More
    Prices in:
    Registration
    Home / Privacy & Cookie Policy

    Privacy & Cookie Policy

    Privacy and Cookie Policy

    Online store www.flexitylife.eu

    Version 2026-09, effective from 1 September 2026

    This policy explains which personal data we process, why, on what legal basis, how long we keep it, who we share it with and what rights you have. Article 9 describes the cookies and similar technologies we use on the website and how you can give, manage and withdraw your consent. We follow Regulation (EU) 2016/679 (the "GDPR"), the Slovak Act No. 18/2018 Coll. on Personal Data Protection and, for cookies, Section 109 of the Slovak Act No. 452/2021 Coll. on Electronic Communications.

    1. Controller and contact

    1. The controller of your personal data is:

      flexity s.r.o.
      Ľuda Zúbka 2, 841 01 Bratislava, Slovakia
      Company ID (IČO): 35 731 389
      VAT ID: SK2021344160
      Registered in the Business Register of the Bratislava III City Court, section Sro, file no. 15884/B
      E-mail: info@flexitylife.eu
      Phone: +421 948 225 426

    2. We have not appointed a data protection officer because the law does not require us to. For any question about your personal data or to exercise your rights, write to info@flexitylife.eu or to our registered office.

    3. flexity s.r.o. runs online stores in several countries. This policy applies to the store www.flexitylife.eu.

    We process personal data only for the purposes below, and we have a legal basis for each of them.

    2.1 Processing orders and performing the contract

    Data: name, billing and delivery address, e-mail, phone number, ordered goods, payment details and order history. If you buy as a business, also your company name, company ID and VAT ID.

    Legal basis: performance of a contract and steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).

    Purpose: accepting and processing your order, concluding and performing the contract, delivering the goods, communicating about the order, and handling withdrawals and complaints.

    2.2 Accounting and tax

    Data: billing and identification details, invoice details and payment details.

    Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR), in particular under the Slovak Accounting Act No. 431/2002 Coll. and VAT Act No. 222/2004 Coll.

    Purpose: issuing and archiving invoices and accounting documents and meeting our tax and accounting obligations.

    2.3 Withdrawals and complaints

    Data: identification and contact details, product details, the content of your complaint and the bank account for a refund.

    Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR) under consumer protection law and the Civil Code, and performance of a contract (Article 6(1)(b) GDPR).

    Purpose: assessing and settling complaints, processing withdrawals and making refunds.

    2.4 Customer support

    Data: contact details, the content of your communication (e-mail, chat, phone) and related order details.

    Legal basis: performance of a contract (Article 6(1)(b) GDPR) if the communication concerns an order; otherwise our legitimate interest in answering your questions (Article 6(1)(f) GDPR).

    Purpose: answering questions and providing customer and technical support.

    2.5 Newsletter and marketing e-mails

    Data: e-mail, name, and purchase and interaction history, which we use to make the content relevant to you.

    Legal basis:

    • your consent (Article 6(1)(a) GDPR) if you subscribe to the newsletter without having bought from us;
    • our legitimate interest (Article 6(1)(f) GDPR) if you are an existing customer and we send you information about similar products (soft opt-in). You can always unsubscribe easily.

    Purpose: telling you about new products, offers and content.

    You can unsubscribe at any time and free of charge using the link in every e-mail or by writing to info@flexitylife.eu.

    2.6 Reviews

    Data: e-mail, name or nickname, the content of the review and the related order.

    Legal basis: our legitimate interest in getting feedback and showing reviews (Article 6(1)(f) GDPR). Where a separate consent is needed for the review invitation, we rely on your consent (Article 6(1)(a) GDPR).

    Purpose: collecting and showing reviews. We do not edit or delete reviews based on their rating.

    2.7 Cookies and website analytics

    Data: device and browser identifiers, cookies and similar technologies, and data on how you use the website.

    Legal basis: your consent (Article 6(1)(a) GDPR and Section 109 of Act No. 452/2021 Coll.). Strictly necessary cookies are used without consent under Section 109(8) of Act No. 452/2021 Coll.

    Purpose: running the website, measuring traffic and marketing. Details are in Article 9.

    Legal basis: our legitimate interest (Article 6(1)(f) GDPR).

    Purpose: protecting our rights, establishing, exercising or defending legal claims, and preventing fraud.

    2.9 Abandoned cart reminders

    Data: e-mail, name, the contents of the unfinished shopping cart and, where relevant, a session identifier.

    Legal basis: our legitimate interest in helping you complete a purchase you started (Article 6(1)(f) GDPR). If we send reminders on the basis of consent you gave in our marketing tool, the legal basis is your consent (Article 6(1)(a) GDPR).

    Purpose: reminding you that you left an unfinished order in the cart. You can object to this at any time and unsubscribe from the reminders.

    2.10 Preventing misuse

    Data: identification and contact details, order history including refused deliveries, and the reason for a restriction.

    Legal basis: our legitimate interest in protecting our business from repeated misuse of the store (Article 6(1)(f) GDPR), in line with Article 20 of our Terms and Conditions. Examples are repeatedly refusing deliveries without reason and abusing promotions, discount codes or returns.

    Purpose: recognising and preventing repeated misuse and restricting further orders in proportion (for example accepting only payment in advance). You can object to this processing. We will stop unless we have compelling legitimate grounds that override your interests.

    2.11 Social media profiles

    Data: your name or nickname on the social network, the content of your interaction (comments, messages, reactions) and publicly available profile data.

    Legal basis: our legitimate interest in presenting our business and communicating with the public (Article 6(1)(f) GDPR).

    Purpose: running our social media profiles (in particular Facebook and Instagram) and responding to comments and messages. For page statistics (Page Insights), we are joint controllers with the operator of the social network. Processing within the platform is also governed by the policy of that network (Meta Platforms Ireland Ltd., see Article 4).

    2.12 Competitions

    Data: name, contact details and the data needed to take part, to hand over the prize and, where required, to pay tax on it.

    Legal basis: performance of a contract (Article 6(1)(b) GDPR) for taking part and receiving the prize under the competition rules, and compliance with a legal obligation (Article 6(1)(c) GDPR) for tax obligations on prizes. We publish winners on the basis of our legitimate interest or your consent, as stated in the competition rules.

    Purpose: running the competition, contacting the winner and handing over the prize.

    3. How long we keep your data

    We keep personal data only as long as needed for the purpose:

    Purpose Retention period
    Orders and performance of the contract For the duration of the contract and then for the limitation periods, usually 3 to 4 years after the contract is performed
    Accounting and tax documents 10 years after the end of the year they relate to
    Complaints and withdrawals Until settled, then for the limitation and legal guarantee periods
    Customer support Until the question is resolved, then for a reasonable time, usually up to 12 months
    Newsletter (consent) Until you withdraw your consent or unsubscribe
    Marketing to existing customers (legitimate interest) Until you object or unsubscribe
    Reviews For as long as the review is displayed, or until you withdraw your consent
    Abandoned cart reminders Until the order is completed, otherwise usually up to 30 days after the last cart activity
    Preventing misuse For as long as needed to prevent repeated misuse, usually up to 3 years after the last incident
    Social media profiles For the duration of the interaction, or until you object or the post is removed
    Competitions For the duration of the competition and then as long as needed to hand over and tax the prize and to defend claims
    Cookies and analytics For the lifetime of each cookie stated in Article 9
    Legal claims Until the relevant limitation periods end

    When the period ends, we delete or anonymise the data securely.

    4. Who receives your data

    1. We share personal data only with recipients who need it for the purposes above. Processors act on our behalf under a data processing agreement. Other recipients act as independent controllers.
    Recipient Purpose Role
    Shoptet, a.s. (Czech Republic) E-commerce platform and hosting Processor
    BaseLinker sp. z o.o. (Poland) Order management Processor
    STORMWARE s.r.o., POHODA (Czech Republic) ERP and accounting Processor
    Zendesk, Inc. (USA) Customer support system Processor
    Chat and chatbot provider Website chat, including the AI assistant (see Article 8a) Processor
    Google Ireland Ltd. / Google LLC (Analytics, Tag Manager, Google Cloud) Analytics and measurement Processor
    Google Ireland Ltd. / Google LLC (Google Ads) Advertising and marketing Processor
    Meta Platforms Ireland Ltd. Advertising and marketing Independent controller / processor
    Ecomail.cz, s.r.o. (Czech Republic) Newsletter and e-mail reminders Processor
    Trustpilot A/S (Denmark) Customer reviews Independent controller
    Revolut Bank UAB (Lithuania) Payments by Revolut Independent controller
    Card payment provider Card payments Independent controller
    Your bank or card issuer and our bank Payments and refunds Independent controller
    DPD, DSV and DACHSER Delivery of goods Independent controller
    Pack4you s.r.o. (Na Pántoch 18, Bratislava, Slovakia) Fulfilment, shipping and processing of returns Processor
    Manufacturers who ship goods directly to you (for example Pilates equipment made to order) Production and delivery of your order Independent controller
    1. We may also disclose personal data to public authorities where the law requires it, for example to tax or customs authorities for deliveries outside the EU.
    2. We do not sell personal data.

    5. Transfers outside the EU

    1. Most processing takes place in the European Union or the European Economic Area. Some recipients may transfer data to third countries, mainly the United States.
    2. Transfers to Google, Meta and Zendesk in the United States are based on either:
      • the recipient's certification under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), or
      • standard contractual clauses under Commission Implementing Decision (EU) 2021/914, together with a transfer impact assessment and additional safeguards where needed.
    3. Ecomail processes data in the Czech Republic and the EU. Your data is not transferred to the USA through Ecomail.
    4. If you order delivery to a country outside the EU or EEA (for example Norway, Serbia or the United Kingdom), we pass your delivery details to the carrier and, where required, to customs authorities in that country. This transfer is necessary to perform the contract you asked for (Article 49(1)(b) GDPR). Norway and the United Kingdom are covered by adequacy arrangements.
    5. On request, we will send you a copy of the safeguards for a transfer. Write to info@flexitylife.eu.

    6. Your rights

    1. You have the following rights:

      • the right of access to your personal data and information about how we process it;
      • the right to have incorrect data corrected and incomplete data completed;
      • the right to erasure ("right to be forgotten") under Article 17 GDPR;
      • the right to restriction of processing under Article 18 GDPR;
      • the right to data portability for data you gave us, under Article 20 GDPR;
      • the right to object to processing based on legitimate interest, including direct marketing. If you object to direct marketing, we will stop using your data for it;
      • the right to withdraw your consent at any time, where processing is based on consent. Withdrawing consent does not affect processing carried out before you withdrew it.

    2. You can exercise your rights by e-mail to info@flexitylife.eu or by letter to our registered office. We reply without undue delay and at the latest within one month. If a request is complex, or we receive many requests, we can extend this by two further months. We will tell you about any extension and the reasons for it. Exercising your rights is free of charge.

    3. If you believe that our processing of your personal data breaches the law, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is:

      Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky)
      Hraničná 12, 820 07 Bratislava 27, Slovakia
      www.dataprotection.gov.sk

      You can also lodge a complaint with the supervisory authority in the EU member state where you live or work, or where the alleged breach took place.

    7. Whether you must give us your data

    1. The data needed to conclude and perform the purchase contract is a contractual requirement. Without it we cannot accept your order.
    2. The data needed to issue an invoice is a legal requirement under tax and accounting law.
    3. Giving data for marketing based on consent is voluntary and is not a condition of purchase.

    8. Automated decision-making and profiling

    1. We do not make automated individual decisions that have legal effects on you or similarly significantly affect you within the meaning of Article 22 GDPR.
    2. For marketing, we may carry out limited profiling. Based on your purchase and interaction history, we adapt the content of advertising and newsletters so that it is more relevant to you. This profiling has no legal effects on you. You can object at any time to processing for direct marketing, including profiling (Article 6).
    3. We do not personalise prices for individual customers.

    8a. AI in customer support

    1. The chat on our website is handled by an automated assistant (an AI system) together with a human operator. Part of a conversation may therefore be processed, and replies generated, by an AI system, and part is handled by a member of our team.
    2. In line with Article 50 of Regulation (EU) 2024/1689 (AI Act), we tell you clearly at the start of the conversation that you are communicating with an AI system. The same notice is shown in the chat window.
    3. If you want to, or if your question goes beyond what the assistant can handle, a human operator takes over. You can ask for a person at any time in the chat or by e-mail to info@flexitylife.eu.
    4. In the chat we process the content of your conversation, the contact details you give us and any related order details. The purpose and legal basis are described in Article 2.4. The provider of the chat platform and AI layer acts as our processor (Article 4).
    5. The assistant provides information and support. It does not make automated individual decisions that have legal effects on you or similarly significantly affect you (Article 8).

    9. Cookies

    9.1 What cookies are

    1. A cookie is a small text file that a website stores in your browser or device when you visit it. When you come back, the website reads the file and recognises your device or remembers some of your settings or behaviour.
    2. In this policy, "cookies" also covers similar technologies with the same function, such as pixels, local storage, session storage, SDKs and device identifiers.
    3. We use cookies so that the website works properly (for example so that your cart keeps its contents as you move between pages), to understand how the website is used, and to measure and improve our advertising. Not all cookies process personal data. Where cookie data can identify a person directly or indirectly, the GDPR applies.
    4. First-party cookies are set by the domain flexitylife.eu. Third-party cookies are set by the providers of services we use on the website (for example analytics or advertising tools). Session cookies are deleted when you close the browser. Persistent cookies remain for a set period or until you delete them.

    9.2 Categories of cookies

    Strictly necessary cookies (no consent needed). These cookies are needed for the website to work and to provide the service you asked for, for example displaying pages, logging in, keeping the cart contents, processing orders, security and remembering your cookie choice. We use them without consent under Section 109(8) of Act No. 452/2021 Coll. You cannot switch them off in the consent banner, but you can block them in your browser settings. Some parts of the website may then not work properly.

    Analytics cookies (only with consent). These help us understand how visitors use the website: which pages they visit, how they move around and where problems occur. We use this to improve content and usability. We set these cookies only with your consent.

    Marketing cookies (only with consent). These are used to target and measure advertising, to build remarketing audiences and to evaluate campaigns on our website and on third-party platforms. They may involve profiling (making assumptions about your interests). We set these cookies only with your consent.

    The legal basis for strictly necessary cookies is Section 109(8) of Act No. 452/2021 Coll. The legal basis for analytics and marketing cookies is your consent under Section 109(8) of Act No. 452/2021 Coll. and Article 6(1)(a) GDPR.

    1. On your first visit, a cookie banner appears. It offers equal buttons "Accept" and "Reject", and "Settings", where you can give consent separately for each category (analytics, marketing). Rejecting is as easy as accepting.
    2. Until you give consent, we do not store or read any cookies other than strictly necessary ones. Analytics and marketing cookies are activated only after you consent to that category. If you do not consent, or you reject cookies, the strictly necessary cookies still work and you can still shop.
    3. We use Google Consent Mode v2. Until you give consent, Google analytics and advertising tools are set to the denied state and do not use cookies that could identify you. When you give or withdraw consent, your choice is passed on to these tools immediately.
    4. You can withdraw or change your consent at any time using the "Edit cookie settings" link in the footer of every page. Withdrawing consent is as easy as giving it and does not affect processing carried out before the withdrawal.
    5. You can also manage cookies directly in your browser: block them, delete stored cookies or ask to be warned before a cookie is stored. The steps differ by browser (Chrome, Firefox, Safari, Edge and others) and are in the browser's help pages. Blocking all cookies may limit how the website works.

    The table lists the main cookies and providers. Exact cookie names, domains and lifetimes can change with the configuration of the tools. We keep the list up to date based on regular scans of the website.

    Cookie / technology Provider Purpose Category Lifetime
    PHPSESSID Shoptet, a.s. (store platform) Session identifier needed to run the store and to log in Strictly necessary Session
    Cart contents, selected currency and security token Shoptet, a.s. (store platform) Shopping process, keeping the cart and currency, protection against form misuse (CSRF) Strictly necessary Session or short period
    language Shoptet, a.s. (store platform) Remembering the selected language Strictly necessary About 1 year
    CookieConsent Shoptet, a.s. (store platform) Remembering your cookie choice Strictly necessary About 1 year
    _ga Google Ireland Ltd., Google Analytics 4 Distinguishing unique visitors Analytics (consent) 2 years
    _ga_<ID> Google Ireland Ltd., Google Analytics 4 Keeping the session state for the measurement property Analytics (consent) 2 years
    _gcl_au Google Ireland Ltd., Google Ads Measuring conversions from advertising Marketing (consent) 90 days
    _fbp Meta Platforms Ireland Ltd. Measuring and targeting advertising on Meta platforms (Facebook, Instagram), remarketing Marketing (consent) 90 days
    _fbc Meta Platforms Ireland Ltd. Storing the ad click identifier for conversion attribution Marketing (consent) 90 days

    9.5 Third-party providers and their policies

    1. If you consent to analytics or marketing cookies, the providers process the data as independent controllers or as processors under their own terms. Some providers are based outside the EU (mainly in the USA). Such transfers are based on the EU-US Data Privacy Framework or on standard contractual clauses (see Articles 4 and 5).

    2. Provider policies:

      If an address changes, you will find the current version on the provider's website.

    10. Changes to this policy

    1. We may update this policy, in particular when the law, the tools we use or the way we process data change. The current version is always available at www.flexitylife.eu/privacy-cookie-policy/.
    2. If we make significant changes to processing based on consent, we will tell you and, where needed, ask for your consent again.
    3. This version takes effect on 1 September 2026 (version 2026-09) and replaces all earlier versions of the privacy and cookie policy of the store.