Privacy Policy (GDPR)

How Driada Medical Shop collects, processes, protects, and respects your personal data in compliance with the European Union General Data Protection Regulation (GDPR).

1. Data Controller Identification

The data controller responsible for processing personal data on https://driadamedicalshop.to is Driada Medical Shop. For all data protection, privacy, or GDPR inquiries, you may contact our Data Protection Desk directly at info@driadamedicalshop.to.

2. Categories of Personal Data We Collect

We adhere strictly to the GDPR principle of data minimization (Article 5(1)(c)), collecting only the data necessary to fulfill your order and provide customer support:

• Identity & Contact Data: Name, shipping address, email address, and optional telephone number for courier notifications.
• Order & Transaction Data: Products ordered, Order ID, order total in EUR (€), and payment settlement status (we never store sensitive card numbers or banking passwords).
• Technical & Session Data: Essential WooCommerce session cookies to maintain your shopping cart contents and secure your checkout session.

3. Purposes & Legal Basis for Processing (GDPR Article 6)

• Performance of a Contract (Art. 6(1)(b) GDPR): Processing your order, verifying payment, dispatching your parcel, and providing order tracking updates.
• Legal Obligations (Art. 6(1)(c) GDPR): Complying with statutory consumer protection, warranty, and accounting obligations.
• Legitimate Interests (Art. 6(1)(f) GDPR): Securing our website against fraud, abuse, and DDoS attacks, and responding to customer support tickets.
• Consent (Art. 6(1)(a) GDPR): Where you voluntarily opt into promotional communications or non-essential cookies (which you may withdraw at any time).

4. Data Sharing, Confidentiality & Security

• Zero Sale of Personal Data: We never sell, rent, trade, or disclose your personal data to third-party advertisers or data brokers.
• Logistics Partners: Your delivery name and shipping address are shared strictly with the postal/courier operator responsible for delivering your parcel.
• Technical Encryption & Retention: All transmissions are protected via 256-bit SSL/TLS encryption. Order shipping records are retained only for the period required to complete delivery, handle potential returns/reshipments, and satisfy mandatory legal retention requirements, after which they are securely anonymized or purged.

5. Your Rights Under EU GDPR (Articles 15–22)

As a data subject in the European Union / EEA, you have the following rights regarding your personal data:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure / “Right to be Forgotten” (Art. 17): Request deletion of your personal data when it is no longer necessary for the purpose collected.
• Right to Restriction & Data Portability (Arts. 18 & 20): Request restriction of processing or receive your data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing.

To exercise any of your GDPR rights, simply email info@driadamedicalshop.to. We respond to all verified data requests within 30 days (and typically within 48 hours).