Privacy policy

Who is responsible

This policy explains how we process personal data when you use this storefront, place an order, personalise a product, or contact us. The details depend on the service you use.

Hosting and technical access

This storefront is hosted by Vercel Inc. When you open a page, technical connection data, such as your IP address, requested page, browser details and time of access, is processed to deliver and secure the site. We also use aggregate hosting request counts to understand page traffic, without adding visitor identifiers or browser tracking. These counts are not unique visitor counts. We rely on our legitimate interest in operating and improving our website under Art. 6(1)(f) GDPR. Vercel is a US provider and may process data outside the EEA. Its published data-processing terms provide for EU Standard Contractual Clauses and applicable adequacy mechanisms. See Vercel’s data-processing terms.

Shopify, cart and checkout

Shopify processes product, cart, checkout and order data. We use these details to prepare or fulfil your order, handle payment and delivery, and meet legal obligations under Art. 6(1)(b) and (c) GDPR. Recipients also include the payment and delivery providers selected for your order. Shopify’s EEA provider is Shopify International Ltd. in Ireland; its services may involve processing outside the EEA. See Shopify’s data-processing terms and transfer safeguards. At checkout, Shopify's own privacy information also applies. A necessary, HTTP-only cart cookie called nava-shopify-cart keeps your cart available on this storefront for up to 14 days.

Personalised products

The consumer candle configurator sends your selected options and any text you enter to Shopify as cart and order details when you add the product to your bag. Please do not enter sensitive personal information in free-text fields.

Contact and Private Label enquiries

When you submit an enquiry, we process your name, email address, message and any order or project details you provide to answer your request. The Private Label estimator keeps your choices in your browser until you submit them; copying a summary does not send it. Our Vercel-hosted form sends submitted enquiries through Zoho Mail to NAVA’s contact or Private Label inbox. Your email address is used as the reply address. We use the information under Art. 6(1)(b) GDPR for pre-contractual enquiries or Art. 6(1)(f) GDPR for other enquiries. Technical request data and short-lived hashed identifiers are used to prevent abuse under Art. 6(1)(f) GDPR. We retain correspondence only as long as needed for the request and any applicable legal retention duties. Submitting an enquiry does not subscribe you to marketing. Newsletter signup is currently unavailable.

Optional analytics

When analytics is enabled on this storefront, we ask for your permission before sending usage events to PostHog EU Cloud. These cover pages and products viewed, successful bag additions, checkout starts, successful enquiry submissions, as well as device/browser type, visit sessions, landing-page categories, referring domains and selected campaign labels. We collect approved campaign labels only, not arbitrary query strings or advertising click identifiers. We do not send form contents, email addresses, personalised candle text, search terms or checkout links. We record a random sample of approximately 10% of consented visits to understand navigation difficulties. Replay text, inputs and element attributes are masked; forms, embedded frames and custom candle previews are blocked. Contact, personalisation, quotation-estimator and withdrawal pages are excluded from recording. Console logs, network contents and automatic click-event capture are disabled. Recordings are retained for 30 days. PostHog receives the technical connection data needed to receive events, including your IP address; location enrichment is disabled.

Your choice is stored in your browser for up to 180 days. If you allow analytics, a random identifier and PostHog session information are stored in browser session storage to group that tab’s activity. A visit session expires after 30 minutes of inactivity, with a maximum duration of 24 hours. This does not identify you across browsers or later tabs. You can withdraw permission for future collection using Privacy choices in the footer, which also clears the optional analytics identity and session storage. Data collected before withdrawal may already have been sent or queued for delivery. The legal basis for optional analytics is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. When you start checkout with analytics allowed, we also pass this random identifier and the storefront environment to Shopify as cart attributes. They may become part of your order metadata. This allows a configured purchase pixel to connect a purchase to the same browsing session, only when Shopify’s separate analytics privacy controls also allow it. Withdrawing permission removes the browser identifier; it does not erase events or order metadata already stored. If analytics is not configured, no analytics events are sent and the consent panel is not shown.

Withdrawal declarations

Our withdrawal form processes your name, email address, order reference and the goods you identify. We send the declaration to NAVA through Zoho Mail and send an acknowledgement to your supplied email address with its contents, reference and receipt time. This records receipt; it is not a decision about eligibility or a refund. The legal basis is Art. 6(1)(b) and (c) GDPR. Technical abuse-prevention processing relies on Art. 6(1)(f) GDPR.

Recipients and international transfers

Vercel hosts the storefront, Shopify processes commerce, Zoho Mail handles correspondence and PostHog processes consented analytics. Our mail service uses Zoho’s EU endpoint; support or subprocessor access can involve other countries. PostHog EU Cloud receives analytics in the EU, while its provider is PostHog Inc. Where processing involves a country without an applicable adequacy decision, the providers’ published terms provide for EU Standard Contractual Clauses. Their terms and safeguard information are available from Vercel, Shopify, Zoho and PostHog. Contact us for information or copies of the safeguards relevant to your data.

How long we keep data

Cart storage lasts up to 14 days and your selected delivery country up to 180 days. Analytics consent expires after 180 days; tab/session identifiers end with the browser session. Replay recordings are retained for 30 days. For order, payment and withdrawal records, retention is determined by the applicable commercial and tax obligations and the need to establish, exercise or defend claims. Enquiry correspondence is kept while the request is being handled and for any resulting contract, statutory retention or claim period. Vercel request and runtime logs available to us are retained for 30 days under the current Observability Plus configuration. Vercel may separately keep data it processes for its own security or legal purposes under its privacy policy. PostHog analytics events and their metadata are retained for one year on our current free plan. Short-lived form deduplication and hashed rate-limit records expire after one hour. You may contact us to ask for the retention period applicable to your records.

Other contact and your rights

When you contact us, we process the details you provide to respond. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries or Art. 6(1)(f) GDPR for other enquiries. Subject to the GDPR, you may request access, correction, deletion, restriction or portability of your data, object to certain processing, and withdraw consent for future processing. You can contact us at the address above. You may also complain to the Berlin Commissioner for Data Protection and Freedom of Information.