GDPR Compliance & Cookie Policy

# GDPR Compliance & Cookie Policy

**Last Updated: June 20, 2026**

NookPack (“we,” “us,” “our”) is committed to protecting your privacy and handling your personal data transparently. This page explains how we comply with the **General Data Protection Regulation (GDPR)** for users in the European Economic Area (EEA), the **UK GDPR**, and applicable data protection laws in other jurisdictions.

## Who We Are

**Data Controller:** NookPack
**Contact:** privacy@nookpack.com
**Physical Address:** Available upon request via email

## What Data We Collect

We collect only the data necessary to process your orders and improve your experience:

**We never collect or store full credit card numbers.** All payments are processed by PCI-DSS compliant third-party providers (Stripe, PayPal).

## Legal Basis for Processing (GDPR Art. 6)

We process your data under the following lawful bases:
– **Contractual necessity**: Fulfilling your order (shipping, payment processing)
– **Legitimate interest**: Improving our website, preventing fraud, responding to inquiries
– **Consent**: Marketing emails (you can unsubscribe anytime)
– **Legal obligation**: Tax records, law enforcement requests

## Your Rights Under GDPR

As an EEA/UK resident, you have the right to:

To exercise any of these rights, email **privacy@nookpack.com**. We will respond within 30 calendar days. No fee is charged unless requests are manifestly unfounded or excessive.

## Cookies & Tracking

We use cookies for essential site functionality and analytics. Here’s what’s running:

### Managing Cookies

On your first visit, a cookie consent banner appears. You can:
– **Accept all** — full site functionality + analytics
– **Essential only** — shop and checkout still work, but analytics are disabled
– **Customize** — choose which categories to allow

Change your preferences anytime by clicking “Cookie Settings” in the site footer.

## Third-Party Data Processors

We share data only with services that help us operate:

All processors are bound by Data Processing Agreements (DPAs) and comply with applicable data transfer mechanisms (Standard Contractual Clauses, EU-US Data Privacy Framework).

## Data Retention

## International Data Transfers

NookPack is based in [your jurisdiction]. If you are in the EEA/UK, your data may be transferred to and processed in countries outside the EEA. We ensure adequate safeguards through Standard Contractual Clauses (SCCs) or by relying on adequacy decisions where applicable.

## Data Breach Notification

In the unlikely event of a data breach affecting your personal data, we will:
1. Notify the relevant supervisory authority within **72 hours**
2. Notify affected users without undue delay if the breach poses a high risk to their rights and freedoms
3. Provide details of the breach, likely consequences, and measures taken

## Supervisory Authority

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection authority. For EEA residents, find your authority at [edpb.europa.eu](https://edpb.europa.eu/about-edpb/about-edpb/members_en). For UK residents, contact the [ICO](https://ico.org.uk).

## Children’s Privacy

NookPack is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us immediately.

## Changes to This Policy

We may update this policy periodically. Material changes will be communicated via email (to account holders) and a site banner notice. The “Last Updated” date at the top reflects the most recent revision.

—

**Contact Our Data Protection Officer:**
Email: **privacy@nookpack.com**
Response time: Within 24 hours (business days) / 30 days (GDPR rights requests)