1. Who is responsible for your data

The controller of your personal data is [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. For anything to do with your data, write to info@neboka.com and put “Data protection” in the subject line.

Data protection officer, if appointed: [DPO NAME AND CONTACT, OR “not appointed”].

2. What we collect

• Account data: name, email address, password, and any preferences you save.
• Order data: what you bought, the price, the date, your billing and delivery address, your telephone number, and your order history.
• Payment data: the payment method and the result of the transaction. Card numbers are entered on our payment provider systems and never reach ours.
• Correspondence: the messages you send us and our replies.
• Technical data: IP address, browser and device type, pages visited, and the date and time of your visit. See our Cookie policy.

You are not obliged to give us any of this. But we cannot conclude or perform a sales contract without your name, address, contact details and payment details, so without them we cannot accept an order.

3. Why we use it, and on what legal basis

• To process and deliver your order, including passing your address to the carrier. Legal basis: performance of a contract, Article 6(1)(b) GDPR.
• To take payment and prevent fraud. Legal basis: performance of a contract, and our legitimate interest in not being defrauded, Article 6(1)(b) and (f).
• To keep accounting and tax records, including invoices. Legal basis: a legal obligation we are under, Article 6(1)(c).
• To answer your questions and handle complaints, returns and guarantee claims. Legal basis: performance of a contract and our legitimate interest in running a support service, Article 6(1)(b) and (f).
• To send you our newsletter, if you asked for it. Legal basis: your consent, Article 6(1)(a). You can withdraw it at any time.
• To measure how the site is used and to advertise, where you have agreed to it through the cookie banner. Legal basis: your consent, Article 6(1)(a).
• To keep the site secure and available. Legal basis: our legitimate interest in protecting the service, Article 6(1)(f).

4. Who else sees it

We do not sell your data. We share it only with parties who need it to do a job for us:

• our hosting provider, GoDaddy.com, LLC, which runs the servers this site sits on;
• our payment provider, [PAYMENT PROVIDER NAME], which processes the transaction;
• the carriers who deliver your parcel, currently [CARRIER NAMES];
• our accountants and, where the law requires it, tax and customs authorities;
• the email service we use to send order confirmations and, if you subscribed, the newsletter.

Everyone acting on our instructions is bound by a written processing agreement under Article 28 GDPR and may use your data only for the task we set them.

5. Data sent outside the European Economic Area

Our hosting provider is established in the United States, so some data is processed outside the EEA. These transfers are covered by the European Commission Standard Contractual Clauses together with additional technical safeguards. You can ask us for a copy of those clauses by writing to info@neboka.com.

6. How long we keep it

• Invoices and accounting records: for the period the tax law of [COUNTRY] requires, normally between seven and ten years. We cannot delete these earlier.
• Account data: until you close your account, then removed within thirty days except anything covered above.
• Order and guarantee records: for the duration of the legal guarantee plus the limitation period for claims.
• Support correspondence: three years from the last message.
• Newsletter: until you unsubscribe, plus a record of the unsubscribe so we do not contact you again.
• Server logs: no more than twelve months.

7. Your rights

Under the GDPR you can ask us to:

• tell you what we hold and give you a copy, Article 15;
• correct anything inaccurate, Article 16;
• delete your data where we no longer need it, Article 17;
• restrict what we do with it while a dispute is sorted out, Article 18;
• hand it over to you or another provider in a machine-readable form, Article 20;
• stop processing based on legitimate interests, by objecting under Article 21. If you object to direct marketing we must stop immediately, with no exceptions.

Where we rely on your consent, you can withdraw it at any time. That does not affect anything we did lawfully before you withdrew it.

Write to info@neboka.com and we will reply within one month. Exercising these rights is free; we may charge only for manifestly unfounded or excessive repeat requests.

8. Complaining to a regulator

If you think we are handling your data wrongly you can complain to the data protection authority of the EU country where you live, where you work, or where the problem happened. Ours is [NAME OF YOUR NATIONAL SUPERVISORY AUTHORITY]. You can also take us to court.

9. Automated decisions

We do not make decisions about you by automated means alone, and we do not profile you in a way that produces legal effects for you.

10. Children

This shop is not aimed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, tell us and we will delete it.

11. Changes

If we change how we use your data we will update this page and, where the change matters, tell you by email before it takes effect.