.sanazia.sk
We may update this privacy policy from time to time, for example in connection with changes in legislation or in the way we process data. We will inform you of any material changes via e-mail or a notice on the website. The date of the last update is shown at the top of this document.
© 2026 IB products s.r.o., Sanazia. All rights reserved. Version 1.0, effective from 26 February 2026.