Privacy policy
Nanosupps online store | https://nanosupps.com/
1. Purpose and scope of this notice
In this notice, Nanosupps Korlátolt Felelősségű Társaság describes the processing of personal data connected with use of the online store at https://nanosupps.com/, orders, customer accounts, payments, invoicing, fulfilment, delivery, customer service, the loyalty programme, newsletters, marketing, analytics and related technical services.
This notice provides the prior information required by Articles 12 and 13 of the GDPR. Each processing purpose is presented separately, including the categories of data processed, legal basis, recipients, retention period, any transfer outside the EEA and the rights of data subjects.
The online store operates in Hungarian and English. According to Nanosupps, at launch orders may be placed from EU Member States and the United States, Canada, the United Kingdom, Switzerland, Norway, Iceland, Ukraine, Albania, Andorra, Bosnia and Herzegovina, Liechtenstein, Montenegro, North Macedonia, Serbia, Kuwait, Qatar, Saudi Arabia and the United Arab Emirates. This notice primarily provides information under the GDPR and Hungarian privacy rules applicable to the online store operated from Hungary. Local privacy requirements in destinations outside the EEA may require additional or different information.
2. Controller details
| Controller | Nanosupps Korlátolt Felelősségű Társaság |
|---|---|
| Short name | Nanosupps Kft. |
| Registered office | 1213 Budapest, Szent István út 292/A., Hungary |
| Company registration number | 01-09-384511 |
| Tax number | 29251487-2-43 |
| Online store | https://nanosupps.com/ |
| Privacy contact | hello@nanosupps.com |
| Customer service | letstalk@nanosupps.com |
Nanosupps has not currently appointed a data protection officer. The need to appoint a DPO and to carry out a data protection impact assessment is a separate internal compliance matter, assessed in light of the actual extent of planned profiling and tracking. This does not affect contact with data subjects.
3. Principles of processing
Nanosupps processes personal data lawfully, fairly and transparently, for specified and lawful purposes, to the extent necessary, accurately and only for as long as necessary for the purpose. The legal basis is determined by purpose; different legal bases and retention rules may apply to the same personal data when it is processed for different purposes.
Nanosupps gives a service provider access to personal data only where access is necessary to perform its task. Where a provider acts as a processor, Nanosupps applies the contractual framework required by Article 28 GDPR.
4. Processing related to operation of the online store
4.1. Technical operation of the online store and Shopify
| Purpose | Ensuring availability, secure technical operation, sessions, cart and essential e-commerce functions of the online store. |
|---|---|
| Data subjects | Visitors and users of the online store. |
| Data processed | Technical data necessary for operation processed by Shopify and the browser, in particular IP address, device and browser data, session identifiers, log data, cart and language settings, and technically necessary cookies and similar identifiers. |
| Legal basis | Article 6(1)(b) GDPR where technical processing is necessary for the online-store service requested by the user or for steps prior to a contract; Article 6(1)(f) GDPR where necessary for IT security and prevention of abuse. Section 155(4) of Act C of 2003 also applies to storage of or access to information on the terminal equipment. |
| Recipient / processor | Shopify International Limited, Ireland, and sub-processors under the Shopify DPA. |
| Retention | According to Shopify’s actual logging, security and session settings. Nanosupps may retain data only as long as necessary for the purpose. |
| Transfers outside the EEA | Shopify International Limited may make transfers outside the EEA while providing the service. Shopify’s DPA of 7 July 2026 provides for BCRs for transfers from the EEA to Shopify group members and, where needed, adequacy decisions and standard contractual clauses. |
| Automated decision-making | The currently known core service does not involve solely automated decision-making producing legal or similarly significant effects within Article 22 GDPR. |
4.2. Registration and customer account
| Purpose | Creating and managing a customer account, identifying the user, and providing order history and account-related functions. |
|---|---|
| Data subjects | Users who choose to register. The online store can also be used as a guest. |
| Data processed | Email address and further profile data actually processed in the Shopify customer-account configuration. |
| Legal basis | Article 6(1)(b) GDPR: performance of the account service created at the user’s request. |
| Recipient / processor | Shopify International Limited. |
| Retention | For the duration of the account and until deletion, except for data that must be retained separately on another legal basis because of an order, accounting obligation, complaint or legal claim. |
4.3. Orders, conclusion of contract and order management
| Purpose | Receiving an order, identifying the purchaser and recipient, concluding the contract, and managing and fulfilling the order. |
|---|---|
| Data subjects | Natural-person purchasers placing orders in the online store; for business purchases, contact persons and recipients who are natural persons. |
| Data processed | Name, email address, telephone number, delivery and billing address, tax number for business purchases, order identifier, products, quantity, price, discounts, selected delivery and payment method, order and fulfilment status, order-related communications and technical order data. |
| Source | Directly from the data subject and from the Shopify order process. |
| Legal basis | Article 6(1)(b) GDPR. The framework for processing necessary to provide the e-commerce service under Section 13/A of Act CVIII of 2001 also applies. |
| Recipients | Shopify International Limited and the fulfilment, delivery, invoicing and payment providers needed for performance, as described in this notice. |
| Retention | For the active period necessary to perform the contract. After performance, retention of order data actually needed to establish, exercise or defend legal claims for five years is recommended, having regard to the general limitation period in Section 6:22 of the Civil Code, on the basis of Article 6(1)(f) GDPR. |
| Consequences of not providing data | Without mandatory data, the order cannot be fulfilled, or cannot be fulfilled properly. |
After an order is placed, Shopify sends an Order Confirmation email that only confirms receipt of the order. According to Nanosupps, the contract is concluded after the order has been processed and handed over for delivery, when Shopify sends the Shipping Confirmation email to the purchaser.
4.4. Transactional emails and order notifications
| Purpose | Communicating receipt, acceptance, dispatch, delivery status and other information necessary to perform the contract. |
|---|---|
| Data processed | Name, email address, order identifier, order and delivery data, message content and technical delivery data. |
| Legal basis | Article 6(1)(b) GDPR; Article 6(1)(c) GDPR where information is legally required. |
| Recipients | Shopify International Limited; the relevant fulfilment and courier provider for delivery notifications. |
| Retention | For the period corresponding to the order record and underlying legal basis. |
Transactional communications are not marketing communications. Unsubscribing from a newsletter or SMS marketing does not affect messages necessary to perform an already concluded contract.
4.5. Payment through Shopify Payments
| Purpose | Payment of the purchase price, processing and confirmation of the transaction and, where necessary, refunds. |
|---|---|
| Payment methods | Card payment, Apple Pay and Google Pay. Cash on delivery and bank transfer are not available at launch. |
| Data processed by Nanosupps | Order identifier, payment method, payment status, amount, transaction identifier and limited payment information made available to the merchant by Shopify. Nanosupps does not process full card data. |
| Legal basis | Article 6(1)(b) GDPR. |
| Recipient | Shopify Payments. For Hungary, the Shopify Payments contracting Shopify entity is Shopify International Limited, Ireland. Actual payment processors and financial service providers may participate within Shopify Payments. |
| Retention | Retention of payment transaction data visible to Nanosupps follows order, accounting and legal-claims purposes. Shopify Payments’ own retention is governed by its terms. |
| Transfers outside the EEA | Within Shopify Payments, data may be transferred to Canada, the United States and other regions under the Shopify Payments terms and applicable transfer safeguards. |
4.6. Invoicing and accounting
| Purpose | Issuing invoices, meeting tax and accounting obligations, and accounting. |
|---|---|
| Data processed | Name or company name, billing address, tax number, invoice item and consideration, invoice identifiers and the mandatory content of the accounting document. |
| Legal basis | Article 6(1)(c) GDPR: compliance with tax and accounting legal obligations applicable to Nanosupps. |
| Invoicing provider | Számlázz.hu, provided by KBOSS.hu Kereskedelmi és Szolgáltató Kft., 1031 Budapest, Záhony utca 7., company registration no. 01-09-303201, tax no. 13421739-2-41. |
| Accountant | Next Accounting Kft., 1132 Budapest, Váci út 20-26., tax no. 26190297-2-41, EU VAT no. HU26190297. |
| Retention | Under Section 169(2) of Act C of 2000 on Accounting, accounting documents directly or indirectly supporting accounting records must be retained for at least eight years. This period does not automatically extend to all order data. |
4.7. Fulfilment, warehousing, packing and handover for outbound delivery
| Purpose | Warehouse processing, picking, packing, dispatch and stock management. |
|---|---|
| Data processed | Name, email address, telephone number, delivery address, order and parcel data, and identifiers and status data needed for fulfilment. |
| Legal basis | Article 6(1)(b) GDPR. |
| Processor | iLogistic Kft., 2051 Biatorbágy, Verebély László utca 2., Hungary. |
| Return address | 2600 Vác, Szent László út 23/5., Hungary. Nanosupps Kft. directly handles return goods, not iLogistic Kft. |
| Retention | iLogistic processes the data under Nanosupps’ instructions for performance of the fulfilment service; on termination it returns or deletes the data and, absent different instructions from Nanosupps within three months, destroys it while observing retention duties. |
| Transfers outside the EEA | Processing normally takes place in the EU/EEA; transfers to third countries require Nanosupps’ prior approval and safeguards compliant with Chapter V GDPR. |
4.8. Delivery and collection-point selection
| Purpose | Delivery of ordered products, selection of a collection point or locker, label generation, parcel tracking and delivery communication. |
|---|---|
| Data processed | Name, email address, telephone number, delivery address or selected collection point/locker, order and parcel identifiers, delivery status. |
| Legal basis | Article 6(1)(b) GDPR. |
| Delivery partners | In Hungary: GLS, MPL, Express One and FoxPost; abroad principally GLS and DHL. The Delivery Gateway integration may also offer Foxpost, GLS and Packeta collection-point or delivery options. |
| Delivery Gateway | The Delivery Gateway app processes name, email address, telephone number and delivery address from the merchant order and transfers the necessary data to the selected delivery provider. |
| Retention | In line with Nanosupps’ order retention; each delivery provider may apply its own retention under its privacy obligations. |
4.9. Customer service, withdrawal, refunds and complaints
| Purpose | Handling customer questions, withdrawal and refund requests, complaints, statutory warranty and product-liability claims and other consumer claims, and documenting case handling. |
|---|---|
| Contact | letstalk@nanosupps.com and Shopify Inbox. No dedicated customer-service telephone number is available at launch. |
| Withdrawal process | Shopify’s built-in Return + Refund order-management flow; Nanosupps Kft. directly handles withdrawal and refund cases and physical returns. Return address: 2600 Vác, Szent László út 23/5., Hungary. |
| Data processed | Name, email address, order identifier, order data, content of the request or complaint, return and refund data, supporting attachments and communications generated while handling the matter. |
| Legal basis | Article 6(1)(b) GDPR for contract-related case handling; Article 6(1)(c) GDPR for statutory consumer complaints, in particular Section 17/A of Act CLV of 1997 on Consumer Protection; Article 6(1)(f) GDPR may apply to establish, exercise or defend legal claims. |
| Retention – consumer complaint | Written complaints, records of oral complaints and copies of substantive responses are retained for three years under Section 17/A(7) of Act CLV of 1997. |
| Retention – other customer-service case | Depending on the type of case, data related to the contract or legal claim may be retained where necessary with regard to the general five-year limitation period, on the basis of documented legitimate interests. |
| Recipients | Shopify International Limited, Shopify Inbox and the relevant courier, payment or invoicing provider where necessary for the case. |
4.10. Protein Snacking Club loyalty programme and JeriCommerce
| Purpose | Managing Protein Snacking Club membership, earning and redeeming points, determining club level, providing a Wallet card, referral functionality and loyalty-programme services. Members may optionally provide their date of birth; it is not a condition of participation. Fifty loyalty points are awarded for providing it, and Nanosupps may use the data to understand the age composition and characteristics of its customer audience. |
|---|---|
| Data subjects | Persons joining the loyalty programme. |
| Data processed | Name, email address, identifiers linked to the customer account and Wallet card, purchase amounts and dates, points, point movements, club level, redemptions and referral events; date of birth only at the member’s voluntary choice. |
| Legal basis | Article 6(1)(b) GDPR for core operation of the loyalty programme. Providing date of birth is optional; use of it to understand the age composition and characteristics of the customer audience is based on consent under Article 6(1)(a) GDPR. |
| Processor | Leuqim OÜ (registry code 17195491, Estonia), operating as JeriCommerce. According to JeriCommerce’s privacy notice of 21 March 2026, it processes merchants’ end-user data as a processor on behalf of the merchant. |
| Retention | Active point balance, point history and club status are processed while membership exists and as needed to operate the programme. If there is no activity affecting the point balance for 12 consecutive months, the member is inactive and unused redeemable points expire. Earned club status does not expire while membership exists. Expiry of points does not itself mean automatic deletion of all loyalty-programme data; further retention is determined by each item’s purpose and legal basis. |
| Transfers outside the EEA | Some JeriCommerce service-provider transfers may go outside the EEA under an adequacy decision, SCCs or another recognised transfer mechanism. |
4.11. Customer reviews – Judge.me
| Purpose | Requesting, collecting, managing and displaying customer reviews and ratings of purchased products on the online store, and ensuring review authenticity and technical operation. Nanosupps uses Judge.me’s automated post-purchase review-request email only to request a review of the purchased product; it contains no separate promotional or sales content. |
|---|---|
| Provider | Judge.me Ltd. According to Judge.me’s GDPR information, it acts as a processor for purchaser and reviewer data transferred by the online store. |
| Data processed | Depending on actual configuration: name, email address, order and product data, review content, reviewer profile data and technical data. |
| Legal basis | Voluntary submission and publication of a review are based on consent under Article 6(1)(a) GDPR. Checking a purchase, ensuring authentic reviews and sending a post-purchase email solely requesting a review of the purchased product without promotional or sales content are based on legitimate interests under Article 6(1)(f) GDPR. The data subject may object at any time. If the review request is supplemented with marketing or sales content, the appropriate legal basis for marketing communication is required. |
| Retention | A review may be processed while published, until deletion or withdrawal of consent; order data needed to verify the purchase follows the retention period for order data. |
4.12. Back-in-stock notification – STOQ
| Purpose | Sending the notification requested by the user that the relevant product is back in stock. |
|---|---|
| Provider | STOQ FZ-LLC (FDRK5298, Ras Al Khaimah, United Arab Emirates). |
| Data processed | Email address, relevant product variant, subscription/notification event and technical service data. STOQ documentation indicates that a back-in-stock subscription processes at least an email address and product-variant identifier. |
| Legal basis | Article 6(1)(b) GDPR: taking steps at the data subject’s request before entering into a contract. Requesting a stock notification is not a subscription to a newsletter or other marketing communication. |
| Retention | The email address and notification request are processed until the notification is sent or the request is withdrawn, but no longer than six months from recording the request. STOQ’s own technical and security data are governed by its separate retention rules. |
| Transfers outside the EEA | STOQ FZ-LLC is registered in the UAE. For transfers from the EEA to a third country, the provider applies appropriate safeguards under Chapter V GDPR, including SCCs where necessary. |
4.13. Other Shopify applications
At launch, Nanosupps uses or plans to use additional Shopify applications. Their privacy role can be stated definitively only after the actual permissions, data flows and provider contracts have been reviewed.
| Provider / recipient | Function | Privacy role | Notes / international transfers |
|---|---|---|---|
| Simple Bundles / Freshly Commerce | Bundle and mix-and-match functionality | Shopify application that may access customer, order and device data according to the App Store | Freshly Commerce Inc., Canada. The App Store indicates access to name, email address, telephone number, address, geolocation, IP/device data and customer and order data. According to Freshly Commerce, Bundle Magic uses product-level order data without direct customer identifiers. |
| UpCharge / UC Lab LLC | Fees, DRS and other surcharges | Recipient / Shopify app provider for order and technical data needed for fees, DRS and surcharge management | UC Lab LLC, USA. The provider processes data needed for fee, surcharge and tariff rules, support, billing, security and legal compliance. |
| Cloud ERP | ERP and order/operations | Processor for personal data processed by Nanosupps in Cloud ERP | CloudERP.hu Kft., Hungary. The provider uses Digital Ocean LLC for storage as a sub-processor and deletes or irreversibly anonymises stored data within 60 days after termination. |
| Delivery Gateway | Collection point, labels and carrier integration | Processor for customer data transferred by Nanosupps as needed for the delivery integration | Delivery Gateway Kft., 1066 Budapest, Nyugati tér 1-2., company registration no. 01-09-441174. It automatically transfers delivery data to the carrier used by Nanosupps. |
5. Newsletter, SMS marketing, marketing automation and profiling
Nanosupps handles the channels and purposes of marketing communication separately. A purchase cannot be made conditional on marketing consent. In line with the Hungarian supervisory authority’s notice of 17 September 2026, consent may cover only a purpose that is specifically determined and clearly communicated in advance.
5.1. Email newsletter and promotional communication
| Purpose | Sending email marketing communications regarding Nanosupps products, news, offers, promotions, discounts, product launches, Protein Snacking Club and Nanosupps community activity. |
|---|---|
| Data subjects | Persons who voluntarily consent to marketing email communication. Under Nanosupps’ current decision, only persons aged 18 or over may subscribe. |
| Data processed | Name, email address, fact and time of consent, subscription source and technical data needed to demonstrate consent. |
| Legal basis | Consent under Article 6(1)(a) GDPR and prior, unambiguous and express consent under Section 6(1) of Act XLVIII of 2008. |
| Processor | Klaviyo, Inc., and Shopify for technical aspects of the integration. |
| Retention | Until consent is withdrawn or the 12-month inactivity period set by Nanosupps expires. A subscriber is inactive if they have not clicked a marketing email and have not purchased from the online store for 12 months. Opening an email alone is not activity. |
| Unsubscribe | Consent may be withdrawn free of charge at any time. Marketing sending must stop without delay. Under Section 6(3) of Act XLVIII of 2008, the declarant’s name and all other personal data must be deleted without delay from the direct-marketing register. Klaviyo first technically marks the profile as suppressed/unsubscribed; Nanosupps then manually deletes the profile without undue delay. |
| Transfers outside the EEA | According to Klaviyo’s notice of 16 June 2026, Customer Data is currently stored in the United States in AWS us-east-1. Klaviyo’s DPA relies on the EU-US Data Privacy Framework and applicable alternative safeguards. |
5.2. SMS marketing
| Purpose | Sending SMS marketing communications about Nanosupps products, offers, discounts, promotions and community programmes. |
|---|---|
| Data processed | Telephone number, name, fact and time of consent, subscription source and delivery and activity data related to the communication, based on Klaviyo’s actual settings. |
| Legal basis | Article 6(1)(a) GDPR and separate prior consent under Section 6(1) of Act XLVIII of 2008. |
| Consent mechanism | SMS consent separate from the email newsletter is required. Providing a telephone number is optional and cannot be a condition of purchase. |
| Processor | Klaviyo, Inc. and Klaviyo providers participating in SMS delivery. |
| Retention | Until consent is withdrawn or Nanosupps’ 12-month inactivity rule applies. Following unsubscribe, Klaviyo applies channel-specific suppression/unsubscribe status. |
5.3. Measuring newsletter opens and clicks
| Purpose | Measuring campaign delivery, opens, link clicks, conversions and effectiveness, and optimising campaigns. |
|---|---|
| Data processed | Delivery, open and click events, links, times, device and technical data, and conversion and revenue events linked by Klaviyo to the campaign. |
| Legal basis | Informed email-marketing consent under Article 6(1)(a) GDPR. Person-linked open and click measurement may be used to measure and personalise email marketing where the data subject was clearly informed when giving consent. If the technology stores information on, or accesses information from, terminal equipment, Section 155(4) of Act C of 2003 also applies. |
| Processor | Klaviyo, Inc. |
| Retention | Person-linked campaign and tracking events, especially email opens, clicks and related conversion events, are processed for no more than 12 months from the event. If consent is withdrawn earlier, person-linked marketing data are deleted or, where appropriate, anonymised without undue delay. |
5.4. Marketing automation and personalised offers
| Purpose | Personalising marketing communication and operating automated marketing workflows, including welcome flow, abandoned cart, browse abandonment, winback, post-purchase cross-sell and offers based on purchase history. |
|---|---|
| Data subjects | Persons who have consented to the relevant marketing communication and, where needed, related tracking. |
| Data processed | Name, email address, marketing consent, browsing and product-view events, cart status, previous purchases, newsletter activity, customer status, preferences and event data lawfully transferred to Klaviyo. |
| Legal basis | Marketing consent under Article 6(1)(a) GDPR for email marketing and personalisation within it. Collection and marketing use of browsing or product-view activity through cookies or other tracking technology occurs only with the appropriate analytics or marketing/tracking consent in CookieYes. |
| Automated decision-making | The currently known processes serve marketing segmentation and recommendations and do not involve solely automated decision-making producing legal or similarly significant effects within Article 22 GDPR. |
| Retention | The marketing profile may be processed until consent is withdrawn or the 12-month marketing-inactivity rule applies. Individual person-linked campaign and tracking events are retained for no more than 12 months from the event and must then be deleted or appropriately anonymised. |
Abandoned-cart and browse-abandonment emails may qualify as direct marketing. They may not be sent to a person who has not given marketing consent where required by applicable law. A one-off, separately requested back-in-stock notification may be handled separately under section 4.12.
6. Cookies, analytics and advertising tracking
The online store uses the CookieYes consent-management platform. Planned technologies include Shopify Analytics, Google Analytics 4, Meta Pixel and Conversions API, TikTok, Google and YouTube channel, and tracking functions of certain Shopify apps. A separate Cookie Notice will contain the detailed names, providers, purposes and lifetimes of cookies and similar technologies. Nanosupps obtains consent required for analytics and advertising tracking through CookieYes. This consent is separate from consent for email and SMS marketing.
| Legal basis – non-essential analytics/marketing | Consent under Article 6(1)(a) GDPR. Where information is stored on or accessed from electronic communications terminal equipment, consent is required after prior, clear and complete information under Section 155(4) of Act C of 2003. |
|---|---|
| Consent platform | CookieYes Limited, United Kingdom. Under its DPA, the merchant is controller and CookieYes is processor. |
| Google Analytics 4 | Used to measure online-store use, traffic and campaign effectiveness. Non-essential Analytics processing is activated only with CookieYes consent. Google acts mainly as processor for Analytics data; where Google products & services data sharing is active, Google is an independent controller for data shared for that purpose. The separate Cookie Notice contains detailed cookie and retention information. |
| Meta Pixel / CAPI | Used for advertising measurement and conversion tracking. Activated only with marketing consent in CookieYes. Under Meta Business Tools terms, Nanosupps and Meta Platforms Ireland Limited may act as joint controllers for collection and transfer of event data to Meta; Meta subsequently acts under its own responsibility. Detailed technology and retention information is in the Cookie Notice. |
| TikTok | TikTok Pixel may be used for advertising measurement, optimisation and, with appropriate consent, remarketing. TikTok tracking is activated only with CookieYes marketing consent. TikTok’s role depends on the Business Product function used; details are in the Cookie Notice. |
| Cookie list | The current itemised list of cookies and similar technologies used by the online store is available in the separate Cookie Notice and CookieYes consent interface. |
7. Summary of processors and other recipients
| Provider / recipient | Function | Privacy role | Notes / international transfers |
|---|---|---|---|
| Shopify International Limited, Ireland | Online-store infrastructure, customer and order functions, Shopify Inbox | Processor for the main scope of merchant customer data; independent controller for certain operations in Enhanced Services | Transfers outside the EEA under BCRs, SCCs or an adequacy decision. If Shopify Network Intelligence / Enhanced Services is enabled, Shopify may also act as independent controller for parts of processing. |
| Shopify Payments / Shopify International Limited | Payments | Role under the Payments terms; additional payment processors participate | For Hungary, processors may include Stripe Payments Europe, Limited and Adyen N.V. under Shopify’s current official processor list. Processors may also act as independent controllers for their own legal and regulatory obligations. |
| Klaviyo, Inc. | Email and SMS marketing, automation, profiling and analytics | Processor for Nanosupps Customer Personal Data | USA, AWS us-east-1; DPF and alternative safeguards. |
| iLogistic Kft. | Fulfilment, warehousing, packing and handover for outbound delivery | Processor | Processes fulfilment data for outbound orders under Nanosupps instructions. Customer withdrawal, refunds and physical returns are handled directly by Nanosupps; iLogistic does not handle returns. |
| KBOSS.hu Kft. / Számlázz.hu | Invoicing | Processor and independent controller for its own legal obligations | Hungary. |
| Next Accounting Kft. | Accounting | Recipient; processor status to be finalised by contract | Hungary. |
| Leuqim OÜ / JeriCommerce | Loyalty programme and Wallet functions | Processor for merchant end-customer data | Estonia. |
| CookieYes Limited | Cookie consent and consent log | Processor | United Kingdom. |
| Judge.me Ltd | Customer reviews | Processor for buyer/reviewer data received from the merchant | Its automated post-purchase review-request email is used solely to request reviews of purchased products, without separate promotional or sales content. |
| STOQ FZ-LLC | Back-in-stock notification | Processor for data transferred for the notification function; independent controller for own service-security and legal purposes | United Arab Emirates; Chapter V GDPR safeguards apply. Nanosupps retains the subscription data until notification, withdrawal or no more than six months. |
| Freshly Commerce / Simple Bundles | Bundle functionality | Recipient / Shopify app provider for customer, order and technical data needed for the bundle function | Freshly Commerce Inc., Canada. |
| UC Lab LLC / UpCharge | DRS and fee management | Recipient / Shopify app provider for data needed for fees, DRS and surcharges | UC Lab LLC, USA. |
| Cloud ERP | ERP | Processor for personal data processed by Nanosupps in Cloud ERP | CloudERP.hu Kft., Hungary; uses Digital Ocean LLC for storage as a sub-processor and deletes or irreversibly anonymises stored data within 60 days after termination. |
| Delivery Gateway | Collection-point, label and carrier integration | Processor for customer data needed for delivery integration | Delivery Gateway Kft., Hungary; automatically transfers necessary data to the carrier used by Nanosupps. |
| GLS, MPL, Express One, FoxPost, DHL, Packeta | Delivery | Recipients; each may also process delivery data under its own privacy notice and legal obligations | The actual carrier receives data necessary for delivery based on the customer’s delivery method and destination. |
| Meta Platforms Ireland Limited | Meta Pixel / Conversions API, advertising measurement and conversion tracking | Nanosupps and Meta may be joint controllers for collection and transfer of event data; Meta acts as independent controller for its further own-purpose processing | Activated only after CookieYes marketing consent. Customer List Custom Audience is not used. |
| Google providers | Google Analytics 4, Google Ads, Google & YouTube channel | Google acts mainly as processor for Analytics data; for Google Ads and some data-sharing operations it may be an independent controller | Non-essential GA4 and Google Ads processing starts only after CookieYes consent. Google Customer Match is not used. |
| TikTok Technology Limited and related TikTok entities | TikTok app, pixel and advertising | Role depends on the Business Product: TikTok may be joint controller, independent controller or processor for particular processing operations | TikTok Pixel starts only after CookieYes marketing consent; applicable Business Products terms govern international transfers. |
8. Transfers outside the EEA
Nanosupps uses several global technology providers, so personal data may be transferred to countries outside the EEA. Such transfers may take place only in accordance with Chapter V GDPR. Appropriate safeguards may include an adequacy decision, the EU-US Data Privacy Framework for certified organisations, binding corporate rules or standard contractual clauses adopted by the European Commission.
Shopify’s DPA records the use of BCRs for transfers from the EEA to Shopify group members and SCCs or another appropriate mechanism for other countries without an adequate level of protection. Klaviyo currently stores Customer Data in the United States and, according to its own information, relies on the DPF and alternative safeguards.
9. Rights of data subjects
Subject to the conditions of the GDPR, data subjects may request information about and access to their personal data, rectification of inaccurate data, erasure where the conditions are met, restriction of processing and, where applicable, exercise the right to data portability.
Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. For direct marketing, after consent is withdrawn Nanosupps may not use the data for further marketing messages.
Where processing is based on the legitimate interests of Nanosupps or a third party, the data subject may object under the conditions of Article 21 GDPR. Processing for direct-marketing purposes may be objected to at any time.
Data-subject requests can be sent to hello@nanosupps.com. Nanosupps acts within the time limit laid down in Article 12 GDPR. Where the identity of a requester is reasonably in doubt, Nanosupps may request additional information necessary to confirm identity.
10. Complaints and judicial remedies
If a data subject considers that processing of their personal data infringes the GDPR or another applicable privacy rule, they may lodge a complaint with the supervisory authority. In Hungary, this is the National Authority for Data Protection and Freedom of Information: 1055 Budapest, Falk Miksa utca 9–11; postal address: 1363 Budapest, P.O. Box 9; email: ugyfelszolgalat@naih.hu.
A data subject may also seek a judicial remedy under Article 79 GDPR and applicable Hungarian procedural rules.
11. Data security
Nanosupps applies technical and organisational measures proportionate to risk to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, damage or unauthorised access. It limits processor access to the necessary service purpose and enters into a data-processing agreement where required.
12. Amendments and effective date
Nanosupps may amend this notice if its processing practices, Shopify configuration, services used, marketing functions, target markets or the legal environment change. The current version will be published in an easily accessible manner on the online store. Where a new processing purpose requires new consent, Nanosupps will obtain it before starting the new processing.
| Effective date | 19 October 2026 |
|---|---|
| Last updated |