Privacy Policy

NovaPep, operating novapep.eu. Contact for privacy matters: [email protected].

Account and order data: name, email address, delivery and billing address, phone number if provided, order history and contents. Payment data: when you pay by bank transfer, the name and account details of the paying account, as they appear on our bank statement. No card details are entered on or stored by the Site. Communications: anything you send us via email or the contact form, including support and returns correspondence. Technical and usage data: IP address, browser type, device information, and pages visited, collected automatically via cookies and similar technologies.

You can withdraw consent-based processing at any time without affecting the lawfulness of processing carried out before withdrawal.

Our hosting provider, on whose EU server the Site runs. Our payment provider, to process your payment. Our shipping carriers, and the shipping platform we book them through, which receive your name, delivery address, phone number and email so the parcel can be delivered and tracked. Our accountant, who receives invoices and order records to keep our books. Our email provider, for correspondence you send to our support or order addresses.

We do not sell personal data. We share data with these providers only as needed to run the Site and fulfil orders, under their own applicable data-processing terms.

Where any provider above processes data outside the EEA, we rely on the safeguards required under GDPR, such as the European Commission's Standard Contractual Clauses, as provided by that processor.

The Site sets essential cookies for the cart, checkout, security, login, and remembering that you passed the age gate. No analytics or advertising cookies are set. See our Cookie Policy for the current list.

We run a partner programme, under which approved partners promote the Site using a personal discount code and tracked links and are paid a commission on the orders that result. If you apply to it or join it, we process additional personal data for that purpose.

What we store for a partner: the name and email address you apply with, the channel or channels you gave us, a short description of your audience, the bank details you enter so that you can be paid, and a record of the clicks and orders your links and code produced. The legal basis is performance of a contract, namely the partner terms you accept when you apply, except for the payment records we are required to keep, which is a legal obligation.

Click records carry a randomly generated token and a broad device type only. No IP address is stored against a click. A partner sees a masked order reference for each referral and never the name, address or email of the customer behind it.

Partner records follow the same retention as the rest of this policy: payout and commission records are kept for seven years as accounting records, and the rest is kept only while the partnership is active or until you ask us to delete it. Applications that are not approved are deleted on request. To exercise any of the rights listed below in relation to partner data, email [email protected], or [email protected] for anything about the programme itself.

Order and invoicing records are kept for seven years, the retention period required for accounting records under Estonian law. Account and marketing data is kept only for as long as needed for the purpose it was collected for, or until you ask us to delete it, whichever is sooner. When you ask us to delete your account and data, we do it within 30 days, except the records we must keep by law.

Under GDPR, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure ("right to be forgotten"); object to or restrict certain processing; request a portable copy of your data; and withdraw consent at any time. To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with your local data protection supervisory authority, or with Estonia's Data Protection Inspectorate (Andmekaitse Inspektsioon), if you believe we have not handled your data lawfully.

We use reasonable technical and organisational measures to protect personal data. No card details are entered on or stored by the Site. No system is completely secure, and we cannot guarantee absolute security of data transmitted to us.

The Site is not directed at children, and we do not knowingly collect personal data from anyone under 18. See the Terms of Service eligibility section.

We may update this Policy from time to time. The version published on the Site at any given time is the one in effect.

[email protected] · [email protected]