Privacy Policy

The data controller is Nazareta Paulina Čypaitė, trading as NAZ, at Fizikų g. 14, 08448 Vilnius, Lithuania. Privacy and customer-support enquiries may be sent to contact@naz.fashion or made by telephone on +370 650 92001.

Depending on how you use the website, we may collect identity and contact data such as your name, billing and shipping address, email address and telephone number; transaction data such as products ordered, order value, payment status, delivery and return information; correspondence, support requests and complaints; private-drop consent and withdrawal records; and technical data such as device and browser information, timestamps, security events, fraud-prevention logs and a salted one-way network identifier used for abuse prevention where configured.

We receive data directly from you, automatically from your browser or device where necessary to operate and secure the website, and from providers involved in a transaction, such as confirmation of payment from Stripe or delivery status from the selected carrier.

We process personal data only where a legal basis applies. The basis depends on the purpose.

• Contract and pre-contract steps: to answer product or order questions, create and administer an order, receive payment status, deliver goods, send transactional messages and handle returns.
• Legal obligations: to keep accounting and tax records, provide mandatory consumer information, deal with statutory conformity claims and respond to authorities where the law requires it.
• Legitimate interests: to secure and troubleshoot the website, prevent fraud and abuse, document communications, manage legal claims and improve operational reliability, after considering your rights and interests.
• Consent: to record and honour your optional choice to receive private-drop invitations and early-access messages. Optional analytics, advertising and marketing cookies are not enabled.

When sales open, payment data will be entered in Stripe-hosted Checkout and processed by Stripe. NAZ does not receive or store the full payment card number. We may receive limited transaction information such as payment status, amount, payment-method category and identifiers needed to reconcile, refund or investigate the payment.

Stripe’s role depends on the processing context and may include acting as an independent controller as well as processing data for NAZ. Stripe also applies its own legal terms and privacy notice to its payment services.

We disclose only the data reasonably required for a service or legal purpose. Current providers include Vercel for website hosting and infrastructure, Neon for hosted database services, Stripe for payments and related fraud controls, and Resend for transactional email, website-contact delivery and private-drop messages where you have opted in. The confirmed shipping carrier will receive the delivery and contact information needed to fulfil an order once shipping is configured.

A provider’s role may differ by activity: it may process data on our instructions for one service and act as a separate controller for its own account, security, legal-compliance or regulated-service purposes. Professional advisers, insurers, banks and competent public authorities may also receive data where necessary or legally required. Next.js and Prisma used as software libraries are not listed as separate data recipients unless a separately hosted service is used.

We do not claim that all personal data remains in the European Union. Some providers operate, store data or permit access outside the European Economic Area. In particular, Resend states that customer data is stored in the United States, and the other providers may use international infrastructure or subprocessors.

Where GDPR transfer rules apply, the relevant provider and NAZ must use a recognised safeguard, such as an adequacy decision, the EU–US Data Privacy Framework where applicable, or European Commission Standard Contractual Clauses, with supplementary measures where needed. The mechanism depends on the provider and processing context.

Order, delivery, returns and customer-service records are retained for as long as needed to perform the contract, deal with after-sales issues and establish, exercise or defend legal claims. Invoices and tax-related records are retained for the period required by applicable accounting and tax law, generally at least 10 years where that rule applies.

Contact enquiries not linked to an order are normally kept for up to 2 years after the last substantive communication, unless a longer period is needed for a dispute or legal obligation. Admin login-attempt records are scheduled for deletion after 90 days. Expired private-access tokens and expired or revoked admin sessions have a 30-day operational grace period before deletion. Data connected with an incomplete order is kept only as long as needed for pre-contract steps, security and record keeping. Private-drop preferences remain active until withdrawal; the minimum consent and withdrawal evidence is then retained only as long as reasonably needed to demonstrate compliance or handle a legal claim.

After a qualifying paid order, you may separately choose to receive private-drop invitations and early-access messages by email. This choice is optional, is not required to complete an order and is recorded with the consent wording, time, source and later withdrawal where applicable.

You may unsubscribe through the preference link or contact contact@naz.fashion. Withdrawal stops future promotional messages and does not affect transactional messages required for an order, return, security or legal notice.

If you submit a Work Request through Work with NAZ, we process the identity and contact details, selected area of work, professional profile, work history, skills, education or training, motivation, proposed contribution, availability and role-specific information you provide. If secure uploads are available and you choose to add photographs, we also process those images and their basic file metadata. We use this information only to assess whether your profile may match future NAZ work and to contact you about a relevant opportunity.

Applications are stored on the website infrastructure. Photographs are held in private file storage and delivered only through an authenticated NAZ admin request; the underlying file address is not public. We retain an application and its photographs for six months from submission on the basis of your explicit talent-pool consent, then schedule both the database record and private files for deletion. You may withdraw that consent earlier by contacting contact@naz.fashion. Do not include special-category data, identity documents or information that is not necessary for assessing your work.

Subject to the legal conditions, you may ask contact@naz.fashion for access to your data, correction, deletion, restriction, data portability or information about processing, and you may object to processing based on legitimate interests. We normally respond without undue delay and within one month, although GDPR permits an extension for complex or numerous requests. We may need to verify your identity.

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You have an absolute right to object to personal data being used for direct marketing, and NAZ will stop that use after your objection.

Contact us at contact@naz.fashion or +370 650 92001 with a privacy request or concern. You also have the right to complain to the Lithuanian State Data Protection Inspectorate (VDAI), L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania, or to the supervisory authority in the EU country where you live or work.

• State Data Protection Inspectorate (VDAI)

At launch, the website uses only technologies necessary for functionality and security. Optional analytics and advertising tracking are not enabled, subject to a live technical audit. See the Cookie Policy for details.

We use proportionate organisational and technical safeguards, but no online system can be guaranteed completely secure. We may update this policy where processing, providers or the law changes. The current version and effective date will be published here; material changes will be highlighted where appropriate.