Your Privacy Matters

Privacy
Policy

We are committed to protecting your personal data and being fully transparent about how we collect, use, and safeguard it — across every country we serve.

UKGDPR &
DPA 2018

30^dResponse
Time

0Data Sold
Ever

43⁺Countries
Protected

UK GDPR & DPA 20180 Data Sold30-Day Response43 Countries ProtectedYour RightsTransparent & SecureUK GDPR & DPA 20180 Data Sold30-Day Response43 Countries ProtectedYour RightsTransparent & Secure

Key FactsUK GDPR · Contact · Response · Data Sales

Governed By UK GDPR & Data Protection Act 2018

Contact hello@novvaliving.com

Response Time Within 30 days of your request

Data Sales We never sell your personal data — guaranteed

Our Commitment

Your data.
Protected.
Always.

We never sell your personal data. We are fully transparent about how we collect and use it, and we respond to all data requests within 30 days.

1. Who We Are

Novva Living is a United Kingdom-based online retailer. For all privacy-related enquiries, please contact us at hello@novvaliving.com or via Live Chat on our website.

2. Personal Data We Collect

Identity & contact data — name, email, billing and delivery address, telephone number
Transaction data — purchase details, payment records, and order history
Account data — username, password, and account preferences
Technical data — IP address, browser type, device information, and cookies
Usage data — pages visited, links clicked, and on-site behaviour
Communications data — live chat messages, emails, and customer service interactions
Marketing preferences — your opt-in choices for marketing communications

3. How We Use Your Data

Processing and fulfilling your orders (performance of a contract)
Managing your account (performance of a contract)
Providing live chat and email support (legitimate interests)
Sending order confirmations and shipping updates (performance of a contract)
Sending marketing communications where opted in (consent)
Improving our website and services (legitimate interests)
Fraud prevention and security (legitimate interests / legal obligation)
Complying with legal and regulatory obligations (legal obligation)

4. Sharing Your Data

We do not sell your personal data. We may share it with trusted third parties including:

Shopify Inc. — our e-commerce platform provider
Payment processors — to securely handle transactions
Delivery and logistics partners — to fulfil and ship your orders
Analytics providers — such as Google Analytics
Advertising platforms — such as Meta and TikTok
Live chat and email marketing providers
Legal and regulatory authorities — where required by law

5. Your Rights

Albania (EU GDPR-aligned, Law No. 9887): Right to access, correct, and withdraw consent. Lodge complaints with the IDP.

Argentina (PDPA / Law 25.326): Right to access, rectify, and delete personal data. Lodge complaints with the AAIP.

Armenia (Law on Personal Data Protection): Right to access, correct, and withdraw consent. Lodge complaints with the Personal Data Protection Agency.

Australia (Privacy Act 1988): Right to access, correct, and lodge a complaint with the OAIC.

Austria (EU GDPR): Full GDPR rights. Lodge complaints with the DSB.

Bahamas: Right to manage your personal data. Contact us at hello@novvaliving.com for any data requests.

Barbados (Data Protection Act 2019): Right to access, correct, and withdraw consent. Lodge complaints with the Data Protection Commissioner.

Belgium (EU GDPR): Full GDPR rights. Lodge complaints with the APD/GBA.

Bosnia (PDPA 2006): Right to access, correct, and withdraw consent. Lodge complaints with the Personal Data Protection Agency of BiH.

Brazil (LGPD 2020): Right to access, correct, delete, and object. Lodge complaints with the ANPD.

Canada (PIPEDA): Right to access, correct, and withdraw consent.

Chile (PDPA / Law 19.628): Right to access, rectify, and delete personal data. Lodge complaints with the CPLT.

Czech Republic (EU GDPR): Full GDPR rights. Lodge complaints with the UOOU.

Denmark (EU GDPR): Full GDPR rights. Lodge complaints with Datatilsynet.

Estonia (EU GDPR): Full GDPR rights. Lodge complaints with the AKI.

Finland (EU GDPR): Full GDPR rights. Lodge complaints with the Tietosuojavaltuutettu.

France (EU GDPR & Loi Informatique et Libertés): Full GDPR rights. Lodge complaints with the CNIL.

Germany (EU GDPR): Full GDPR rights. Lodge complaints with the BfDI or your regional authority.

Greece (EU GDPR): Full GDPR rights. Lodge complaints with the HDPA.

Hungary (EU GDPR): Full GDPR rights. Lodge complaints with the NAIH.

Ireland (EU GDPR): Full GDPR rights. Lodge complaints with the DPC.

Italy (EU GDPR): Full GDPR rights. Lodge complaints with the Garante.

Japan (APPI 2022): Right to access, correct, and request cessation of use. Lodge complaints with the PPC.

Kazakhstan (PDPL 2023): Right to access, correct, and withdraw consent. Lodge complaints with the MDIAP.

Luxembourg (EU GDPR): Full GDPR rights. Lodge complaints with the CNPD.

Malaysia (PDPA 2010): Right to access, correct, and withdraw consent. Lodge complaints with the PDPC.

Netherlands (EU GDPR): Full GDPR rights. Lodge complaints with the Autoriteit Persoonsgegevens (AP).

New Zealand (Privacy Act 2020): Right to access, correct, and lodge a complaint with the OPC.

Nigeria (NDPA 2023): Right to access, rectify, delete, and object. Lodge complaints with the NDPC.

Norway (EU GDPR via EEA): Full GDPR rights. Lodge complaints with Datatilsynet.

Poland (EU GDPR): Full GDPR rights. Lodge complaints with the UODO.

Portugal (EU GDPR): Full GDPR rights. Lodge complaints with the CNPD.

Romania (EU GDPR): Full GDPR rights. Lodge complaints with the ANSPDCP.

Serbia (LPPD 2018): Right to access, rectify, erase, and object. Lodge complaints with the Commissioner for Information.

Singapore (PDPA 2012): Right to access, correct, and withdraw consent. Lodge complaints with the PDPC.

South Africa (POPIA 2013): Right to access, correct, delete, and object. Lodge complaints with the Information Regulator.

Spain (EU GDPR): Full GDPR rights. Lodge complaints with the AEPD.

Sri Lanka (PDPA 2022): Right to access, correct, and withdraw consent. Lodge complaints with the Data Protection Authority.

Sweden (EU GDPR): Full GDPR rights. Lodge complaints with the IMY.

Switzerland (nFADP 2023): Right to access, correct, and object. Lodge complaints with the FDPIC.

Ukraine (Law on Personal Data Protection): Right to access, correct, delete, and object. Lodge complaints with the Ombudsman.

UK (UK GDPR): Right to access, rectify, erase, restrict, port your data, object to processing, or withdraw consent at any time.

US (CCPA/CPRA): Right to know, delete, and opt out of the sale or sharing of your data.

To exercise any of these rights, contact us at hello@novvaliving.com. We will respond within 30 days.

6. Cookies & Tracking

Essential cookies — required for the website to function
Analytics cookies — to understand how visitors use our site (e.g. Google Analytics)
Marketing cookies — to deliver relevant advertising (e.g. Meta Pixel, TikTok Pixel)

You may manage your cookie preferences via our cookie banner or browser settings.

7. Security & Retention

We implement reasonable technical and organisational measures to protect your data. Our website is hosted on Shopify, which maintains PCI DSS compliance for payment data.

Order and transaction data — retained for 7 years (UK legal requirement)
Marketing data — until you withdraw consent or unsubscribe
Live chat records — up to 2 years
Account data — for the duration of your account plus a reasonable period thereafter

8. Changes to This Policy

We may update this Privacy Policy periodically. Any changes will be posted on this page. We encourage you to review this policy regularly.

Questions about your data?

Want to exercise your rights or have a privacy concern? Contact us and we’ll respond within 30 days — guaranteed.

UK residents may also contact the ICO: ico.org.uk · ☎ 0303 123 1113