Privacy Policy

The controller for data processing on this website is:

Qimondo Limited Partnership
Monavalley Business Park
Tralee, Co. Kerry, V92 YP84
Ireland

Email: …
Phone: +353 66 913048-0

This website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Workers, D1 database and CDN). Cloudflare processes technical access data (e.g. IP address, time of access, page visited) in order to ensure the delivery and security of the website. The legal basis is our legitimate interest in secure and efficient operation (Art. 6 (1) lit. f GDPR). As Cloudflare may also process data in the USA, we base the transfer on the EU standard contractual clauses. A data processing agreement is in place with Cloudflare.

When you place an order, we process the data required for this: email address, name, delivery address, the products ordered and details of the chosen payment method. This data is stored in our database (Cloudflare D1) and used to process the purchase contract. The legal basis is Art. 6 (1) lit. b GDPR (performance of a contract).

We retain order and invoice data on the basis of commercial and tax retention obligations for the legally prescribed period (generally up to ten years); the legal basis is Art. 6 (1) lit. c GDPR.

To access your customer area, we use a passwordless procedure: we send you a six-digit login code by email. We store the code and session token only in encrypted or hashed form. The login serves to display and manage your orders and subscriptions. The legal basis is Art. 6 (1) lit. b GDPR.

For payment processing - including card payments and direct debit - we use PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The data required for payment is transmitted to PayPal; card data is transmitted directly to PayPal and does not reach our servers. For a subscription, PayPal stores a payment agreement for recurring charges; we store a reference ID for this, but not your payment data. The legal basis is Art. 6 (1) lit. b GDPR. PayPal's privacy terms also apply.

To send login codes, order and cancellation confirmations and - after you sign up - newsletter emails, we use the service provider Resend (Resend, Inc., USA). Your email address is transmitted to Resend for this purpose. The legal basis is Art. 6 (1) lit. b GDPR or our legitimate interest in reliable email delivery (Art. 6 (1) lit. f GDPR). We base the transfer to the USA on the EU standard contractual clauses.

To deliver your order, we transmit your name and delivery address to the carrier commissioned with the delivery - depending on the shipment DHL Express (DHL Express Germany GmbH or local DHL companies) or DPD (DPD Ireland Ltd. or local DPD companies). The legal basis is Art. 6 (1) lit. b GDPR (performance of the contract). The carriers process the data for delivery and tracking under their own responsibility; their privacy notices also apply.

You can sign up for our newsletter voluntarily (form in the footer or notice window). We use the double opt-in procedure: after signing up you receive an email with a confirmation link; your registration only becomes effective once you confirm. We store your email address, the time of registration and confirmation and - as proof of your consent - the IP address used when signing up. The legal basis is your consent (Art. 6 (1) lit. a GDPR); the proof is based on Art. 7 (1) GDPR.

You can unsubscribe at any time via the unsubscribe link in every newsletter email or by contacting …; the withdrawal takes effect from that moment. Any welcome voucher linked to the registration is only created after confirmation.

WhatsApp news: Alternatively, you can sign up for news and offers via WhatsApp by actively sending us a pre-filled message via the button on our website - this message constitutes your consent (Art. 6 (1) lit. a GDPR). We store your phone number, the chosen language and the times of sign-up and unsubscription, and send you your personal voucher code as a reply. Communication runs via WhatsApp, a service of Meta Platforms Ireland Ltd. (Ireland); Meta processes your data (including phone number and message content) under its own responsibility - the WhatsApp privacy policy additionally applies. Meta may transfer data to third countries (including the USA), based on the EU standard contractual clauses. You can unsubscribe at any time by replying STOP; the withdrawal takes effect from that moment.

Product reviews: If you submit a review while logged in, we store the review text, star rating, the display name you provide and the email address of your account (for moderation and abuse prevention; only the display name is published). The legal basis is Art. 6 (1) lit. b or lit. f GDPR. Details in our review guidelines.

Back-in-stock notification: If you sign up on a sold-out product, we store your email address and notify you once when the product is available again (Art. 6 (1) lit. b GDPR).

Applications (jobs, creator/affiliate): If you send us an application via our forms, we process the data provided and uploaded documents solely to handle the application (Art. 6 (1) lit. b GDPR). Documents are kept in private, non-public storage; after the process is completed we delete the data within six months unless legal obligations or a collaboration require otherwise.

On our website you can voluntarily use an AI chat that answers general questions about our products and our concept. Only when you actively send a message there is the chat history transmitted to Anthropic (Anthropic, PBC, USA) to generate the answer. Please do not enter any personal data such as your name, address or health data in the chat - for questions about your order, use our e-mail support. We do not store or log the chat contents on our servers; the history only lives in your browser tab's storage and is deleted when you close the tab. The legal basis is answering your request or our legitimate interest in a helpful product assistant (Art. 6(1)(b) and (f) GDPR); we base the transfer to the USA on the EU standard contractual clauses. Use is voluntary - all information is also available on the product pages.

We use technically necessary storage without consent (Art. 6 (1) lit. b or lit. f GDPR):

• nyce_session - session cookie for the login to the customer area, valid for 30 days. The same applies to nyce_admin_session and nyce_partner_session for team and partner access.
• nyce_consent - stores your cookie decision, valid for 6 months. Without this cookie we would have to ask you again on every visit.
• Your browser's local storage - the contents of your cart („nyce-cart-v2“), your entries in the checkout form („nyce-checkout-v1“, only until you close the tab) and - if you use the AI chat - your chat history („nyce-chat-v1“, only until you close the tab).
• NEXT_LOCALE - remembers the selected language so that we can serve the site in the correct language version.
• When you pay, PayPal sets its own cookies for fraud prevention and payment processing. This is necessary for the performance of the contract; details can be found in PayPal's privacy policy.

Everything else only with your consent (Art. 6 (1) lit. a GDPR). On your first visit we ask you via a cookie notice; until you decide, nothing requiring consent is loaded. You can change or withdraw your choice at any time via the „Cookie settings“ link in the footer (Art. 7 (3) GDPR); the withdrawal takes effect from the moment of the change. We distinguish:

• Functional - convenience storage without any personal reference, e.g. the note whether our newsletter or WhatsApp message has already been shown to you („nyce-newsletter-popup-v1“, „nyce-whatsapp-popup-v1“).
• Statistics - audience measurement with Google Analytics 4 (see below).
• Marketing - personalised advertising and measuring advertising performance. We currently do not use any service in this category.

Google Analytics 4: If audience measurement is active, we load it exclusively after your consent to the „Statistics“ category. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Cookies (including „_ga“) are set and usage data such as pages visited, time, shortened IP address, device and browser are processed in order to evaluate reach and usage. A transfer to the USA is possible; we base it on the EU standard contractual clauses and the EU-US Data Privacy Framework. The retention period is 14 months. Without consent no Google script is loaded and no analytics cookie is set; if you withdraw it, we remove the analytics cookies that were set.

Under the GDPR you have the following rights:

• Access to the data stored about you (Art. 15)
• Rectification of incorrect data (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing (Art. 21)

To exercise your rights, a message to … is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority.