Free tracked DHL shipping

    Privacy Policy

    Privacy Policy

    We treat your personal data with the same care we apply to our products. This policy explains what we collect, why we collect it, and the rights you have under the GDPR.

    LAST UPDATED · July 2026

    1. Controller

    Enhanced Republic OÜ, Registry Code 17473323. Registered Office: Narva mnt 5, 10117 Tallinn, Estonia. European Correspondence: Emsdettener Str. 10, 48268 Greven, Germany. Contact: privacy@enhancedrepublic.com.

    2. Data we collect

    • Account data: your email, password hash, and optionally your first name, last name, and phone number.
    • Order data: shipping and billing address, items purchased, payment method, order history, and your age and research-use confirmation.
    • Technical data: IP address (used for geo-detection and, with your consent, analytics), browser and device type, and analytics events.
    • Cart data: the items in your active cart, stored via a Cart-Token in your browser localStorage.
    • Communications: emails, support tickets, and any messages you send us via email, WhatsApp, or our Telegram channel.

    3. Legal bases (Art. 6 GDPR)

    • Contract performance, for processing and shipping your orders.
    • Legal obligation, for invoice retention under Estonian accounting law and for age verification on restricted product categories.
    • Legitimate interest, for fraud prevention and service security.
    • Consent, for analytics and for marketing emails. You can withdraw consent at any time.

    4. Sharing with processors

    We share data only with processors that are strictly necessary to deliver our service. All processors are bound by Art. 28 GDPR data processing agreements:

    • Logistics: DHL, for tracked delivery across Europe.
    • Payments: NOWPayments (cryptocurrency) and our banking partner for SEPA transfers. Each has its own privacy policy governing payment data. We do not accept or store card payment data.
    • Hosting: Hetzner Online GmbH (Germany).
    • CDN and security: Cloudflare Inc. (see Section 7 regarding international transfers).
    • Email delivery: Postmark.
    • Analytics: Google Ireland Limited (Google Analytics and Google Tag Manager), used only with your consent (see Sections 7 and 8).
    • Messaging: WhatsApp (Meta Platforms Ireland Ltd.) and Telegram (Telegram Group Inc.), if you choose to contact us through those channels.
    • Mail handling: Postflex, which processes physical mail sent to our German correspondence address.
    • VAT compliance: Hellotax Global S.L. (Spain).

    5. Retention

    • Account data: until you delete your account, or after 3 years of inactivity.
    • Order and invoice data: 7 years, as required by Estonian accounting law.
    • Marketing and analytics consent: until you withdraw it.
    • Support communications: 2 years.
    • Analytics data: up to 26 months.

    6. Your rights

    Under the GDPR you have the right to access, rectify, erase, restrict, port, and object to the processing of your data. You also have the right to withdraw consent at any time for processing based on consent. To exercise any right, email privacy@enhancedrepublic.com. You may also lodge a complaint with the Estonian Data Protection Inspectorate (AKI) at aki.ee, or with your local EU data protection authority.

    7. International transfers

    Most processing takes place inside the EU and EEA. Some processors are based outside the EU or transfer data to countries outside it, notably Cloudflare Inc. and Google (United States), WhatsApp/Meta (United States), and Telegram (United Arab Emirates and British Virgin Islands). Where data is transferred outside the EU, we rely on Standard Contractual Clauses approved by the European Commission, together with additional safeguards including, where applicable, the EU-US Data Privacy Framework.

    8. Cookies, analytics, and local storage

    We use the following strictly necessary technologies for core functionality, with no consent required:

    • Session cookie for login persistence.
    • Cart-Token, stored in your browser localStorage to preserve your cart across page loads.
    • Country cache, stored in your browser localStorage for 24 hours, used for geo-based banner display.

    In addition, with your prior consent given through our cookie banner, we use Google Analytics and Google Tag Manager to understand how our site is used. These set analytics cookies and transfer data to Google (see Section 7). We do not load these until you consent, and you can withdraw consent at any time through the cookie settings on our site. We do not use third-party advertising cookies.

    9. Data security

    All data in transit is encrypted with TLS 1.3. Data at rest is encrypted on our infrastructure providers. Access to personal data is restricted to authorized personnel on a need-to-know basis. We continuously review our security practices.

    10. Automated decision-making

    We do not use automated decision-making or profiling that produces legal effects concerning you.

    11. Children's data

    Our service is intended exclusively for adults aged 18 or older. We do not knowingly collect or process personal data from minors. If you believe we have inadvertently received data from a minor, contact privacy@enhancedrepublic.com and we will delete it promptly.

    12. Newsletter

    Marketing emails are sent only to subscribers who have explicitly opted in. We use double opt-in, which means you confirm your email before being added to the list. You can unsubscribe at any time via the link in any marketing email or by contacting privacy@enhancedrepublic.com.

    13. Changes to this policy

    We may update this policy to reflect changes in our service or in legal requirements. The Last updated date at the top of this page reflects the most recent revision. Material changes will be communicated by email to account holders.