Privacy policy

Last updated: 07.06.2026

1. Introduction

This Privacy Policy explains how RXC Balti OÜ, operating under the brand name Cells8, collects, uses, stores and shares personal data when you:

  • visit or use the Cells8 website;

  • place an order;

  • create or use a customer account;

  • subscribe to marketing communications;

  • contact customer support;

  • interact with our advertisements;

  • communicate with us through Facebook, Instagram or other channels.

We process personal data in accordance with the General Data Protection Regulation, applicable Estonian data protection law and other applicable privacy and electronic communications laws.

2. Data Controller

The controller responsible for the processing of your personal data is:

RXC Balti OÜ
Registry code: 14147572
Address: Rannamõisa tee 5a, 13516 Tallinn, Estonia
Email: health@cells8.com
Phone: +372 5055153

3. Personal Data We Collect

Depending on how you interact with Cells8, we may collect the following categories of personal data.

3.1. Identity and Contact Data

  • first name and surname;

  • email address;

  • phone number;

  • billing address;

  • delivery address.

3.2. Order and Transaction Data

  • products ordered;

  • order value;

  • purchase history;

  • order status;

  • delivery information;

  • payment status;

  • transaction references;

  • returns, refunds, exchanges and warranty claims.

Complete payment card or online banking details are generally processed directly by our payment service providers and are not stored by Cells8.

3.3. Account Data

Where customer accounts are available, we may process:

  • account login information;

  • saved addresses;

  • account preferences;

  • order history;

  • saved or recently viewed products.

3.4. Technical and Usage Data

When you use our website, we or our technology providers may collect:

  • IP address;

  • browser type and version;

  • device type;

  • operating system;

  • language and time-zone settings;

  • approximate location;

  • referring website or advertising campaign;

  • pages and products viewed;

  • links and buttons clicked;

  • session duration;

  • shopping-cart and checkout activity;

  • cookie identifiers and similar online identifiers;

  • technical, security and diagnostic information.

3.5. Marketing and Preference Data

We may collect:

  • newsletter and marketing subscription status;

  • cookie and privacy preferences;

  • products and content that interest you;

  • email opens, clicks and other engagement data;

  • advertising and campaign interaction data;

  • audience and customer-segment information;

  • inferred interests based on website and purchase activity, where permitted by law.

3.6. Communications and Social Media Data

When you contact us or interact with Cells8 on social media, we may process:

  • the content of your message;

  • correspondence history;

  • customer-support requests;

  • comments, reactions and public posts;

  • your social-media profile name and other information made available by the platform;

  • information provided in connection with complaints, returns or warranty claims.

4. How We Collect Personal Data

We collect personal data:

  • directly from you when you place an order, register an account, subscribe, contact us or submit information;

  • automatically through cookies, pixels, tags and similar technologies;

  • from Shopify and applications connected to our online store;

  • from payment, delivery and logistics providers;

  • from Klaviyo when managing marketing subscriptions and campaigns;

  • from Google services, including Google Analytics and Google Ads;

  • from Meta services, including Meta Pixel, Facebook and Instagram;

  • from other service providers and professional advisers where permitted by law.

5. Purposes and Legal Bases for Processing

We process personal data only where we have an appropriate legal basis.

5.1. Processing Orders and Deliveries

We use identity, contact, order and transaction data to:

  • receive and confirm orders;

  • process payments;

  • prepare and deliver products;

  • send order and delivery notifications;

  • manage returns, exchanges and refunds;

  • provide information relating to your purchase.

Legal basis: performance of a contract or taking steps at your request before entering into a contract.

5.2. Customer Support, Product Support and Warranty Claims

We process personal data to:

  • respond to questions;

  • provide product and usage support;

  • resolve delivery issues;

  • handle complaints;

  • manage defective-product and legal-guarantee claims;

  • communicate about returns and refunds.

Legal basis: performance of a contract, compliance with legal obligations and our legitimate interest in providing effective customer support.

5.3. Legal, Tax and Accounting Obligations

We process and retain relevant records to comply with:

  • accounting and tax requirements;

  • consumer-protection legislation;

  • product-safety obligations;

  • fraud-prevention requirements;

  • court orders and lawful requests from public authorities.

Legal basis: compliance with a legal obligation.

5.4. Website Operation and Shopify

Our online store is hosted and operated using Shopify.

Shopify may process personal data on our behalf in order to:

  • display and operate the online store;

  • provide shopping-cart and checkout functions;

  • host store and customer information;

  • support customer accounts;

  • process technical and security information;

  • prevent fraud and abuse;

  • provide store analytics and related platform services.

Legal basis: performance of a contract, our legitimate interest in operating a secure and functional online store, and consent where a Shopify feature uses non-essential cookies or advertising technology.

Shopify provides merchant privacy settings and tools, but Cells8 remains responsible for configuring and using the platform in accordance with applicable law.

5.5. Payments

We use Montonio Finance OÜ and relevant banking or card-processing partners to process payments.

Payment providers may process:

  • identification and contact details;

  • order amount;

  • payment method;

  • bank or card transaction information;

  • fraud-prevention and authentication information.

Legal basis: performance of a contract and compliance with legal obligations.

Payment providers may act as independent controllers for certain processing performed under financial-services, anti-fraud or regulatory obligations.

5.6. Delivery and Logistics

We use FedEx and, where necessary, other logistics providers to deliver orders.

We may share:

  • name;

  • delivery address;

  • email address;

  • phone number;

  • order and shipment details.

Legal basis: performance of a contract.

5.7. Email Marketing and Klaviyo

We use Klaviyo to manage mailing lists, customer profiles, marketing automation and email communications.

Klaviyo may process:

  • name;

  • email address;

  • phone number, where provided;

  • marketing-consent status;

  • order and purchase history;

  • browsing and shopping-cart activity;

  • products viewed;

  • email opens, clicks and other engagement;

  • customer preferences and audience segments.

We use this information to:

  • send newsletters and promotional messages;

  • provide product information and educational content;

  • send welcome, abandoned-cart or checkout communications where legally permitted;

  • personalise communications;

  • analyse campaign performance;

  • manage subscription and consent records.

Legal basis: consent and, where specifically permitted by applicable law, our legitimate interest in marketing similar products to existing customers.

You may unsubscribe at any time by using the unsubscribe link in our emails or by contacting health@cells8.com.

Klaviyo generally processes customer personal data on behalf of its business customers under contractual data-processing terms. Cells8 remains responsible for determining the purposes of its marketing activities and obtaining any required consent.

5.8. Google Analytics

We use Google Analytics to understand how visitors use our website and to improve its content, usability and performance.

Depending on your consent choices, Google Analytics may process:

  • cookie and device identifiers;

  • IP address;

  • approximate location;

  • browser and device information;

  • pages and products viewed;

  • referral and campaign information;

  • clicks and website interactions;

  • transaction and conversion data.

We use this information to:

  • analyse website traffic;

  • understand customer journeys;

  • assess website performance;

  • identify technical and usability improvements;

  • measure conversions and campaign results.

Legal basis: consent.

Google Analytics and related non-essential analytics storage are used in accordance with the consent choices submitted through our cookie banner.

5.9. Google Ads

We use Google Ads to promote Cells8 products and measure advertising performance.

Depending on your consent choices, Google may process:

  • cookie and device identifiers;

  • IP address;

  • browser and device data;

  • website visits and interactions;

  • products viewed;

  • shopping-cart, checkout and purchase events;

  • transaction value and currency;

  • advertising and campaign information.

We may use Google Ads for:

  • conversion measurement;

  • advertising attribution;

  • remarketing;

  • audience creation;

  • campaign optimisation;

  • personalised advertising.

Legal basis: consent.

For users in the European Economic Area, consent choices relating to analytics storage, advertising storage, advertising user data and personalised advertising are communicated to Google through applicable consent settings. Google states that EEA consent choices must be passed to its tags when Google services are used for behaviour measurement, remarketing or personalised advertising.

5.10. Meta Pixel, Facebook and Instagram

We use services provided by Meta Platforms, including the Meta Pixel, Facebook and Instagram.

Depending on your consent choices and your interactions, Meta may receive or process:

  • IP address;

  • browser and device information;

  • cookie and advertising identifiers;

  • pages and products viewed;

  • items added to the shopping cart;

  • checkout and purchase events;

  • transaction value and currency;

  • interactions with Cells8 advertisements;

  • interactions with our Facebook or Instagram pages;

  • information associated with your Meta account, where applicable.

We use Meta services to:

  • measure advertising conversions;

  • assess campaign effectiveness;

  • create or exclude advertising audiences;

  • retarget website visitors;

  • display relevant advertisements on Facebook and Instagram;

  • communicate with users through messages, comments and social-media features.

Legal basis: consent for Meta Pixel, audience creation, remarketing and personalised advertising; legitimate interest or steps taken at your request when responding to direct messages or public enquiries.

Meta Pixel and other non-essential Meta tracking technologies are intended to operate in accordance with the marketing-cookie choices submitted through our cookie banner.

When you interact directly with Facebook or Instagram, Meta may also process personal data for its own purposes as an independent controller under Meta’s own privacy terms.

5.11. Security and Fraud Prevention

We may use technical, account, transaction and device information to:

  • secure our website and customer accounts;

  • prevent fraud, misuse and unauthorised access;

  • detect suspicious activity;

  • investigate security incidents;

  • protect our customers, systems and legal rights.

Legal basis: our legitimate interests in operating a secure business and, where applicable, compliance with legal obligations.

6. Cookies and Similar Technologies

We use cookies, pixels, tags, local storage and similar technologies.

6.1. Strictly Necessary Technologies

These technologies are required for:

  • shopping-cart and checkout functions;

  • account login;

  • payment and transaction security;

  • fraud prevention;

  • website security;

  • remembering privacy and cookie choices;

  • technical operation of the store.

They may be used without consent where they are necessary to provide a service requested by the user.

6.2. Analytics Technologies

With your consent, analytics technologies may be used to:

  • measure website traffic;

  • understand website usage;

  • analyse user journeys;

  • measure conversions;

  • identify technical and content improvements.

These may include technologies provided by Shopify and Google Analytics.

6.3. Personalisation Technologies

With your consent, personalisation technologies may be used to:

  • remember preferences;

  • personalise website content;

  • associate activity with a customer or subscriber profile;

  • improve future website and marketing experiences.

These may include technologies used by Shopify and Klaviyo.

6.4. Marketing Technologies

With your consent, we and our partners may use marketing technologies to:

  • measure advertising performance;

  • attribute sales to campaigns;

  • create or exclude advertising audiences;

  • conduct remarketing;

  • display personalised advertisements;

  • personalise marketing communications;

  • measure engagement across websites and platforms.

These partners may include Shopify, Google, Meta and Klaviyo.

You may accept, reject or update your cookie preferences through the cookie preference tool available on our website.

Refusing or withdrawing consent does not affect the operation of strictly necessary cookies, but it may reduce personalisation and advertising measurement.

Shopify provides customer-privacy settings that can be used to manage cookie banners and privacy preferences, but use of those tools alone does not guarantee legal compliance.

7. Sharing of Personal Data

We may share personal data with:

  • Shopify, for e-commerce hosting, checkout, customer accounts, security and platform services;

  • Klaviyo, for email marketing, automation and customer-profile management;

  • Google, including Google Analytics and Google Ads, for analytics, conversion measurement and advertising;

  • Meta Platforms, including Meta Pixel, Facebook and Instagram, for advertising, audience creation, campaign measurement and social-media communication;

  • Montonio Finance OÜ, banks and card-payment providers;

  • FedEx and other delivery or logistics providers;

  • accounting, legal and professional advisers;

  • IT, hosting, security and technical-support providers;

  • insurers, auditors or fraud-prevention providers where necessary;

  • public authorities, regulators, courts or law-enforcement bodies where disclosure is required by law;

  • a purchaser or potential purchaser in connection with a lawful sale, merger or restructuring of our business.

We share only the data reasonably necessary for the relevant purpose.

Some recipients process personal data on our behalf as processors. Others may act as independent controllers where they determine their own purposes and legal obligations.

We do not sell personal data for monetary payment.

Certain uses of advertising and cross-context tracking technologies may nevertheless be treated as “sharing” or “targeted advertising” under some non-European privacy laws. Where applicable, users may exercise relevant opt-out choices through our privacy controls.

8. International Data Transfers

Some providers used by Cells8 may process or access personal data outside Estonia or outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, the transfer must be supported by a lawful safeguard, such as:

  • a European Commission adequacy decision;

  • Standard Contractual Clauses approved by the European Commission;

  • supplementary technical and organisational measures;

  • another lawful transfer mechanism available under the GDPR.

The protections of the GDPR continue to apply when personal data is transferred outside the European Union through the required legal safeguards.

You may request further information about applicable transfer safeguards by contacting health@cells8.com.

9. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy and to comply with legal obligations.

Our general retention approach is:

  • accounting, invoice and transaction records: generally 7 years or for any longer period required by law;

  • order and customer-service records: generally up to 3 years after the end of the customer relationship, unless a longer period is necessary for accounting, warranty, product-liability or legal-claim purposes;

  • warranty, return and complaint records: for the period necessary to handle the matter and establish, exercise or defend legal claims;

  • marketing subscription data: until consent is withdrawn or the data is no longer necessary;

  • suppression records: limited information may be retained to ensure that an unsubscribe or objection continues to be respected;

  • customer-account data: until the account is closed, subject to records that must be retained by law;

  • cookie, analytics and advertising data: according to the configured lifetime of the relevant cookie, tag or provider;

  • security and technical logs: for a limited period appropriate for security, fraud prevention and troubleshooting;

  • social-media messages: for as long as reasonably necessary to respond, manage the relationship or handle legal issues.

We may retain information for longer where necessary to comply with law or establish, exercise or defend legal claims.

10. Your Data Protection Rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

  • access your personal data;

  • receive information about how it is processed;

  • correct inaccurate or incomplete data;

  • request deletion of your data;

  • request restriction of processing;

  • object to processing based on legitimate interests;

  • object at any time to direct marketing;

  • receive certain data in a structured, commonly used and machine-readable format;

  • request transmission of eligible data to another controller;

  • withdraw consent at any time;

  • lodge a complaint with a supervisory authority;

  • request information about safeguards used for international transfers.

To exercise your rights, contact:

health@cells8.com

We may request reasonable information to verify your identity before completing a request.

We will respond within the period required by applicable law.

These rights are not absolute and may be limited where processing is required by law or where another lawful exception applies.

11. Marketing Choices

You may stop receiving marketing emails at any time by:

  • clicking the unsubscribe link in the email;

  • changing your communication preferences, where available;

  • contacting health@cells8.com.

Unsubscribing from marketing does not prevent us from sending service messages necessary for an order, payment, delivery, return, warranty claim or account security.

12. Withdrawal of Cookie Consent

You may update or withdraw consent for analytics, personalisation and marketing technologies through our cookie preference tool.

Withdrawal of consent does not affect the lawfulness of processing that occurred before consent was withdrawn.

Deleting browser cookies alone may not always update the consent record stored by our consent-management tool, so we recommend using the privacy-preference interface on the website.

13. Automated Processing and Profiling

We may use limited profiling to:

  • create customer and marketing segments;

  • personalise emails and advertisements;

  • predict product interests;

  • identify abandoned carts;

  • measure advertising audiences and campaign performance.

This processing does not ordinarily result in decisions based solely on automated processing that produce legal or similarly significant effects for the user.

If this changes, we will provide the information and safeguards required by law.

14. Security

We use appropriate technical and organisational measures designed to protect personal data from:

  • unauthorised access;

  • loss;

  • misuse;

  • alteration;

  • disclosure;

  • destruction.

Measures may include access restrictions, secure hosting, encryption where appropriate, account controls, backups, monitoring and contractual protections with service providers.

No online service can guarantee absolute security. Users should also protect their account credentials and devices.

15. Children’s Privacy

Our online store and products are not specifically directed at children.

We do not knowingly collect personal data directly from children who cannot validly provide consent under applicable law.

Where a parent or legal guardian believes that a child has provided data without proper authorisation, they should contact health@cells8.com.

16. Third-Party Websites and Platforms

Our website may contain links to external websites or platforms, including Facebook, Instagram and third-party payment or delivery services.

Independent third parties process data according to their own privacy policies and practices.

Cells8 is not responsible for the content or independent privacy practices of third-party websites, except to the extent that applicable law makes us responsible for a provider used to perform our obligations.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

  • changes in our business or services;

  • the addition or removal of technology providers;

  • changes in legal requirements;

  • changes in how personal data is processed.

The latest version will be published on this page together with the date of the most recent update.

Where required by law, we will provide additional notice or request new consent before materially changing consent-based processing.

18. Complaints and Supervisory Authority

Please contact us first if you have concerns about how we process your personal data.

You also have the right to submit a complaint to:

Estonian Data Protection Inspectorate
Andmekaitse Inspektsioon

You may also complain to the competent data-protection authority in the European Union country where you live, work or believe an infringement occurred.

19. Contact

For questions about this Privacy Policy or the processing of personal data, contact:

RXC Balti OÜ
Registry code: 14147572
Address: Rannamõisa tee 5a, 13516 Tallinn, Estonia
Email: health@cells8.com
Phone: +372 5055153