Privacy Policy

1. Controller

Celluro Sales OÜ, Tornimäe tn 5, Kesklinna linnaosa, 10145 Tallinn, Harju maakond, Estonia, e-mail: mrbhealthproducts@gmail.com.

This policy applies to visitors from the EU/EEA (GDPR) and Switzerland (revFADP).

2. Hosting and server logs

When you visit this website our hosting provider automatically processes technical access data (IP address, timestamp, requested page, user agent) as far as necessary to deliver and secure the site (Art. 6(1)(f) GDPR). Fonts are served from our own servers — no requests are made to Google Fonts.

3. Orders (Shopify)

Cart and checkout run on Shopify (Shopify International Ltd., Ireland). Shopify processes the data required for your order (order details, name, address, e-mail, payment data) (Art. 6(1)(b) GDPR). Payment is handled by the payment providers offered at checkout (e.g. TWINT, Klarna, credit card, Apple Pay), whose own privacy policies additionally apply.

4. Cookies and local storage

Strictly necessary storage (cart, language/currency choice, your consent decision) is used without consent (Art. 6(1)(f) GDPR). Analytics cookies are set only with your consent via our cookie banner (Art. 6(1)(a) GDPR). You can withdraw consent at any time via “Cookie settings” in the footer.

5. Google Analytics 4

With your consent we use Google Analytics 4 (Google Ireland Ltd.) with Google Consent Mode to measure how the site is used. Without consent, no analytics identifiers are stored. GA4 does not log full IP addresses. Data may be transferred to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. Retention: 14 months. You can withdraw consent at any time.

6. Reviews and contact form (Supabase)

If you submit a product review or use our contact form, the data you enter (display name, review text, message, e-mail) is stored in our database at Supabase (processor) to handle your request or display the approved review (Art. 6(1)(b) and (f) GDPR). Reviews are moderated before publication.

7. Your rights

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) GDPR
• Data portability (Art. 20) and objection (Art. 21) GDPR
• Withdrawal of consent with future effect (Art. 7(3) GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR); for Switzerland: FDPIC

To exercise your rights, e-mail mrbhealthproducts@gmail.com.

8. Retention

We keep personal data only as long as needed for the purposes above or as required by statutory retention duties (e.g. up to 10 years for order records).