Skip to content
Free shipping to Germany over €99
NUVARA

Last updated 18 October 2026

Privacy Policy

1. Controller

Nuvara Jewellery
ul. Przykładowa 1
00-001 Warszawa, Poland
Email: yusuf.songur@nuvarajewellery.com

2. Data we process and why

  • Orders: name, delivery address, email, optional phone and company/VAT ID, order contents and payment status — to perform the contract (Art. 6(1)(b) GDPR) and to meet accounting and tax retention obligations (Art. 6(1)(c) GDPR; invoices and accounting records are kept for 5 years from the end of the tax year under Polish law).
  • Withdrawals: name, email, order number, content and time of your withdrawal — to process it and to prove its receipt (Art. 6(1)(b) and (c) GDPR).
  • Customer account: name, email and a hashed password (Art. 6(1)(b) GDPR). You can ask us to delete your account at any time.
  • Newsletter: your email address, with your consent (Art. 6(1)(a) GDPR), confirmed by double opt-in. We store when you confirmed and send you a personal single-use welcome code. You can unsubscribe at any time via the link in every email.
  • Bag reminders: only if you tick the box at checkout, we use your email and the contents of an unpaid order to send at most one reminder and one personal discount code (Art. 6(1)(a) GDPR). You can stop them with one click.
  • Reviews: if you write a review after delivery, we publish your rating, text and the name you choose (Art. 6(1)(a) GDPR). Only with your consent at checkout do we email you a single review request.
  • Birthday code: if you add your birthday (day and month, no year) in your account, we use it to email you one personal discount code a year (Art. 6(1)(a) GDPR). You can remove it in your account at any time.
  • Back-in-stock alerts: if you ask to be notified, we store your email and the product to send one email when it is available again, then delete the request (Art. 6(1)(a) GDPR).
  • Gift cards: buyer's email, sender and recipient name, recipient email and the optional message — to deliver the card and manage its balance (Art. 6(1)(b) GDPR).
  • Review photos: a photo you upload with your review is only published with your explicit consent (Art. 6(1)(a) GDPR); you can ask us to remove it at any time.
  • Contact form: name, email and message — to answer your enquiry (Art. 6(1)(b)/(f) GDPR).
  • Shop statistics: we count product page views, "add to bag" clicks and checkout steps (e.g. "opened checkout", "payment failed") as daily totals. These counters contain no personal data, no IP addresses and use no cookies (Art. 6(1)(f) GDPR, improving our shop).
  • Server logs and security: IP addresses are processed briefly for security and abuse prevention (e.g. rate limiting) and are not stored with your orders (Art. 6(1)(f) GDPR).

3. Recipients and processors

  • Stripe Payments Europe Ltd. (Ireland) — payment processing; for PayPal/Klarna the respective provider.
  • Vercel Inc. (USA) — website hosting; Neon Inc. (USA, database hosted in the EU, Frankfurt) — database.
  • Resend (Plus Five Five, Inc., USA) — sending transactional emails (order confirmation, invoice, tracking).
  • DHL, DPD, InPost or other carriers — name and address, and where needed email/phone, for delivery.

Processors act under data processing agreements (Art. 28 GDPR). Transfers to the USA are based on the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses.

4. Cookies and local storage

We only use technically necessary storage: a session cookie when you sign in, your shopping bag saved in your browser's local storage, and small local-storage notes so the newsletter offer isn't shown again after you close it and the "recently viewed" and saved-pieces (wishlist) lists (names and photos of pieces, which never leave your device). We use no tracking or advertising cookies, so no consent banner is required (§ 25 (2) TDDDG). If we add analytics or advertising pixels in future, we will ask for your consent first.

5. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) and to withdraw consent at any time with effect for the future. You may lodge a complaint with a supervisory authority, e.g. the Polish UODO (uodo.gov.pl) or the authority in your country of residence.