Privacy Policy

Wassim Sayeg and Leon Ak jointly operate Scrubs Wise and act as joint controllers of the personal data described in this policy.

Address: Ul. 29. augusta 10195/7A, 036 01 Martin, Slovakia · Email: scrubwise@gmail.com

We share responsibility for responding to privacy requests, maintaining appropriate security, reviewing service providers, and ensuring that personal data is deleted when no longer needed.

Our shared email address is the central contact point for privacy matters. The operator who receives a request coordinates its handling with the other operator. Decisions about new uses of personal data, new service providers, and retention rules are made jointly.

You may exercise your rights against either operator, regardless of our internal allocation of work. Contact us for further information about our joint-controller arrangement.

When you submit a request, we collect your full name, email address, university, selected product, colour, size, pickup location, and any optional telephone number or notes.

We use this information to respond, check availability, coordinate collection, and take steps towards a purchase at your request. Requests and their status are stored in our Convex database.

The legal basis is Article 6(1)(b) GDPR: steps requested before entering into a contract and, where applicable, performing that contract.

Fields marked as required are needed to process your request through the form. You may contact us by email if you need assistance. Optional fields may be left blank.

Submitting a product request does not subscribe you to marketing emails.

Our contact form collects your name, email address, and message. We use these to respond to your enquiry.

General enquiries are processed on the basis of our legitimate interest in responding to correspondence, under Article 6(1)(f) GDPR. Purchase-related enquiries may instead be processed under Article 6(1)(b).

Messages are delivered through our email system to our Gmail inbox. Although there is no separate contact-message database, message information can remain in email-delivery records and the mailbox.

Please do not submit health information or other sensitive information in free-text fields.

Subscription requires your email address; your first name is optional. We record your subscription status, signup source, consent timestamp, and information needed to confirm or cancel your subscription.

You must select the consent checkbox and confirm your email address before your subscription becomes active. Confirmation links expire after 24 hours.

We use this information to send Scrubs Wise updates based on your consent under Article 6(1)(a) GDPR.

Every newsletter includes an unsubscribe link. You can also withdraw consent by emailing us. Withdrawal does not affect processing that was lawful before withdrawal.

Unsubscribing stops newsletter delivery. It does not automatically delete the subscriber record.

We use hosting, database, image-delivery, and managed email services to operate the website and deliver messages.

Technical processing can include connection information, security records, and email-delivery information. Our email system retains delivery jobs and their status.

Necessary technical processing is based on our legitimate interests in providing a reliable, secure website under Article 6(1)(f) GDPR. Processing needed to deliver order-related messages also supports the purposes described in section 2.

The contact and subscription forms include a hidden anti-spam field used to discard automated submissions.

The website uses Macaly’s built-in platform analytics to understand website traffic and improve the catalogue.

Macaly provides statistics such as page views, visits, visit duration, referral sources, approximate country, browser, operating system, and device type. According to our website configuration audit, this service does not place analytics cookies or other analytics information on visitors’ devices.

We do not use Google Analytics, Meta Pixel, or advertising trackers.

Where personal data is processed for these statistics, our intended legal basis is our legitimate interest in understanding and improving website use under Article 6(1)(f) GDPR, subject to assessing the necessity of that processing and its impact on visitors.

Cookieless analytics does not necessarily mean that no personal data is processed. You may contact us for information about the processing or to object on grounds relating to your particular situation.

Our website uses the services below. Providers receive the information necessary for the services they perform. Their role may be that of a processor, subprocessor, or independent controller, depending on the service.

Our Convex database is configured in the EU West region in Ireland. Other services used to operate the website, deliver images and emails, or handle correspondence may involve processing outside the European Economic Area.

Macaly’s published privacy policy identifies possible processing in the United States, United Kingdom, and Switzerland. It states that applicable transfer arrangements may include European Commission standard contractual clauses, the EU–U.S. Data Privacy Framework where applicable, or another lawful transfer mechanism.

Our Gmail correspondence is handled through Google’s international infrastructure. Google states that it relies on applicable adequacy decisions, including the EU–U.S. Data Privacy Framework for covered transfers, and standard contractual clauses where required.

EU database hosting does not mean that all support access, email processing, or processing by service providers takes place within the EU.

Further information is available in the providers’ privacy and transfer documentation:

Macaly privacy policy

Google international-transfer information

You may contact scrubwise@gmail.com to request information about the safeguards applicable to your data, including how to obtain a copy where applicable.

We retain personal data for the purposes described in this policy and apply the following deletion schedule:

Deletion may be performed manually or automatically. We review records at least monthly to apply these rules.

If information is needed for an ongoing dispute or a legal retention obligation, we retain only the relevant records, restrict their use to that purpose, and delete them when the requirement ends.

The periods above apply to records under our control. Provider-managed security logs and backup copies follow the applicable provider retention and deletion arrangements. We request deletion through our providers where necessary; deletion from active records may not immediately remove copies from backups.

Subject to applicable conditions, you can request access, correction, deletion, restriction of processing, or data portability.

You can object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing at any time and withdraw any consent you have given.

Contact scrubwise@gmail.com to exercise your rights. You may exercise your rights against either joint controller.

You may also lodge a complaint with the Office for Personal Data Protection of the Slovak Republic: dataprotection.gov.sk/en/

We will revise this policy when our processing practices change and update the date above.