Privacy policy
Last updated: 23 September 2026
This Privacy Policy explains how NAZVA s. r. o. collects, uses and protects your personal data when you visit nazva.eu, create an account, place an order, submit a review or contact us. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on the protection of personal data.
1. Who is responsible for your data
The controller of your personal data is:
NAZVA s. r. o., Topoľčianska 4083/24, 851 05 Bratislava - mestská časť Petržalka, Slovak Republic, IČO 57 644 209 E-mail for privacy matters: support@nazva.eu
We have not appointed a data protection officer because we are not required to do so. You can reach the persons responsible for data protection at the e-mail address above.
2. What data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identification and contact data | name, surname, e-mail, phone number, delivery and billing address, country | you, when ordering, registering or contacting us |
| Order and transaction data | ordered products, sizes, prices, VAT, order number, delivery status, invoices, returns and refunds | generated when you order |
| Payment data | payment method, payment status, last four digits of the card, payment reference | our payment provider (we never see or store full card numbers) |
| Account data | login e-mail, password (hashed), order history, saved addresses, wishlist | you, when you create an account |
| Communication | e-mails, contact form messages, complaints, withdrawal notices | you |
| Review data | your name as you enter it, rating, review text, photos you upload, whether the purchase was verified, e-mail (not published) | you, when you submit a review |
| Marketing preferences | newsletter consent, unsubscribe status, e-mail engagement | you and our e-mail tool |
| Technical and usage data | IP address, browser and device type, language, pages viewed, referring site, cookie identifiers, approximate location | your device and cookies, see our Cookie Policy |
We do not process special categories of personal data and we do not knowingly collect data from children under 16. Our store is intended for adults.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) | Retention |
|---|---|---|
| Processing and delivering your order, handling payments, sending order and shipping confirmations | Art. 6(1)(b) - performance of a contract | duration of the contract plus limitation period (see section 7) |
| Handling returns, withdrawals, complaints and legal guarantee claims | Art. 6(1)(b) contract and Art. 6(1)(c) legal obligation | as above |
| Invoicing, accounting and tax records (including VAT / IOSS reporting) | Art. 6(1)(c) - legal obligation (Slovak Act on Accounting, VAT Act) | 10 years after the end of the accounting year |
| Customs and export formalities for shipments from Ukraine | Art. 6(1)(c) legal obligation and Art. 6(1)(b) contract | as required by customs law, at least 3 years |
| Customer account management | Art. 6(1)(b) - contract | until you delete the account or after 3 years of inactivity |
| Answering your questions and customer support | Art. 6(1)(b) contract, Art. 6(1)(f) legitimate interest in customer service | 3 years after the last contact |
| Publishing product reviews and marking verified purchases | Art. 6(1)(a) consent (submitting the review) and Art. 6(1)(f) legitimate interest in honest, verifiable reviews | while the review is published or until you ask us to remove it |
| Sending our newsletter and marketing e-mails | Art. 6(1)(a) - consent (you can withdraw it at any time via the unsubscribe link) | until you withdraw consent, then 3 years as proof of consent history |
| Sending information about similar products to existing customers by e-mail | Art. 6(1)(f) legitimate interest, with the right to object at any time (Art. 13(2) ePrivacy Directive) | until you object |
| Fraud prevention, security of the store, prevention of abuse | Art. 6(1)(f) - legitimate interest | 12 months, longer if needed for a specific case |
| Analytics, personalised advertising, social media pixels | Art. 6(1)(a) - consent given through the cookie banner | see Cookie Policy |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) - legitimate interest | limitation periods under applicable law |
Where processing is based on legitimate interest, we have assessed that your interests and rights do not override ours. You can request details of this assessment at support@nazva.eu.
Providing the data marked as mandatory at checkout is necessary to conclude and perform the contract. Without it we cannot deliver your order.
4. Automated decision-making
We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Our payment provider may carry out automated fraud screening of transactions as part of its own obligations.
5. Who receives your data
We share personal data only to the extent necessary for the purposes described above with the following categories of recipients:
Platform and hosting - Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, Ireland - e-commerce platform and hosting of the store, customer accounts, order data and e-mail notifications. Store data is stored in the European Union. Shopify acts as our processor under its Data Processing Addendum.
Payments - Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland - payment processing. Stripe acts as an independent controller for the payment transaction and as our processor for certain services.
Invoicing - Sufio s.r.o., Bottova 1, 811 09 Bratislava, Slovakia (support@sufio.com) - creation, storage and e-mail delivery of invoices and credit notes for your orders. Sufio receives your name, billing and delivery address, e-mail address and the contents and amounts of your order, and acts as our processor under its Data Processing Agreement.
Delivery and customs - Nova Post SK s. r. o. and the Nova Post / Nova Poshta network (including LLC Nova Poshta, Ukraine, and Nova Post companies in the country of delivery) - transport, customs clearance and delivery of your parcel; they receive your name, delivery address, phone number, e-mail, and the customs data required by law (description and value of goods).
Production and fulfilment in Ukraine - Individual Entrepreneur Ruslan Pchelnikov (Фізична особа-підприємець Пчельніков Руслан Сергійович), Kharkiv, Ukraine - our contracted production and fulfilment partner that prepares, packs and hands over your order to the carrier. This partner receives only the data needed to prepare and dispatch the parcel: your name, delivery address, phone number and the contents of the order. It does not receive payment data. It processes the data on our behalf under a data processing agreement.
Consent management and cookies - Consentmo GDPR Compliance, operated by iSenseLabs, Prof. Georgi Bradistilov St. 4, Sofia, Bulgaria (support@consentmo.com) - cookie consent banner and consent records.
Marketing, analytics and store applications (inventory of 2026-09-23) - Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland - Facebook & Instagram sales channel and Meta Pixel / Conversions API (browser and server events such as page views, add to cart, purchases). Used only after you consent to marketing cookies. Meta acts as a joint controller for the collection of event data and as an independent controller afterwards. - Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland - Google Analytics 4 and the Google & YouTube sales channel (statistics on how the Store is used: page views, product views, add to cart, purchases; Google Analytics 4 does not store IP addresses). Used only after you consent to statistics cookies. Google acts as our processor under the Google Ads Data Processing Terms; the data is kept in Google Analytics for 14 months. - Translate & Adapt, Search & Discovery, Bundles - first-party Shopify applications covered by the Shopify Data Processing Addendum (language preferences, search queries, product bundles). - Our own applications "Nazva Ops" and "Nazva Reviews API" (operated by NAZVA s. r. o. on servers of Hosting Ukraine LLC, Kyiv, Ukraine) - catalogue management and processing of product reviews.
Professional advisers and authorities - accountants, tax advisers, lawyers, and, where required by law, tax and customs authorities, courts, consumer protection and data protection authorities.
We do not sell your personal data.
6. International transfers
Your data is primarily stored in the European Union. Some recipients are located outside the European Economic Area:
- Ukraine (our production and fulfilment partner; parts of the Nova Post / Nova Poshta network). The European Commission has not adopted an adequacy decision for Ukraine. We transfer data on the basis of the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), supplemented by a transfer impact assessment and technical and organisational measures. Transfers to the carrier are in addition necessary for the performance of the contract with you (Art. 49(1)(b) GDPR).
- United States (certain services of Shopify, Stripe, Google and the applications listed in section 5). These transfers rely on the EU-U.S. Data Privacy Framework where the recipient is certified, or otherwise on Standard Contractual Clauses.
You can request a copy of the relevant safeguards at support@nazva.eu.
7. How long we keep your data
We keep personal data only as long as necessary for the purpose for which it was collected, as set out in section 3. In summary:
- order, invoice and payment records: 10 years after the end of the accounting year in which the order was placed (Slovak accounting and tax law);
- customer account: until deletion by you or after 3 years of inactivity;
- customer support communication: 3 years after the last contact;
- reviews: while published, or until you request removal;
- marketing consent: until withdrawn; we keep the record of your consent and withdrawal for 3 years afterwards;
- technical logs and security data: up to 12 months;
- cookie data: for the periods stated in our Cookie Policy.
After the retention period ends, we delete or anonymise the data.
8. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy;
- rectification of inaccurate or incomplete data;
- erasure ("right to be forgotten") where there is no longer a legal reason to keep the data;
- restriction of processing in the cases provided by law;
- data portability of data you provided to us, in a structured, machine-readable format;
- object to processing based on legitimate interest, and at any time to processing for direct marketing;
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
- lodge a complaint with a supervisory authority. In Slovakia this is the Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk. You may also complain to the supervisory authority of the EU country where you live or work.
To exercise your rights, write to support@nazva.eu. We respond within one month; this period can be extended by two further months for complex requests, in which case we will inform you. We may ask you to confirm your identity before we act on a request.
9. Cookies and similar technologies
We use cookies and similar technologies. Cookies that are strictly necessary for the store to function are set without consent. Analytics, personalisation and advertising cookies are set only after you give consent in our cookie banner. You can change or withdraw your choices at any time via the "Cookie settings" link in the footer of every page. Details are in our Cookie Policy.
10. Security
We use appropriate technical and organisational measures to protect your data, including TLS encryption of the store, access control, pseudonymisation where possible, and contractual obligations for our processors. Payment card data is processed only by our PCI DSS certified payment provider.
11. Changes to this policy
We may update this Privacy Policy, for example when we change our services or when the law changes. The current version is always published on nazva.eu with the date of the last update. For material changes we will inform registered customers by e-mail.
12. Contact
NAZVA s. r. o., Topoľčianska 4083/24, 851 05 Bratislava - mestská časť Petržalka, Slovak Republic support@nazva.eu
