Privacy Policy

5.1 Controller

ULTRASENS LT, MB, company number 308011165, V. Nagevičiaus g. 3, LT-08237 Vilnius, Lithuania, is the controller of personal data processed for the operation of Nurvishop, except where a service provider acts as an independent controller for its own legally defined purposes.

Privacy enquiries may be sent to info@nurvishop.com.

5.2 Scope

This Privacy Policy applies when you visit the Website, place or manage an Order, request a return, contact support, make a complaint or otherwise interact with Nurvishop. It is intended to comply with the GDPR and other applicable data-protection laws without reducing rights available under local law.

5.3 Personal data we process

• Identity and contact data, such as name, email address, telephone number, billing address and delivery address.
• Order data, such as products, quantities, price, currency, delivery preference, return status and communications about the Order.
• Payment and transaction data, such as payment status, limited card metadata, transaction identifier, refund information and fraud-risk results. Full card credentials are handled through the payment interface.
• Delivery data, such as recipient details, tracking events, proof of delivery, failed-delivery information and customs information where required.
• Customer-service data, such as enquiries, complaints, return reasons, photographs provided for a claim and our responses.
• Technical and security data reasonably necessary to operate and protect the Website, such as IP address, device/browser information, logs, timestamps and security events.
• Legal and compliance data where necessary to prevent fraud, comply with sanctions or export rules, handle disputes, enforce rights or respond to lawful requests.

5.4 How we collect data

We collect data directly from you, automatically through necessary Website technologies, from payment and delivery providers, and from authorities or fraud-prevention sources where legally permitted and necessary.

5.5 Purposes and legal bases

5.6 Required information

Information marked as required at checkout is needed to process payment, form the contract or deliver the Order. If it is not provided, we may be unable to accept or fulfil the Order.

5.7 Recipients

We disclose personal data only as reasonably necessary to:

• the authorised payment service provider and relevant card/payment networks;
• DPD and FedEx for delivery, tracking, customs and delivery-related support;
• technical hosting, security and professional advisers used to operate and protect the service;
• public authorities, courts, regulators or law-enforcement bodies where disclosure is legally required; and
• a successor or transaction adviser in connection with a genuine corporate transaction, subject to appropriate safeguards.

Service providers acting on our behalf must process data under appropriate contractual and confidentiality obligations.

5.8 International transfers

International delivery and service infrastructure may require personal data to be processed outside Lithuania or the European Economic Area. Where the GDPR requires safeguards, we use an adequacy decision, approved standard contractual clauses or another lawful transfer mechanism and apply supplementary measures where appropriate.

5.9 Retention

We retain personal data only for as long as necessary for the relevant purpose, including fulfilment, returns, warranty and complaints, and for periods required by tax, accounting, consumer-protection and limitation laws. Security logs and unsuccessful checkout data are kept for shorter periods unless needed for fraud prevention or a legal claim.

When data is no longer required, it is deleted, anonymised or securely isolated in accordance with applicable retention requirements.

5.10 Your rights

Subject to applicable conditions and exceptions, you may have the right to:

• access personal data and receive information about its processing;
• correct inaccurate or incomplete data;
• request deletion;
• restrict processing;
• object to processing based on legitimate interests or to direct marketing;
• receive portable data in a structured, commonly used, machine-readable format;
• withdraw consent at any time without affecting earlier lawful processing; and
• lodge a complaint with the Lithuanian State Data Protection Inspectorate or another competent supervisory authority.

To exercise a right, email info@nurvishop.com. We may request proportionate information to verify identity. Exercising a right is generally free, but manifestly unfounded or excessive requests may be handled as permitted by law.

5.11 Automated decisions

Payment and fraud providers may use automated risk tools. Nurvishop does not intend to make solely automated decisions that produce legal or similarly significant effects without the safeguards required by applicable law. Contact us if you believe an Order was incorrectly rejected and you want a human review where legally available.

5.12 Children

The Website is not directed to children and Orders may be placed only by persons aged 18 or over. If we learn that a child’s personal data was collected without a valid legal basis, we will take appropriate steps to delete it.

5.13 Security

We use reasonable organisational and technical measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. No internet transmission or storage method is completely secure, and customers should protect their devices and communications.

5.14 Marketing

Nurvishop will send electronic marketing only where a lawful basis exists and any required consent has been obtained. Transactional messages about Orders, delivery, returns, security or legal notices are not marketing. You may opt out of marketing at any time using the method provided in the message or by contacting us.

5.15 Changes

We may update this Policy to reflect legal, operational or technical changes. The current version will be published on the Website with its revision date. Material changes will be highlighted or otherwise communicated where required.