Privacy Policy
Last updated: September 4, 2026 · Effective: September 4, 2026
Notice at Collection. We collect the categories of personal information described in Section 2 for the purposes described in Section 4. We share personal information with advertising partners for cross-context behavioral advertising. You have the right to opt out — see Your Privacy Choices. We do not sell personal information for money.
1. Who we are and how to reach us
This Privacy Policy explains how Nurestia ("we", "us", "our") collects, uses, discloses and protects personal information when you visit nurestia.com, purchase from us, or communicate with us.
Nurestia is established in Belgium and is the controller of your personal information. Our contact details are in Section 14.
2. Personal information we collect
In the 12 months preceding the date of this policy, we have collected the following categories of personal information:
| Category | Examples | Source | Shared for advertising? |
|---|---|---|---|
| Identifiers | Name, billing and shipping address, email, phone number, IP address, device and cookie identifiers, order number | You; your device | Yes |
| Customer records (Cal. Civ. Code §1798.80) | Name, address, telephone, payment method (last four digits only) | You; our payment processor | No |
| Commercial information | Products viewed, added to cart, purchased or returned; order history; customer service correspondence | You; your device | Yes |
| Internet / network activity | Pages viewed, referring URL, session duration, clicks, search terms on our Site | Your device | Yes |
| Geolocation data | Approximate location inferred from IP address (city / state level) | Your device | Yes |
| Audio / visual | Photos or videos you submit with a review or a support request | You | No |
| Inferences | Preferences and characteristics inferred from your browsing and purchases, used to build audiences | Derived by us and our partners | Yes |
We do not knowingly collect sensitive personal information as defined by the California Privacy Rights Act (such as Social Security numbers, precise geolocation, racial or ethnic origin, religious beliefs, or health data), and we do not use or disclose any such information for purposes requiring a right to limit.
We never receive or store your full payment card number. Payments are processed by our payment providers (Shopify Payments, PayPal and others displayed at checkout), who process your card data under their own privacy policies and PCI-DSS obligations.
3. How we collect it
- Directly from you — when you place an order, create an account, subscribe, leave a review, or contact support.
- Automatically — through cookies, pixels, tags, SDKs and server logs when you browse the Site. See Section 7.
- From third parties — our e-commerce platform (Shopify), payment providers, shipping carriers, fraud prevention services, and advertising and analytics partners.
4. Why we use it
- To process, fulfill, ship and invoice your orders, and to handle returns and refunds.
- To communicate with you about your order, and to provide customer support.
- To send you marketing communications where you have opted in, and to measure their effectiveness.
- To personalize and improve the Site, our products and your shopping experience.
- To display advertising to you on third-party platforms, including Facebook and Instagram, and to measure whether that advertising leads to a purchase.
- To detect, investigate and prevent fraud, abuse and security incidents.
- To comply with our legal, tax and accounting obligations, and to establish, exercise or defend legal claims.
5. Who we disclose it to
We disclose personal information for a business purpose to the following categories of recipients. We do not disclose personal information to third parties for monetary consideration.
| Recipient category | Examples | What they receive |
|---|---|---|
| E-commerce platform | Shopify Inc. | Order, account and browsing data |
| Payment processors | Shopify Payments, PayPal | Billing details, order amount |
| Fulfillment and shipping | Our fulfillment partners and carriers | Name, shipping address, phone, email |
| Advertising and analytics | Meta Platforms (Facebook / Instagram), Google, TikTok | Identifiers, hashed email, browsing and purchase events |
| Email and SMS providers | Our marketing platform | Email, phone number, purchase history |
| Reviews and support tools | Our review and helpdesk apps | Name, email, review content |
| Professional advisers and authorities | Accountants, lawyers, regulators | Only as required by law |
We may also disclose personal information in connection with a merger, acquisition or sale of assets, in which case we will notify you before your information is transferred and becomes subject to a different privacy policy.
6. "Selling" and "sharing" your information
Under California and several other state privacy laws, the use of advertising cookies and pixels to show you relevant ads on other websites and apps may be considered a "sale" or a "share" for cross-context behavioral advertising — even though no money changes hands.
On that basis, we disclose identifiers, commercial information, internet activity, geolocation and inferences to advertising partners (including Meta Platforms) for cross-context behavioral advertising.
You have the right to opt out. See Your Privacy Choices below.
We do not knowingly sell or share the personal information of consumers under 16 years of age.
7. Cookies, pixels and tracking technologies
We use cookies and similar technologies, including the Meta Pixel and the Meta Conversions API, to operate the Site, remember your cart, understand how the Site is used, and measure and target advertising.
The Meta Conversions API sends purchase and browsing events from our server to Meta. Where an email address or phone number is included, it is hashed before transmission so that Meta receives an irreversible representation rather than the value itself.
You can control cookies through our cookie banner and through your browser settings. Blocking essential cookies will prevent checkout from working. Full detail is in our Cookie & Tracking Notice.
Global Privacy Control. We honor the Global Privacy Control (GPC) browser signal. If your browser or extension transmits GPC, we treat it as a valid request to opt out of the sale and sharing of personal information for that browser.
8. Your Privacy Choices
Depending on where you live, you may have the following rights:
- Right to know / access — the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients.
- Right to delete — request deletion of personal information we hold about you, subject to legal exceptions such as completing a transaction or complying with tax law.
- Right to correct — request correction of inaccurate personal information.
- Right to opt out of sale or sharing — including for targeted advertising and profiling.
- Right to limit the use of sensitive personal information — we do not use sensitive personal information for purposes that trigger this right.
- Right to non-discrimination — we will not deny you goods or services, charge you a different price, or provide a different level of quality because you exercised a privacy right.
- Right to appeal — if we decline your request, you may appeal by replying to our decision. We will respond to an appeal within 45 days.
How to exercise your rights. Email contact@nurestia.com with the subject line "Privacy Request", or write to us at the address in Section 14. Tell us which right you wish to exercise and the email address you used to order, so we can locate your records.
We will confirm receipt within 10 business days and respond within 45 calendar days, with one 45-day extension where reasonably necessary. Verification is limited to matching the information you provide against our records; we do not require you to create an account.
Authorized agents. You may designate an authorized agent to submit a request on your behalf. We will require written proof of authorization and may contact you directly to confirm.
California "Shine the Light". California residents may request, once per year and free of charge, information about personal information disclosed to third parties for their direct marketing purposes. We do not make such disclosures, but you may confirm this by contacting us.
9. Marketing communications and SMS
Email. You may unsubscribe at any time using the link at the bottom of any marketing email, or by contacting us. Transactional emails about an existing order will still be sent.
Text messages. We send marketing text messages only to individuals who have provided prior express written consent by affirmatively opting in. Consent is not a condition of any purchase. Message frequency varies. Message and data rates may apply. Reply STOP to any message to unsubscribe, or HELP for assistance. Carriers are not liable for delayed or undelivered messages.
10. How long we keep it
| Data | Retention |
|---|---|
| Order and transaction records | 7 years (accounting and tax obligations) |
| Customer support correspondence | 3 years from last contact |
| Marketing contact details | Until you unsubscribe, then 30 days to honor the suppression |
| Website analytics and advertising identifiers | Up to 24 months |
| Fraud and security logs | 12 months |
11. How we protect it
We maintain administrative, technical and physical safeguards designed to protect personal information, including encryption in transit (TLS), access controls, and vendors assessed for security. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
12. Children's privacy
Our Site is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it promptly.
13. International transfers
We are established in Belgium. If you are located in the United States, your personal information will be transferred to and processed in Belgium and in other countries where our service providers operate, which may have different data protection laws than your state. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
If you are located in the European Economic Area or the United Kingdom, you also have rights under the GDPR, including the right to lodge a complaint with your supervisory authority. In Belgium, this is the Autorité de protection des données (autoriteprotectiondonnees.be).
14. Contact us
Nurestia — Privacy
5000 Namur, Belgium
Email: contact@nurestia.com
15. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced on the Site before they take effect.