Version: August 2026
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Mokapoko s.r.o.
Sanderova 1616/16
170 00 Praha 7 – Holešovice
Czech Republic
IČO 19938365
Authorized representative: Managing Director Helvija Balode
Email: support@sunpept.com · Phone: +420 777 173 380
We have not appointed a data protection officer because we are not legally required to do so. For data protection inquiries, you can reach us at the email address above.
2. General information on data processing
We process personal data only if this is necessary to provide the website, its content, and services, or insofar as there is a legal basis under Art. 6 GDPR.
The legal bases are in particular:
- Art. 6(1)(a) GDPR — consent (e.g., for marketing cookies)
- Art. 6(1)(b) GDPR — performance of a contract (e.g., order processing)
- Art. 6(1)(c) GDPR — legal obligation (e.g., retention obligations)
- Art. 6(1)(f) GDPR — legitimate interest (e.g., secure provision of the website)
3. Hosting & server logs
Unsere Website und unsere E-Mail-Postfächer werden bei der 1984 ehf. (1984 Hosting), Reykjavík, Island, gehostet. Island ist Mitglied des Europäischen Wirtschaftsraums (EWR); die DSGVO gilt dort unmittelbar. Beim Aufruf werden technisch bedingt folgende Daten in Server-Logs erfasst:
- IP address (truncated / short-term)
- Date and time of access
- Requested URL, HTTP status code, amount of data transferred
- Referrer URL
- User agent (browser, operating system)
Legal basis: Art. 6(1)(f) GDPR (provision, security, and stability). Deletion: after 14 days, unless security-relevant incidents require longer retention.
Mit 1984 ehf. besteht ein Auftragsverarbeitungsvertrag nach Art. 28 DSGVO.
4. Cookies & consent management (Complianz)
We use cookies and similar technologies. Technically necessary cookies (e.g., cart, session, consent storage) are set without consent on the basis of Art. 6(1)(f) GDPR. All other cookies – in particular for statistics and marketing – are set only after your active consent (Art. 6(1)(a) GDPR).
For consent management, we use the plugin Complianz (Complianz B.V., NL). Complianz stores your consent decision in a local cookie in your browser and – for documentation purposes – in anonymized form in our database. You can revoke or change your selection at any time via the “Cookie settings“ link in the footer.
5. Contacting us
If you contact us by email (support@sunpept.com) or via the contact page, we process your information (name, email, message content) to handle your inquiry. Legal basis: Art. 6(1)(b) GDPR for contract-related inquiries, otherwise Art. 6(1)(f) GDPR. Storage until the matter is finally resolved, at most for the duration of statutory retention periods.
6. Customer account & order processing (WooCommerce)
To process your order, we process the following data (WooCommerce, Automattic Inc.): first and last name, company name if applicable, billing and shipping address, email address, phone number, order contents, order history, IP address at order completion, time of RUO confirmation, payment data (see Section 8).
Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (retention obligations under tax and commercial law).
Retention period: at least 10 years in accordance with Czech and German commercial and tax law (retention of invoices, § 147 AO / § 257 HGB / cf. § 35 Czech Accounting Act).
7. RUO confirmation at checkout
As proof of the exclusively research-related purpose of the order, we store your confirmation checkbox together with a timestamp and IP address at the time of ordering. Legal basis: Art. 6(1)(c) GDPR (compliance with the HWG/AMG demarcation) and Art. 6(1)(f) GDPR (legitimate interest in preventing misuse). Stored together with the order.
8. Payment processing
Currently, we offer only prepayment by bank transfer . Payment is made via your own bank to our business account at Česká spořitelna, a.s. (Prague). In doing so, we process your name, the amount, the payment reference (order number), and the account details transmitted to us with the incoming payment. No data is passed on to other payment service providers. Legal basis: Art. 6(1)(b) and (c) GDPR.
9. Shipping service provider (Packeta / Zásilkovna)
To deliver your order, we pass on your name, delivery address, email address, and phone number to Zásilkovna s.r.o. (Packeta), Lihovarská 1060/12, 190 00 Praha 9, Czech Republic. Purpose: delivery including tracking notifications. Legal basis: Art. 6(1)(b) GDPR. Packeta privacy policy.
10. Sending emails
We send order confirmations, invoices, and other service emails via the email server of our provider ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Your email address, your name, and the content of the respective message are processed. Legal basis: Art. 6(1)(b) GDPR.
11. Review invitations (Trustpilot)
After completing your order, you may receive an email from Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen K, Denmark, inviting you to review your purchase. For this purpose, we transmit your name, email address, and order number to Trustpilot. The legal basis is our legitimate interest in customer feedback and in displaying independent reviews (Art. 6(1)(f) GDPR). You can object to this use at any time – informally by email to support@sunpept.com or via the unsubscribe link in the invitation – without incurring any costs other than the transmission costs at the basic rates. Trustpilot privacy policy.
12. Translation (TranslatePress)
For multilingual support, we use the plugin TranslatePress (Cozmoslabs, Romania). It sets technically necessary cookies for language selection. No personal data is passed on to third parties. Legal basis: Art. 6(1)(f) GDPR.
13. Server cache (Redis)
Wir setzen einen Server-seitigen Object-Cache (Redis, lokal auf unserem eigenen Hosting-Server betrieben) ein, um die Ladezeit der Seite zu beschleunigen. Es werden keine personenbezogenen Daten in verwertbarer Form persistiert; der Cache läuft ausschließlich auf dem Hosting-Server. Rechtsgrundlage: Art. 6 Abs. 1 lit. f DSGVO.
14. Your rights as a data subject
Under the GDPR, you have the following rights:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
To exercise your rights, simply send an informal message to support@sunpept.com.
15. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The authority responsible for us is:
Úřad pro ochranu osobních údajů (ÚOOÚ)
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
www.uoou.cz
Consumers from Germany may alternatively contact the state data protection authority of their place of residence or the Federal Commissioner for Data Protection and Freedom of Information (BfDI) .
16. Data transfers to third countries
Your data is currently not transferred to countries outside the EEA. Should this become necessary in the future (e.g., due to new services), it will only take place with your consent or on the basis of appropriate safeguards. In such cases, we rely on the EU-U.S. Data Privacy Framework (for certified providers) and/or standard contractual clauses pursuant to Art. 46(2)(c) GDPR. A level of protection fully equivalent to that in the EU cannot be guaranteed in all third countries.
17. Data security
The website is SSL/TLS-encrypted throughout (HTTPS). As payment is made exclusively by bank transfer, no payment data such as card or account login details are collected or stored on our website.
18. Changes to this privacy policy
We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to reflect changes to our services. The new privacy policy will then apply to your next visit.
This privacy policy was carefully prepared based on the tools currently active in the shop.