Privacy Policy
Valid and effective from
Dear NOZONO customers,
It is important to us that you feel safe when using our e-shop. Protecting your personal data is therefore an important element in building the systems and procedures used within our company. These Personal Data Processing Principles (hereinafter the “Principles”) explain how we process your personal data in connection with the functionality of the website www.nozono.com (hereinafter the “website” or “e-shop”). These Principles are particularly important to you if you have placed an order for goods through the e-shop or subscribed to our newsletter.
When processing personal data, we primarily follow Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “GDPR”), Act No. 110/2019 Coll., on the Processing of Personal Data, Act No. 480/2004 Coll., on Certain Information Society Services (hereinafter the “ISS Act”), and other relevant legal regulations.
Our company is committed to continuously improving its personal data protection policy, procedures, and security system, and to reasonably innovating and refining them for this purpose. In order to ensure effective protection of personal data, we obtain and apply the latest knowledge in practice. We do not transfer or use your personal data for purposes other than those for which you knowingly provided it to us and which are consistent with these Principles. Employees of our company and other persons involved in our activities are obliged to maintain confidentiality regarding all information and documents relating to your personal data.
The data controller is:
NOZONO s.r.o.
registered office: Butovická 921, Butovice, 742 13 Studénka
Company ID No.: 22600043
VAT ID No.: CZ22600043
registered in the Commercial Register maintained by the Regional Court in Ostrava, file No. C 98739/KSOS
data box: mrkii74
e-mail: info@nozono.com
web: www.nozono.com
(hereinafter the “controller”, “seller” or “NOZONO”)
The controller has not appointed a data protection officer, as it is not required to do so under Article 37 GDPR. If you have any questions regarding the protection of your personal data, you may send them at any time to the controller’s registered office address or by e-mail to info@nozono.com.
1. What personal data is
1.1. Personal data means any information on the basis of which we can identify you, whether directly or indirectly. Personal data may therefore include, for example, your first name, surname, billing or delivery address, telephone number, e-mail address, bank account number, or IP address.
1.2. GDPR distinguishes a special category of personal data which must be handled with particular care. Special categories of personal data include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data used for the unique identification of a natural person, data concerning health, sex life, or sexual orientation. Our company has no interest in processing special categories of your personal data. If you have provided us with such data yourself (e.g. as part of an inquiry about the suitability of a food supplement in relation to your health condition), we process it solely for the purpose of handling your inquiry and delete it without undue delay after answering it, unless applicable legal regulations require us to retain it for longer.
1.3. A special regime also applies to the processing of children’s personal data. We have no interest in processing the personal data of children under 16 years of age. Our terms and conditions also include a recommendation that some food supplements are not suitable for persons under 18 years of age. Since, in connection with placing an order (taking into account the principle of data minimisation), we do not process the customer’s date of birth or age, it cannot theoretically be excluded that an order may also be placed by a minor. If you discover that a minor child has provided us with their personal data, please inform us at info@nozono.com, and we will ensure its prompt deletion unless applicable law provides otherwise.
2. Why we process personal data
2.1. Processing of personal data means any operation or set of operations performed on personal data, such as collection, recording, organisation, storage, retrieval, use, dissemination, erasure, or destruction, whether carried out by automated means or manually.
2.2. We process your personal data primarily so that we can handle your order for food supplements, longevity products, or related goods, i.e. perform the purchase contract concluded between us and you.
2.3. We also process your personal data in cases where this is required or permitted by the applicable laws of the Czech Republic, as well as in cases where there are overriding legitimate interests of the controller (or, in justified cases, also of other persons), and on the basis of your consent.
3. For what purposes and on what legal bases we process personal data
| We process your personal data on the legal basis of: | We process your personal data for the purpose of: | The personal data we process for this reason mainly includes: |
|---|---|---|
| 3.1. Pre-contractual negotiations, i.e. answering your inquiries in connection with our offer of goods [Art. 6(1)(b) GDPR] |
Handling your request for information. For this purpose, we take steps prior to entering into a contract, for example if you contact us with a question about our goods by e-mail or through the contact form. | First name, surname, e-mail address, telephone number (if provided), and the information you provide in your request. |
| 3.2. Performance of rights and obligations under the purchase contract concluded between us as controller and you as data subject [Art. 6(1)(b) GDPR] |
Performance of contractual rights and obligations. Without processing your personal data, we would not be able to handle your order, deliver the ordered goods to you, and fulfil other obligations under the terms and conditions (e.g. handle a complaint or withdrawal from the contract). | Data necessary to conclude the contract and process / deliver the order: first name and surname, e-mail address, telephone number, billing and delivery address, IBAN / bank account number (for any refund), the IP address from which the order was placed, information on whether you are a consumer or a business customer (for business customers also Company ID No., VAT ID No., registered office), the subject of the order, payment details, and delivery details. |
| 3.3. Compliance with the controller’s legal obligations [Art. 6(1)(c) GDPR] |
We must process part of your personal data because legal regulations impose this obligation on us, in particular Act No. 563/1991 Coll., on Accounting, Act No. 235/2004 Coll., on Value Added Tax, Act No. 634/1992 Coll., on Consumer Protection, and regulations governing the placing of food and food supplements on the market. | Personal data contained in accounting and tax documents (invoices, tax documents, payment details), data necessary to handle complaints or withdrawal from the contract, data for record-keeping within the meaning of the Foodstuffs and Tobacco Products Act. |
| 3.4. The controller’s overriding legitimate interest [Art. 6(1)(f) GDPR] |
In the interest of the efficient conduct of our business activities, we use the services of third parties who may process your personal data for us as processors (hereinafter “processors”). In particular, processors provide us with: (i) operation of the e-shop, hosting, and IT support (especially the Shopify platform); (ii) accounting and warehousing services; (iii) legal services; (iv) analytics and website performance measurement tools; (v) tools for managing customer reviews on our e-shop (Judge.me); (vi) targeted advertising and remarketing tools. We also carry out a limited form of customer profiling based on their purchasing behaviour for the purpose of more effective targeting of marketing communication content (e.g. product recommendations based on previously ordered food supplements). Other legitimate interests include protection against misuse of our services, fraud prevention, and ensuring the security of the e-shop. In relation to all processing operations under this point, we have carried out a so-called balancing test, the result of which was the controller’s overriding legitimate interest consisting in particular in the efficient organisation of business processes and product promotion. In particular, we took into account: the provisions of GDPR (recitals 47–49), which presume the controller’s legitimate interest in some of these operations; standard market practices in relation to the use of processors; the reasonable expectations of data subjects arising from the existence of a contractual relationship; the scope and nature of the data processed, which does not involve special category data; and the relative simplicity of terminating processing in the case of marketing operations. |
(i) platform and hosting provider (Shopify): first name and surname, e-mail address, telephone number, billing and delivery address, IP address, order details; (ii) providers of accounting / IT / legal services: data necessary for the performance of the relevant services (especially order and invoice details); (iii) analytics tool providers: pseudonymised identifier (cookie, device ID), IP address (shortened/anonymised), website behaviour data; (iv) review tool provider (Judge.me): name (or nickname), e-mail address, and review content; (v) targeted advertising service providers: pseudonymised identifier, e-mail address (hash) for the purposes of so-called custom audiences; (vi) profiling: data on the types, brands, values, and timing of purchased products; data on interaction with our newsletter (whether it was opened and which links were opened). |
| 3.5. Direct marketing of our own similar products and services to existing customers [Section 7(3) of the ISS Act] |
The ISS Act allows us to carry out direct marketing by electronic mail even without your consent if it concerns marketing of our own similar products and services, we obtained your contact details in connection with your order, and you have the option to easily and free of charge refuse such messages at any time. The option to refuse (unsubscribe) is included in every delivered marketing message. | First name, surname, e-mail address, and possibly data on previous purchases for the purpose of recommending similar products. |
| 3.6. Marketing purposes based on your consent [Art. 6(1)(a) GDPR and Section 7(2) of the ISS Act] |
Sending marketing communications about special offers, new products in the range, discount campaigns, and other marketing activities of the controller. You give your consent voluntarily (e.g. by ticking a box when subscribing to the newsletter) and you may withdraw it at any time. However, withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. | Name (or nickname), e-mail address, telephone number (if provided), preferences regarding the type of content that interests you, data on interaction with e-mail campaigns (message opening, link clicks). |
| 3.7. Cookies and similar technologies [Art. 6(1)(a) or (f) GDPR] |
Website functionality, traffic measurement, marketing, and remarketing. Details on cookies are set out in Article 10. | IP address, device / browser identifier, website behaviour data, data on goods added to the basket. |
3.8. Providing personal data is voluntary. However, if you do not provide the personal data necessary to process an order (name, delivery address, contact details, payment details), we will not be able to conclude a purchase contract with you or perform it properly. In the case of data processed on the basis of a legal obligation (e.g. data stated on tax documents), its provision is mandatory by law.
4. Who we disclose your personal data to (recipients and processors)
4.1. We disclose personal data only to those persons and to the extent necessary for the fulfilment of the controller’s legal and contractual obligations, or in accordance with the controller’s overriding legitimate interest or with your consent. At the same time, we ensure that recipients are reliable entities that comply with their legal obligations.
4.2. We have concluded a written personal data processing agreement with each processor within the meaning of Article 28 GDPR, or the processing is governed by the conditions stated directly within the terms of the given service (data processing addendum).
4.3. We transfer your personal data in particular to the following categories of recipients:
| Recipient category | Specific processor | Purpose of transfer |
|---|---|---|
| E-shop platform and hosting provider | Shopify International Ltd. (Ireland), Shopify Inc. (Canada) | Operation of the e-shop, storage of orders, customer accounts, and related data |
| Payment service providers (payment gateways) | GoPay s.r.o.; ComGate Payments, a
|