PRIVACY POLICY

PRIVACY POLICY – myIdealSkin Effective from: 30 September 2026

1. Data Controller The Data Controller is:

Ivanna Pódová – myIdealSkin Company ID (IČO): 19246412 place of business: Počernická 387/80, 108 00 Prague 10, Czech Republic

E-mail: myidealskin@seznam.cz Phone: +420 773 909 940

hereinafter referred to as the "Controller".

The Controller processes the personal data of customers and visitors to the online store www.myidealskin.cz in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR") and other applicable legislation.

1. Personal data we process The Controller may process, in particular:

first name and surname, billing and delivery address, e-mail address, telephone number, information about orders and purchased goods, information necessary for payments and billing, information relating to a user account, the content of communications with the customer, and technical data relating to the use of the website.

The Controller does not normally receive full payment card details. Card payments are processed by the relevant payment service provider.

1. Sources of personal data The Controller obtains personal data primarily directly from the customer, for example when:

registering a user account, creating and submitting an order, communicating with the Controller, making a complaint or returning goods, subscribing to commercial communications, or using the website.

Data relating to the use of the website may also be collected through cookies and similar technologies in accordance with the visitor's consent settings.

1. Purposes and legal bases for processing Personal data is processed in particular for the following purposes:

processing an order and entering into a purchase agreement — performance of a contract and steps taken prior to entering into a contract, delivery of goods and communication regarding an order — performance of a contract, handling complaints, withdrawal from the agreement and return of goods — performance of a contract and compliance with legal obligations, accounting and tax obligations — compliance with a legal obligation, administration of a customer account — performance of a contract or the Controller's legitimate interest, protection and enforcement of legal claims — the Controller's legitimate interest, sending newsletters and marketing communications to persons who are not customers — consent, offering the Controller's own similar products or services to existing customers — legitimate interest and the relevant provisions of applicable law, analytical and marketing cookies — consent where required by law. The processing of personal data necessary to process and fulfil an order is not based on the customer's consent. Such processing is necessary for entering into and performing the purchase agreement.

1. Commercial communications The Controller may send existing customers commercial communications concerning its own similar products or services, provided that the customer has not opted out of such use of their contact details.

The customer is given a simple and free opportunity to opt out both when their contact details are obtained and in each individual commercial communication.

Commercial communications are sent to persons who are not customers only where there is an appropriate legal basis for doing so, in particular their consent.

Consent may be withdrawn at any time using the link contained in the commercial communication or by contacting the Controller at myidealskin@seznam.cz.

1. Retention period Personal data is retained only for as long as is necessary for the purpose for which it was collected.

Data relating to an order and contractual relationship is retained for the duration of the contractual relationship and thereafter for the period necessary to protect and enforce legal claims.

Accounting and tax documents are retained for the period required by applicable legislation.

Data processed on the basis of consent is processed until consent is withdrawn or until the purpose of the processing no longer applies.

Contact details used for direct marketing will no longer be used for this purpose if the customer objects to such processing or unsubscribes from commercial communications.

1. Recipients of personal data Personal data may, to the extent necessary, be disclosed to entities involved in operating the online store or fulfilling an order, in particular:

Webnode AG — operation and technical provision of the online store platform,

carriers and collection point operators according to the delivery method selected by the customer,

payment service providers and payment gateway providers,

accounting service providers,

IT, hosting and e-mail service providers,

Google, where Google Analytics or other Google services are used on the website and the visitor has provided any consent required,

public authorities where disclosure is required by applicable law.

1. Transfers of personal data outside the EU and EEA The online store uses the services of Webnode AG, which is based in Switzerland.

Where other service providers are used, personal data may in certain circumstances also be processed outside the European Economic Area.

In such cases, the Controller uses only legally permitted mechanisms for international transfers of personal data, in particular an adequacy decision or appropriate contractual safeguards.

1. Cookies The website may use technical cookies that are necessary for its proper and secure operation.

The visitor's consent is not required for the use of strictly necessary technical cookies.

Analytical, marketing and other optional cookies are used only where the visitor has provided the appropriate consent, if such consent is required by law.

Visitors must be able to reject optional cookies as easily as they can accept them and must also be able to subsequently change or withdraw their consent.

Details of the specific cookies used may be provided in the cookie settings or in a separate Cookie Policy.

1. Rights of the data subject In connection with the processing of personal data, the customer or visitor has, in particular:

the right of access to their personal data, the right to rectification of inaccurate personal data, the right to erasure where the conditions laid down by the GDPR are met, the right to restriction of processing, the right to data portability where provided for by the GDPR, the right to object to processing based on legitimate interests, the right to withdraw consent at any time where processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

The data subject may object to the processing of personal data for direct marketing purposes at any time.

These rights may be exercised by contacting:

myidealskin@seznam.cz

1. Right to lodge a complaint If a data subject believes that their personal data is being processed in breach of applicable legislation, they have the right to lodge a complaint with:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů) Pplk. Sochora 27 170 00 Prague 7 Czech Republic

Website: uoou.gov.cz

1. Requirement to provide personal data Providing personal data required for entering into and performing a purchase agreement is a contractual requirement.

Without the information necessary to process an order, arrange delivery and process payment, the order cannot be properly processed and the agreement cannot be performed.

Providing data for marketing purposes where processing is based on consent is voluntary, and refusing to provide such data does not affect the customer's ability to make a purchase.

1. Security of personal data The Controller implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or unauthorised disclosure.

Access to personal data is limited to persons and service providers who require it to perform their duties and who are subject to appropriate confidentiality or data-protection obligations.

1. Forms and online diagnostics Through forms available on the website, the Controller may process personal data voluntarily provided by a visitor, in particular their first name, surname, e-mail address, telephone number, the content of their message and other information entered in the relevant form.

In the case of forms intended for skin or scalp diagnostics, the Controller may also process photographs and information concerning the condition of the skin or scalp, cosmetic products or routines currently used, allergies, sensitivity and other information voluntarily provided by the visitor in the form.

Where the information provided contains health data or other special categories of personal data, such data is processed only on the basis of the explicit consent of the person submitting the form, for the purpose of individual assessment and recommending suitable cosmetic, hair or scalp care.

Providing such information is voluntary.

The person may withdraw their consent at any time by contacting the Controller at myidealskin@seznam.cz.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

Information obtained through a diagnostic form is retained only for as long as necessary to complete the diagnostic assessment and related communication, or for the period specified when consent was given.

Consent checkbox for the diagnostic form I consent to the processing of the information I provide in this form, including any health-related information and photographs I submit, for the purpose of an individual diagnostic assessment and recommendation of suitable care. I may withdraw my consent at any time.

1. Final provisions The Controller may update this Privacy Policy from time to time, in particular if the services used, personal data processors or applicable legislation change.

The current version will always be published on www.myidealskin.cz.

Effective from: 30 September 2026.