Privacy policy

Controller and contact

This policy explains how personal data is processed when you visit our online store, place an order or contact us.

Legal bases for processing

We process personal data to take steps at your request before a contract and to perform contracts under Article 6(1)(b) GDPR, to meet legal obligations under Article 6(1)(c), and on the basis of consent under Article 6(1)(a). Where we rely on legitimate interests under Article 6(1)(f), we identify those interests for the relevant processing and consider your competing rights and interests.

The GDPR applies to processing in the context of our German establishment even if you live outside the EU. Additional mandatory privacy rights in your country remain unaffected.

Store operation and technical access data

Our store runs on Shopify. Our contracting entity is Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland. Shopify provides hosting, store functionality and technical order processing.

When a page is accessed, data including the IP address, time, requested address, referrer, browser, operating system and technical errors is processed. This enables page delivery, troubleshooting and protection against misuse. The legal basis is Article 6(1)(f) GDPR and our interest in a secure, functional store. Contract-related data is processed for technical order fulfilment under Article 6(1)(b).

Where Shopify processes data on our behalf, the Shopify Data Processing Addendum applies. Shopify affiliates and subprocessors outside the EEA may be involved. See “International data transfers” below.

Orders, delivery and claims

For orders, we process your name, billing and delivery addresses, contact details, ordered items, prices, payment status and order history. This is necessary to enter into the sale, allocate payments, deliver jewellery and handle returns, refunds and warranty claims under Article 6(1)(b) GDPR. We cannot fulfil your order without the required information.

We also receive order-related status information from payment and delivery services. The carrier receives the recipient and shipment details needed for delivery. Contact details are shared only where necessary for that delivery or where you have consented to additional notifications.

If you send photographs of jewellery to support a complaint or colour warranty claim, we process them with your order and contact details to handle the claim. Please photograph only the affected product where possible. We do not use these photographs for advertising without a separate legal basis.

We process necessary records and transaction data for accounting and tax obligations under Article 6(1)(c) GDPR. Necessary data may be provided to tax advisers, competent authorities and, in disputes, legal advisers. Establishing or defending claims and investigating specific suspected fraud is based on Article 6(1)(f) and our interests in protecting our rights and preventing misuse.

Payment processing

Depending on your selected payment method, the payment provider and participating banks process identification, contact, billing, payment and transaction data. Our disclosure to execute your payment is based on Article 6(1)(b) GDPR. Available payment methods are shown at checkout.

Shopify Payments: The provider is Shopify International Limited, Ireland. Payment processors and banking partners participate in processing. See the Shopify Payments terms and Shopify Consumer Privacy Policy.

PayPal: For EEA customers, the provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal acts as an independent controller, including for payments, fraud prevention and legal obligations. Certain payment products may involve identity and credit checks. See the PayPal Privacy Statement.

Klarna: The provider is Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna acts as an independent controller. Certain payment methods involve identity and credit checks, including credit reference agencies. Decisions about payment eligibility may be automated. See Klarna’s privacy information for data sources, decision processes, retention and your rights.

Contacting us

When you contact us, we process your contact details, message and information needed to deal with your request. Article 6(1)(b) GDPR applies to enquiries about an order or a potential purchase. Other enquiries are processed under Article 6(1)(f), based on our interest in responding appropriately and documenting communications.

Cookies, consent and withdrawal

Cookies or similar storage technologies may be used for strictly necessary functions such as the cart and checkout. Device access is then based on Section 25(2) TDDDG; subsequent processing of personal data is based on Article 6(1)(b) or (f) GDPR, depending on the purpose.

Non-essential analytics and advertising technologies require prior consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw consent at any time for the future. Withdrawal does not affect processing lawfully carried out before withdrawal. You can contact us at info@nuralea.com.

Your consent choice and necessary evidence are processed to implement your choice and demonstrate compliance, in particular under Article 6(1)(c) together with Article 7(1) GDPR.

Google Analytics

We use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand use of our store. With your consent, page views, interactions, purchases, approximate location, device and browser data and pseudonymous identifiers are processed to produce usage statistics and improve the store. The legal basis is Article 6(1)(a) GDPR, together with Section 25(1) TDDDG for relevant device access.

Google processes analytics data on our behalf. According to Google, IP addresses of users in the EU, Switzerland and UK are discarded before logging. This does not automatically make other collected data anonymous. Google LLC in the USA may process data.

See Google’s Privacy Policy and its information on partner websites. You may withdraw consent for the future.

Meta Pixel

We use Meta Pixel, provided by Meta Platforms Ireland Limited, Ireland. Following your consent, visited pages, viewed products, cart and purchase events, IP address, browser data and identifiers are sent to Meta. This measures our Facebook and Instagram advertising and supports audiences for interest-based advertising. Meta may associate the data with an existing user account. The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG for device access.

We and Meta are joint controllers under Article 26 GDPR for the collection and transmission of the relevant event data. Responsibilities are allocated in the Meta controller agreement. You may exercise rights with us or Meta. Meta is responsible for its subsequent processing. Transfers to the USA may occur. See the Meta Privacy Policy for processing and retention information.

International data transfers

The services described may process personal data outside the EEA, in particular in Canada and the USA. Besides a legal basis, transfers must meet Articles 44 et seq. GDPR, such as an applicable adequacy decision or appropriate safeguards including EU Standard Contractual Clauses, supplemented by additional safeguards where necessary.

The Canadian adequacy decision applies only within its scope. The EU-US Data Privacy Framework supports transfers only where the particular US recipient has valid certification covering the processing. It does not authorise every transfer to the USA. You may request information and a copy of the safeguards applicable to a specific transfer from us, subject to protecting third-party rights.

Retention

We delete or anonymise personal data when no longer needed for its purpose and no legal retention requirement or other legal basis remains. Enquiries are deleted once resolved and any necessary evidence purposes cease. Limited retention until the relevant limitation period expires may be necessary for potential claims.

Tax-relevant accounting vouchers generally require eight years of retention, certain business correspondence six years, and books and certain financial records ten years. The applicable law determines the start and any extension of these periods. A lifetime colour warranty does not mean all customer data is stored for life.

Withdrawal ends future processing based on consent. Further retention requires another valid legal basis, such as necessary evidence of consent. Technical logs are needed only as long as required for operation, troubleshooting and security; relevant data may be retained longer to investigate specific incidents.

Your rights

Subject to the legal conditions, you have rights of access, rectification, erasure, restriction and data portability under Articles 15 to 20 GDPR. You may withdraw consent at any time for the future.

Objection: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. We then stop processing unless compelling legitimate grounds override your interests or processing is necessary for legal claims. You may object to direct marketing and related profiling at any time without giving reasons; affected data will no longer be processed for those purposes.

Contact info@nuralea.com. Where we have reasonable doubts about identity, we may request additional information necessary to verify it. We generally respond within one month and explain any legally permitted extension.

You may also complain to a supervisory authority, particularly where you live, work or believe an infringement occurred. The authority for our establishment is the Hamburg Commissioner for Data Protection and Freedom of Information.

Changes to this policy

We update this policy when processing activities or legal requirements change. Simply using our website, or an update to this policy, does not replace any required consent.