Privacy Policy

Effective date: 1 October 2026

Data Controller

Jelizaveta Andrejevna Jermakova, OSVČ

Vysočanská 237/101, Praha 9 – Střížkov, 190 00, Czech Republic

IČO: 24342203

Email: elizaveta@toxmetics.com

The website toxmetics.com (the “Website”) is operated by Jelizaveta Andrejevna Jermakova, a self-employed professional who uses the name Elizaveta Ermakova and the Toxmetics brand in professional communication.

Toxmetics provides professional consulting services in product safety, cosmetic and chemical legislation, regulatory documentation, packaging and related requirements for placing products on the market. Its activities also include professional training and educational activities.

External experts and independent collaborators may also participate in selected projects depending on the scope of a particular assignment.

This Privacy Policy explains what personal data we process when you use the Website, communicate with us about our services or use our services.

1. Personal data we process

We process only data that you provide to us or that is necessary for operating the Website, communication and provision of services.

a) Data you provide to us

If you contact us through a form, email, telephone or another method, we may process in particular:

· first and last name,

· email address,

· telephone number, if provided,

· company name and job title,

· billing information,

· IČO, DIČ and other information required for the business relationship,

· information contained in your message or enquiry,

· documents and other materials that you provide in connection with a specific assignment.

b) Technical data

When you visit the Website, certain technical information necessary for its operation and security may be processed automatically, for example:

· IP address,

· browser type and version,

· device type and operating system,

· information about pages visited,

· date and time of access,

· technical logs related to operation of the Website.

2. Purposes of processing personal data

We may process personal data in particular for:

· responding to questions and enquiries,

· preparing quotations,

· communication before entering into a contract,

· providing ordered services,

· project and regulatory communication,

· organising training and other professional activities,

· issuing invoices and maintaining accounting records,

· fulfilling legal obligations,

· protecting our rights and legitimate interests,

· ensuring the security and technical operation of the Website.

3. Legal basis for processing

Depending on the circumstances, we process personal data primarily on the following legal bases:

Performance of a contract or steps prior to entering into a contract

If you contact us with an enquiry or use our services, we process data necessary for communication, preparation of an offer and subsequent provision of services.

Compliance with legal obligations

We are required to retain certain data, for example due to accounting, tax or other statutory obligations.

Legitimate interests

On the basis of legitimate interests, we may process data necessary to protect our rights, keep records of business communication, secure the Website or handle potential legal claims.

Consent

Where consent is required for a particular type of processing, for example for certain marketing or analytics tools, personal data will be processed only on the basis of your consent.

You may withdraw your consent at any time.

4. Who may receive personal data

We do not sell personal data or provide it to third parties for their own marketing purposes.

To the extent necessary, data may be made available in particular to:

· web hosting and technical service providers,

· accounting or tax service providers,

· IT and other support service providers,

· external experts and collaborators involved in a specific assignment,

· public authorities where disclosure is required by law.

External collaborators receive information only to the extent necessary to carry out the specific project.

5. Retention period

We retain personal data only for as long as necessary for the purpose for which it was collected.

This will typically include, for example:

· ordinary contact enquiries and enquiries that do not result in a project: generally no longer than 12 months,

· data related to services provided: for the duration of the collaboration and subsequently for the period necessary to protect legal claims,

· billing and accounting documentation: for the period required by applicable law,

· technical logs: for the period determined by the technical infrastructure provider or for as long as necessary for Website security.

If the law requires a longer retention period, data will be retained for that period.

6. Cookies

The Website may use cookies and similar technologies necessary for its proper operation.

Strictly necessary cookies may be used without user consent where they are required for operation of the Website.

If the Website uses analytics, marketing or other cookies that require consent, they will be activated only in accordance with the user’s choice made through the cookie banner.

More detailed information about cookies used may be provided directly in the cookie banner settings.

7. Your rights

Subject to the conditions laid down by applicable law, you have the right to:

· obtain information about the processing of your personal data,

· request access to your personal data,

· request correction of inaccurate or incomplete data,

· request deletion of personal data,

· request restriction of processing,

· object to processing based on legitimate interests,

· request data portability where the statutory conditions are met,

· withdraw consent at any time where processing is based on consent.

To exercise your rights, contact us at:

elizaveta@toxmetics.com

8. Data security

We take appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or unauthorised disclosure.

Access to personal data is limited to persons who need it to perform their work or contractual duties.

9. Third-party services

For operation of the Website and provision of services, we may use third-party services, in particular:

· web hosting and web infrastructure providers,

· email service providers,

· accounting and administrative tools,

· other services necessary for business operations where applicable.

If the manner in which personal data is processed or the services used change materially, this Policy will be updated accordingly.

10. Transfers outside the European Economic Area

Some technical service providers may also process personal data outside the European Economic Area.

Where such transfers occur, they take place only where the conditions laid down by the GDPR are met, for example on the basis of an adequacy decision by the European Commission or standard contractual clauses.

11. Automated decision-making

We do not use personal data for automated individual decision-making or profiling that would produce legal or similarly significant effects for you.

12. Changes to this Policy

We may update this Privacy Policy from time to time, for example in connection with changes to our services, technologies used or legal requirements.

The current version will always be published on the Website together with the date of the latest update.