Privacy Policy
Effective and valid as of
Dear NOZONO customers,
it is important to us that you feel safe while using our e-shop. The protection of your personal data is therefore a significant element in building the systems and procedures used within our company. This Privacy Policy (hereinafter the "Policy") explains how we process your personal data in connection with the functionalities of the website www.nozono.com (hereinafter the "website" or "e-shop"). This Policy is particularly important for you if you have placed an order for goods through the e-shop or registered to receive our newsletter.
When processing personal data, we are governed primarily by Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter "GDPR"), Act No. 110/2019 Coll., on the Processing of Personal Data, Act No. 480/2004 Coll., on Certain Information Society Services (hereinafter the "Information Society Services Act"), and other applicable legal regulations.
Our company is committed to continuously improving its data protection policy, procedures, and security system, and to appropriately innovating and enhancing them for this purpose. In our effort to ensure effective protection of personal data, we acquire and apply the latest knowledge in practice. We do not transfer or use your personal data for any purposes other than those for which you knowingly provided them and which are consistent with this Policy. Our company's employees and other persons involved in our activities are obliged to maintain confidentiality regarding all information and documents relating to your personal data.
The data controller is:
NOZONO s.r.o.
with its registered office at Butovická 921, Butovice, 742 13 Studénka, Czech Republic
Company ID (IČO): 22600043
VAT ID (DIČ): CZ22600043
registered in the Commercial Register maintained by the Regional Court in Ostrava, File No. C 98739/KSOS
data box ID: mrkii74
e-mail: info@nozono.com
website: www.nozono.com
(hereinafter the "controller", "seller", or "NOZONO")
The controller has not appointed a data protection officer, as this obligation does not arise for it under Art. 37 GDPR. If you have any questions regarding the protection of your personal data, you may send them at any time to the controller's registered office address or to the e-mail address info@nozono.com.
1. What is personal data
1.1. Personal data means any data that can be used to identify you, whether directly or indirectly. Personal data may thus include, for example, name, surname, billing or delivery address, telephone number, e-mail address, bank account number, or IP address.
1.2. The GDPR distinguishes a special category of personal data that must be treated with extraordinary sensitivity. This special category of personal data includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data used to uniquely identify a natural person, data concerning health, sex life, or sexual orientation. Our company has no interest in processing special categories of your personal data. If you have provided us with such data yourself (e.g. as part of a query about the suitability of a dietary supplement in relation to your health condition), we process it exclusively for the purpose of handling your query and, once it has been answered, delete it without undue delay, unless applicable legal regulations require us to retain it for longer.
1.3. A special regime also applies to the processing of children's personal data. We have no interest in processing the personal data of children under 16 years of age. Our terms and conditions also state a recommendation that some dietary supplements are not suitable for persons under 18 years of age. Given that, in connection with placing an order (and in keeping with the principle of data minimisation), we do not process the date of birth or age of the customer, it cannot theoretically be ruled out that an order may be placed by a minor. If you discover that a minor child has provided us with their personal data, please inform us at info@nozono.com, and we will ensure it is promptly deleted, unless applicable law provides otherwise.
2. Why we process personal data
2.1. Processing of personal data means any operation or set of operations performed with personal data, such as their collection, recording, organisation, storage, retrieval, use, dissemination, erasure, or destruction, whether carried out automatically or manually.
2.2. We process your personal data primarily so that we can fulfil your order for dietary supplements, longevity products, or related goods, i.e. to perform the purchase contract concluded between us and you.
2.3. We also process your personal data in cases where this is required or permitted by the applicable legal order of the Czech Republic, further in cases where the controller (or, in justified cases, other persons) has overriding legitimate interests, and on the basis of consent granted by you.
3. For what purposes and on what legal grounds we process personal data
| We process your personal data on the following legal basis: | We process your personal data for the purpose of: | The personal data we process for this reason are in particular: |
|---|---|---|
| 3.1. Pre-contractual negotiations, i.e. answering your questions in connection with our offer of goods [Art. 6(1)(b) GDPR] |
Handling your request for information. For this purpose we take steps prior to entering into a contract, e.g. if you contact us with a question about our goods via e-mail or a contact form. | First name, surname, e-mail address, telephone number (if you provide it), and the data you yourself state in your request. |
| 3.2. Performance of rights and obligations arising from the purchase contract concluded between us as controller and you as the data subject [Art. 6(1)(b) GDPR] |
Performance of contractual rights and obligations. Without processing your personal data we would not be able to process your order, deliver the ordered goods to you, and fulfil other obligations under the terms and conditions (e.g. handle a complaint or a withdrawal from the contract). | Data necessary to conclude the contract and process/deliver the order: first name and surname, e-mail address, telephone number, billing and delivery address, IBAN / bank account number (for any refunds), the IP address from which the order was placed, whether you are a consumer or a business (for businesses, also company ID, VAT ID, registered office), the subject of the order, and data on payment and delivery. |
| 3.3. Compliance with the controller's legal obligations [Art. 6(1)(c) GDPR] |
We must process part of the personal data because this obligation is imposed on us by legal regulations, in particular Act No. 563/1991 Coll., on Accounting, Act No. 235/2004 Coll., on Value Added Tax, Act No. 634/1992 Coll., on Consumer Protection, and regulations governing the placing of food and dietary supplements on the market. | Personal data contained in accounting and tax documents (invoices, tax documents, payment data), data necessary for processing a complaint or withdrawal from the contract, data for record-keeping within the meaning of the act on food and tobacco products. |
| 3.4. The controller's overriding legitimate interest [Art. 6(1)(f) GDPR] |
In the interest of efficiently carrying out our business activities, we use the services of third parties who may process your personal data as processors (hereinafter "processors"). Processors provide us in particular with: (i) e-shop operation, hosting, and IT support (in particular the Shopify platform); (ii) accounting and warehouse services; (iii) legal services; (iv) analytics and web performance measurement tools; (v) tools for managing customer reviews on our e-shop (Judge.me); (vi) tools for targeted advertising and remarketing. We also carry out a limited form of customer profiling based on their purchasing behaviour in order to target marketing communication content more effectively (e.g. product recommendations based on previously ordered dietary supplements). Other legitimate interests include protection against misuse of our services, fraud prevention, and ensuring the security of the e-shop. With regard to all processing operations under this point, we have carried out a so-called balancing test, the result of which was the controller's overriding legitimate interest, consisting in particular in the efficient organisation of business processes and promotion of products. We took into account in particular: the provisions of the GDPR (recitals 47–49), which presuppose a legitimate interest of the controller for some of these operations; standard market practices in relation to the use of processors; the reasonable expectations of data subjects arising from the existence of a contractual relationship; the scope and nature of the data processed, which are not special category data; and the relative ease of terminating processing in the case of marketing operations. |
(i) provider of the platform and hosting (Shopify): first name and surname, e-mail address, telephone number, billing and delivery address, IP address, order data; (ii) providers of accounting / IT / legal services: data necessary for the performance of the relevant services (in particular order and invoice data); (iii) providers of analytics tools: pseudonymised identifier (cookie, device ID), IP address (shortened/anonymised), data on website behaviour; (iv) providers of the review tool (Judge.me): name (or nickname), e-mail address, and the content of the review; (v) providers of targeted advertising services: pseudonymised identifier, e-mail address (hashed) for the purpose of so-called custom audiences; (vi) profiling: data on the type, brand, value, and time of purchased products; data on interaction with our newsletter (whether it was opened and which links were clicked). |
| 3.5. Direct marketing of the controller's own similar products and services to existing customers [Sec. 7(3) of the Information Society Services Act] |
The Information Society Services Act allows us to carry out direct marketing by electronic mail even without your consent, provided it concerns marketing of our own similar products and services, we obtained your contact details in connection with your order, and you have the option to easily and free of charge refuse the sending of such messages at any time. The option to refuse (unsubscribe) is included in every marketing message you receive. | First name, surname, e-mail address, and, where applicable, data on previous purchases for the purpose of recommending similar products. |
| 3.6. Marketing purposes based on your consent [Art. 6(1)(a) GDPR and Sec. 7(2) of the Information Society Services Act] |
Sending marketing communications about promotional offers, new products in the range, discount campaigns, and other marketing activities of the controller. You grant consent voluntarily (e.g. by ticking a box when registering for the newsletter) and may withdraw it at any time. However, withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. | Name (or nickname), e-mail address, telephone number (if you provide it), preferences regarding the type of content that interests you, data on interaction with e-mail campaigns (message opens, link clicks). |
| 3.7. Cookies and similar technologies [Art. 6(1)(a) or (f) GDPR] |
Website functionality, traffic measurement, marketing, and remarketing. Details on cookies are set out in Article 10. | IP address, device/browser identifier, data on behaviour on the website, data on goods added to the cart. |
3.8. The provision of personal data is voluntary. However, if you do not provide the personal data necessary to process your order (name, delivery address, contact details, payment details), we will not be able to conclude, or duly perform, the purchase contract with you. In the case of data processed on the basis of a legal obligation (e.g. data stated on tax documents), their provision is mandatory under the law.
4. Who we disclose your personal data to (recipients and processors)
4.1. We disclose personal data only to those persons and to the extent necessary for the performance of the controller's legal and contractual obligations, or in accordance with the controller's overriding legitimate interest or with your consent. At the same time, we take care to ensure that recipients are reliable entities that comply with their legal obligations.
4.2. We have a written data processing agreement in place with each processor within the meaning of Art. 28 GDPR, or the processing is governed by conditions set out directly within the terms of the relevant service (a data processing addendum).
4.3. We transfer your personal data in particular to the following categories of recipients:
| Category of recipient | Specific processor | Purpose of transfer |
|---|---|---|
| Provider of the e-shop platform and hosting | Shopify International Ltd. (Ireland), Shopify Inc. (Canada) | Operation of the e-shop, storage of orders, customer accounts, and related data |
| Payment service providers (payment gateways) | GoPay s.r.o.; ComGate Payments, a.s.; Stripe Payments Europe Ltd. (Ireland) | Processing of payments by payment card, Apple Pay, Google Pay; fraud protection |
| Carriers | Zásilkovna s.r.o. (Packeta); PPL CZ s.r.o.; General Logistics Systems Czech Republic s.r.o. (GLS) | Delivery of goods to the address or pick-up point chosen by the buyer |
| E-mail marketing and automation tool | Klaviyo, Inc. (USA) | Sending the newsletter, transactional e-mails, and marketing automation |
| Customer review management tool | Judge.me (EasyCommerce Inc. / Judge.me Ltd.) | Collecting and displaying reviews for specific products directly on the e-shop |
| Analytics tools | Google Ireland Limited (Google Analytics 4) | Traffic measurement, analysis of user behaviour, website optimisation |
| Targeted advertising and remarketing tools | Google Ireland Limited (Google Ads); Meta Platforms Ireland Limited (Facebook / Instagram, Meta Pixel) | Targeted and remarketing advertising, conversion measurement, creation of custom audiences based on hashed identifiers |
| Accounting services provider | The controller's contracted accounting firm | Bookkeeping, processing of tax documents |
| Legal services provider | The controller's contracted law firm | Legal advice, representation in disputes, debt recovery |
| Public authorities | Tax Authority, Czech Trade Inspection Authority, Office for Personal Data Protection, courts, law enforcement authorities | Fulfilment of the controller's legal obligations, or the justified requests of these authorities |
4.4. We will provide you with an updated list of processors upon your request at the e-mail address info@nozono.com.
4.5. Please note that if you visit our profiles on social networks (in particular Facebook and Instagram, operated by Meta Platforms Ireland Limited, or YouTube, operated by Google Ireland Limited), these companies also process your personal data in accordance with their own privacy policies and your settings on the respective social network and browser. The controller has no influence over these circumstances. If you are interested in the information we publish on social networks but do not wish your personal data to be processed in this way, please contact us directly and we will provide you with the content in a different form.
5. To which countries we transfer your personal data
5.1. Within our processing operations we primarily use partners located in the European Economic Area (EEA, i.e. the EU, Iceland, Norway, and Liechtenstein). However, your personal data may, to a certain extent (in particular e-mail address, device identifier, data on website behaviour), be transferred to processors in third countries outside the EEA, specifically to the United States of America, or to Canada. This concerns in particular:
- Shopify Inc. (Canada) – operation of the e-shop platform; Canada is recognised by the European Commission as a country with an adequate level of personal data protection (adequacy decision under Art. 45 GDPR);
- Klaviyo, Inc. (USA) – e-mail marketing and marketing automation; the transfer takes place on the basis of the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023), or standard contractual clauses;
- Google LLC / Meta Platforms, Inc. (USA) – analytics and advertising tools (GA4, Google Ads, Meta Pixel) operated by their European subsidiaries (Google Ireland Limited, Meta Platforms Ireland Limited); any partial transfer to the USA takes place on the basis of the EU-U.S. Data Privacy Framework, to which both groups of companies are certified;
- Judge.me – a global provider of the review tool; the transfer is carried out on the basis of standard contractual clauses (SCCs) adopted by the European Commission.
5.2. In certain cases, the special exception set out in Art. 49(1)(b) and (c) GDPR may also apply, i.e. that the transfer is necessary for the performance of the contractual relationship between our company as controller and you as the data subject, or that the transfer is necessary for the conclusion or performance of a contract concluded in your interest.
5.3. If you wish to prevent a specific processing operation involving a transfer to third countries, you may contact us at info@nozono.com. In the case of cookies and similar technologies, you also have the option to set your preferences through the cookie management tool directly on the website.
6. How long we retain your personal data
6.1. We retain personal data for no longer than is necessary for the purposes for which they are processed, unless applicable Czech law requires us to retain them for longer (e.g. for archiving purposes or to fulfil accounting obligations).
6.2. If we process your personal data on the basis of a legal obligation, we retain them for the period laid down by the relevant legislation. For accounting records this is generally 5 years, and for tax documents 10 years (Sec. 35 of the VAT Act).
6.3. If we process your personal data on the basis of a purchase contract, we retain them for the duration of the contractual relationship and thereafter for 10 years from the termination of the contractual relationship (generally from the fulfilment of the last delivery), in case it becomes necessary to use them in the event of court or other similar proceedings, or for the purpose of resolving discrepancies in our records. After this period the personal data are deleted, unless the law provides otherwise.
6.4. If we process your personal data solely on the basis of a legitimate interest (e.g. for the purposes of targeted marketing to existing customers) and the law does not impose a longer period, we retain them for no longer than 5 years from the last purchase, or until you successfully object to their processing.
6.5. If we process your personal data on the basis of consent (in particular for the purpose of sending the newsletter) or under the Information Society Services Act, we retain them for no longer than 5 years from the granting of consent, or from the last purchase in the case of processing under the Information Society Services Act. We will stop retaining this data sooner if you withdraw your consent or unsubscribe from the newsletter.
6.6. Data stored in cookies are retained for the period stated for the individual categories of cookies in Article 10 (or in the separate "Cookie Policy" document).
7. How we obtain your personal data
7.1. We generally obtain personal data directly from you, through:
- filling in the order form on the e-shop (even without registration),
- registering a customer account,
- signing up for the newsletter,
- filling in the contact form or communicating by e-mail or telephone,
- submitting a product review through the Judge.me tool,
- visiting the website (cookies and similar technologies).
7.2. To a limited extent, we may obtain your personal data from third parties (e.g. from the carrier in connection with a shipment complaint, or from the payment gateway provider in connection with a payment complaint).
7.3. We do not obtain personal data from publicly available sources or from other business partners for the purpose of expanding our customer database.
8. How we use your personal data
8.1. In accordance with the table in Article 3, we only collect the personal data we need to process your order, to fulfil other contractual obligations, and for the reasonable development of our business activities. We protect your personal data and ensure that it is used solely for the purpose for which we obtained it. Our employees who are authorised to work with your personal data are instructed about the obligations arising from the GDPR and about the need to maintain confidentiality.
8.2. The following applies:
- if we obtained your personal data for the purpose of concluding a contract or handling your pre-contractual requests, we use it precisely for this purpose and in a manner permitted by law;
- if we obtained your personal data due to compliance with legal obligations (in particular accounting, tax, and consumer protection obligations), we use and process it in the manner determined by the relevant law;
- if we process your personal data due to an overriding legitimate interest, we use it solely in an effort to secure that legitimate interest (in particular the operation of the e-shop, protection against fraud, and contacting existing customers with a similar offer);
- if we process your personal data on the basis of consent, we process it for the purpose and in the manner stated therein, and only for as long as you do not withdraw your consent, or until you unsubscribe.
8.3. Automated decision-making and profiling with legal effects: Our company does not use automated individual decision-making within the meaning of Art. 22 GDPR, i.e. decision-making without human intervention that would have legal effects on you or significantly affect you. We only carry out limited profiling for direct marketing purposes based on the goods purchased (e.g. the type of dietary supplements you prefer), the number/value/timing of orders, and interaction with our newsletter. This form of profiling does not have legal effects on you, nor does it significantly affect you in a similar way. You have the right to object to this processing at any time (see Article 9.6).
9. What rights you have as a data subject
In connection with the processing of your personal data, you have the rights set out below. You may exercise a request by sending it to the controller's registered office address or to the e-mail address info@nozono.com. The controller will generally handle your request within 30 days of receipt; in justified cases (in particular due to complexity or the number of requests), this period may be extended by a further two months, of which the controller will inform you. Handling the request is generally free of charge; in the case of manifestly unfounded or excessive requests (in particular repeated ones), the controller may charge a reasonable fee or refuse the request.
9.1 Right of access
You have the right to obtain confirmation from the controller as to whether your personal data is being processed, and if so, you have the right to access that data and information about its processing (in particular the purposes, categories of data, recipients, and retention period). Upon request, we will also provide you with a copy of the personal data being processed. Please remember to state, in your request, the contact details to which we can send our reply.
9.2 Right to rectification
If you believe that some of the personal data we process about you is incorrect or incomplete, you may request that it be corrected or completed. In such a case, please clearly state what you believe is incorrect or incomplete, how you wish the correction to be made, and, if applicable, provide supporting evidence.
9.3 Right to erasure ("right to be forgotten")
You have the right to request the erasure of personal data we process about you if:
- the personal data is no longer necessary for the purposes for which it was collected or processed;
- you withdraw your consent and there is no other legal ground for the processing;
- you object to the processing and there are no overriding legitimate grounds for the processing;
- the personal data has been processed unlawfully;
- erasure is necessary to comply with a legal obligation.
In certain cases, the GDPR allows a request for erasure to be refused, e.g. if the processing is necessary to comply with a legal obligation, for archiving purposes in the public interest, or for the establishment, exercise, or defence of legal claims.
9.4 Right to restriction of processing
You have the right to restrict the extent to which we process your personal data if:
- you contest the accuracy of the personal data, for the period until we have verified your objections;
- the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
- we no longer need the personal data, but you need it for the establishment, exercise, or defence of legal claims;
- you have objected to the processing, pending verification whether the controller's legitimate grounds override yours.
9.5 Right to data portability
You have the right to receive from the controller the personal data concerning you that you have provided to it, in a structured, commonly used, and machine-readable format, and to transmit that data to another controller. However, this right applies only to data processed on the basis of consent you have granted or on the basis of a contractual relationship, and which is processed by automated means. This right may only be exercised if doing so does not adversely affect the rights and freedoms of others.
9.6 Right to object
In certain cases, you have the right to object at any time to the processing of your personal data. With regard to the processing operations under this Policy, this concerns in particular processing on the legal basis of the controller's overriding legitimate interests (Art. 6(1)(f) GDPR), or, in the case of direct marketing, on the basis of the Information Society Services Act. You have the right to object to processing for direct marketing purposes at any time, and upon receiving the objection the controller will terminate such processing.
Please address objections to info@nozono.com. Please provide a clear and comprehensible description of the circumstances on the basis of which you believe that the given processing disproportionately interferes with your rights and freedoms.
9.7 Right to withdraw consent
If the processing is based on your consent, you have the right to withdraw your consent at any time, in the same simple manner in which you granted it. Withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal. You can unsubscribe from the newsletter via the "Unsubscribe" link contained in every marketing e-mail, or by sending a request to info@nozono.com.
9.8 Rights relating to automated decision-making
As stated in Article 8.3, our company does not carry out automated individual decision-making within the meaning of Art. 22 GDPR. Profiling for direct marketing purposes does not have legal effects on you, nor does it significantly affect you. You have the right to object to this processing.
9.9 Right to lodge a complaint with the supervisory authority
If you have any questions or concerns regarding the processing of your personal data, please contact us directly first. We will always try to resolve your queries to your satisfaction. However, if you are not satisfied with our approach, you have the right to lodge a complaint with the supervisory authority:
Office for Personal Data Protection (Úřad pro ochranu osobních údajů)Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
tel.: +420 234 665 111
website: www.uoou.cz
e-mail: posta@uoou.cz
10. Cookies and similar technologies
10.1. In order to ensure the proper functioning of the e-shop, evaluate its performance, and support our marketing activities, we store small data files on your device, so-called cookies, and use similar technologies (pixels, browser local storage). Cookies may in some cases contain personal data (in particular a pseudonymised identifier, IP address).
10.2. What are cookies? A cookie is a small text file that a website stores on your computer or mobile device while you are browsing it. Thanks to this file, the website retains information about your actions and preferences (such as language, cart contents, identification of a non-logged-in user) for a certain period of time, so you do not have to re-enter them when you visit again.
10.3. What types of cookies do we use?
- Technical (necessary) cookies – necessary for the proper functioning of the website (account login, cart contents, security). We process these cookies on the basis of the controller's legitimate interest under Art. 6(1)(f) GDPR, and they cannot be declined without limiting the functionality of the website.
- Functional (preference) cookies – allow us to remember your choices (e.g. language, region) and provide a more convenient user experience. We process these cookies on the basis of your consent.
- Analytics cookies – we mainly use the Google Analytics 4 service (Google Ireland Limited) to measure traffic, analyse user behaviour, and optimise the e-shop. We process these cookies on the basis of your consent.
- Marketing cookies – enable personalised and remarketing advertising on partner platforms. We mainly use Google Ads (Google Ireland Limited) and the Meta Pixel (Meta Platforms Ireland Limited) for advertising on Facebook and Instagram. We process these cookies exclusively on the basis of your consent.
10.4. How to manage cookies? On your first visit to the e-shop, we display a cookie banner where you can set which categories of cookies you consent to. You can change your preferences at any later time via the "Cookie Settings" link in the footer of the website.
10.5. You may also check or delete cookies at your own discretion – details can be found, for example, at www.aboutcookies.org. You can delete all cookies stored on your device, and most browsers can be set to prevent cookies from being stored. In that case, however, you will likely have to manually adjust certain settings on each visit, and some services and features may not work correctly.
10.6. Cookie settings in individual browsers:
11. Social media plugins and embedded third-party content
11.1. The website may contain links to the controller's social media profiles, or buttons enabling content to be shared on third-party social networks. If you click on such a button or link, or if third-party content is embedded on the page (e.g. a YouTube video), your personal data may also be processed by the operator of the relevant social network or service, in accordance with its own privacy policy and your settings. This concerns in particular:
- the Facebook and Instagram plugin, managed by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland;
- the YouTube plugin, managed by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
11.2. These plugins are not managed by our company, and we therefore bear no responsibility for any processing of personal data by the operators mentioned above, nor for their functionality or any damage that they may cause. If you do not wish these entities to process your personal data, please refrain from clicking on the relevant links and buttons, or do not grant consent to marketing cookies in the cookie bar.
12. Security of personal data
12.1. The controller has adopted and maintains appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing personal data, in particular:
- communication between your browser and the e-shop is secured by HTTPS (TLS) encryption;
- payment data is processed solely on the side of the payment gateway providers in accordance with the PCI DSS standard; the controller has no access to, and does not store, payment card data;
- access to the e-shop administration is protected by strong passwords and multi-factor authentication;
- the number of persons with access to personal data is minimised; these persons are instructed on the obligation to maintain confidentiality;
- we regularly update the systems used and monitor security threats.
12.2. In the event of a breach of the security of your personal data that could result in a high risk to your rights and freedoms, we will inform you without undue delay in accordance with Art. 34 GDPR.
13. Changes to the Privacy Policy
13.1. Data protection is not a one-off matter for us. The information we are obliged to provide to you in connection with the processing of your personal data may change over time or become outdated. For this reason, we reserve the right to amend and change this Policy at any time and to any extent.
13.2. If we make a substantial change to this Policy, we will notify you of the change in an appropriate manner on the website and/or by e-mail sent to your e-mail address.
13.3. The current version of this Policy is always available at www.nozono.com in the "Privacy Policy" section.