Privacy Policy

This policy explains what personal data Noctis collects when you visit our website or buy from us, why we collect it, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who we are

This website is operated by [COMPANY LEGAL NAME] (“Noctis”, “we”, “us”), registered in [COUNTRY] under company number [COMPANY NUMBER], with its registered office at [REGISTERED ADDRESS]. We are the data controller for the personal data described in this policy.

For any question about this policy or your data, contact us at [CONTACT EMAIL].

2. The data we collect

• Account details — your name, email address, password (stored in encrypted form), phone number and preferred language.
• Address details — the delivery address saved to your profile or entered at checkout.
• Order details — the products you buy, prices, order history and the payment method you chose. Card and PayPal payments are handled by our payment providers; we do not store your full card number.
• Cart — the items in your cart, kept in sync with your account.
• Technical data — IP address, browser and device information, collected through cookies and similar technologies.

3. How and why we use your data

We only use your data where the GDPR gives us a legal basis:

• To process, deliver and support your orders, including returns — performance of our contract with you (Art. 6(1)(b)).
• To provide and manage your account — performance of our contract with you (Art. 6(1)(b)).
• To send marketing emails — only with your consent (Art. 6(1)(a)), which you can withdraw at any time.
• To keep our website secure, prevent fraud and improve our service — our legitimate interests (Art. 6(1)(f)).
• To keep accounting and tax records — compliance with legal obligations (Art. 6(1)(c)).

4. Who we share your data with

We never sell your personal data. We share it only with service providers who help us run Noctis, under contracts that protect your data:

• Payment providers (card processors and PayPal)
• Delivery and courier companies
• Website hosting, database, email and IT providers
• Professional advisers, and public authorities where required by law

If a provider processes data outside the European Economic Area, we make sure appropriate safeguards are in place, such as an EU adequacy decision or the European Commission’s Standard Contractual Clauses.

5. Cookies

We use strictly necessary cookies and browser storage to run the website — for example, to keep you signed in, keep your cart and remember your language. These do not require consent. We will only use analytics or marketing cookies if you agree to them, and you can change your choice at any time in your browser settings.

6. How long we keep your data

We keep order and invoice records for as long as tax and accounting law requires ([RETENTION PERIOD, e.g. 10 years]). Account data is kept while your account is active and deleted when you ask us to, unless the law requires us to keep it. Marketing data is kept until you unsubscribe.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• correct inaccurate data — you can also edit it on your account page;
• have your data erased;
• restrict or object to how we use your data;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent.

To exercise these rights, email [CONTACT EMAIL]. We will reply within one month. You also have the right to complain to your local data protection authority, or to [SUPERVISORY AUTHORITY] in [COUNTRY].

8. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections and encrypted password storage. Please keep your password confidential.

9. Children

Our shop is not intended for children under 16, and we do not knowingly collect their personal data.

10. Changes to this policy

We may update this policy from time to time. The current version is always on this page. See also our Terms of Service.