Privacy policy

What data we collect, why we need it and what you can do about it.

Last updated: 1 August 2026

Data controller

The controller of your personal data is MycoLabs Aleksandra Jarczok, ul. Gołębia 1, 43-200 Pszczyna, Poland, VAT ID PL6381623935, business register number (REGON) 243384883.
For any matter concerning personal data you can reach us at info@mycolabs.pl.

What data we process

We collect only the data we need to sell our products and to run this website:

  • Order details — your name, delivery address, a phone number for the courier and, if you want a company invoice, the company name, address and VAT ID. You send us this yourself, by e-mail.
  • Correspondence — the content of the messages you send us, together with the sender's e-mail address.
  • Technical data — IP address, browser and device type, and the referring page. These end up in server logs and visit statistics. We do not link them to your identity.

Purposes and legal bases

  • Fulfilling your order — accepting the order, shipping the goods, handling complaints. Basis: Art. 6(1)(b) GDPR (performance of a contract).
  • Tax and accounting obligations — issuing and storing invoices. Basis: Art. 6(1)(c) GDPR (legal obligation).
  • Replying to correspondence — answering questions sent by e-mail. Basis: Art. 6(1)(f) GDPR (our legitimate interest).
  • Statistics and site security — counting visits in aggregate form and protecting the site against abuse. Basis: Art. 6(1)(f) GDPR (our legitimate interest).

Cookies

This site does not store any cookies on your device and does not use browser storage (localStorage, sessionStorage) for tracking. That is why there is no cookie consent banner — there is nothing to store or read.

We measure visits with Cloudflare Web Analytics, which works without cookies and without fingerprinting. It does not build a user profile, does not track you across websites and does not let us tell that the same person has visited us again.

Who we share data with

We do not sell data and we do not share it for marketing purposes. We do, however, use providers that process data on our behalf:

  • Netlify — hosting for this site and server logs.
  • Cloudflare — visit statistics.
  • Our e-mail provider — handling correspondence and orders.
  • Courier companies — delivering your parcel (name, address, phone number).
  • Our accounting office — bookkeeping for issued invoices.

Transfers outside the EEA

Netlify and Cloudflare are based in the USA, so technical data may be processed outside the European Economic Area. This happens under the mechanisms of Chapter V GDPR — standard contractual clauses and, for providers that have joined it, the Data Privacy Framework.

How long we keep data

  • Accounting records (invoices) — 5 years from the end of the tax year in which the tax obligation arose.
  • Correspondence — for as long as we need it to handle your enquiry, and after the matter is closed until any potential claims become time-barred (as a rule 6 years, or 3 years for claims connected with business activity).
  • Server logs — kept by our hosting provider for a limited time, solely for diagnostics and to keep the site secure.
  • Visit statistics — we store no cookies, so there is no cookie expiry time here. The data reaches Cloudflare in aggregate form only and cannot be linked to a specific person or device.

Your rights

In connection with the processing of your data you have the right to:

  • access your data and receive a copy of it,
  • rectify data that is inaccurate or incomplete,
  • have your data erased where we have no basis to keep processing it,
  • restrict processing,
  • object to processing based on our legitimate interest,
  • port your data to another controller.

To exercise these rights, write to us at info@mycolabs.pl. We reply without undue delay, and within one month at the latest.

You also have the right to lodge a complaint with the supervisory authority:
President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Is providing data mandatory

Providing your data is voluntary, but without it we cannot fulfil an order or issue an invoice — to that extent it is a condition of entering into a contract. Simply browsing the site requires no data at all.

Changes to this policy

If we change how we process data — for example by adding a new tool — we will update this page and change the last-updated date shown at the top.