Privacy Policy

1) Who we are (Data Controller)

NATYKA (“NATYKA”, “we”, “us”, “our”)
Registered address: Kuwait, Kuwait City, Sharq, block 5, Khalid Ibn Al-Walid Street, KIPCO tower, floor 41
Contact : info@natyka.tn
If applicable, Data Protection Officer (DPO): Adel Ali

This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our websites natyka.tn and natyka.store, purchase our products, or interact with us.

2) Scope & applicable laws

We process personal data in accordance with applicable data protection laws, including the EU GDPR and, where relevant, the UK GDPR. If you access our Services from outside these regions, local laws may also apply.

3) Categories of personal data we process

• Identification & contact: name, email, phone, shipping/billing address.

• Account data: username, password (hashed), preferences, order history.

• Order & payment data: products purchased, amounts, invoice details, payment status. (We do not store full card details; payments are handled by our payment providers.)

• Communications: messages to customer support, reviews, comments.

• Marketing: newsletter sign-ups, consent status, campaign interactions.

• Technical & usage: IP address, device/browser info, cookies, analytics identifiers, page views, referring URLs.

• Media uploads: images you upload (we recommend removing EXIF/GPS data before upload).

4) Purposes & legal bases

We process your data for the following purposes and legal bases:

• Account creation & management – to create and maintain your account.
  Legal basis: performance of a contract.

• Order processing & delivery – to fulfill and deliver your purchases, handle returns and warranty.
  Legal basis: performance of a contract; legal obligation (billing).

• Customer service – to answer questions and provide support.
  Legal basis: performance of a contract; legitimate interest.

• Payments – via third-party payment processors (e.g., Stripe/PayPal).
  Legal basis: performance of a contract; legal obligation (anti-fraud).

• Website operation & security – to run, secure, and improve our site (e.g., load balancing, fraud/spam prevention).
  Legal basis: legitimate interest.

• Analytics & performance – to measure traffic and improve UX (e.g., first-party analytics or Google Analytics/Matomo).
  Legal basis: consent (where required) or legitimate interest (configured privacy-friendly).

• Marketing & newsletters – to send offers and news if you subscribe or consent.
  Legal basis: consent (you can withdraw at any time).

• Legal compliance – to comply with tax, accounting, or regulatory obligations.
  Legal basis: legal obligation.

5) Comments & Gravatar

When you leave a comment, we collect the data shown in the comment form, along with your IP and browser user-agent to help prevent spam. An anonymized string (hash) from your email may be sent to Gravatar to check if you use it. After approval, your profile image is public next to your comment. See Gravatar privacy: https://automattic.com/privacy/.

6) Embedded content

Articles may include embedded content (videos, images, etc.) from other sites. Embedded content behaves as if you visited the other site, which may collect data, use cookies, and track your interaction—especially if you have an account and are logged in there.

7) Cookies & similar technologies

We use cookies and similar technologies to operate the site, enable basic functions (cart, login), measure performance, and—where you consent—support marketing and personalization.

• Strictly necessary cookies – required for core site features (e.g., cart, checkout, login, security).

• Functional cookies – remember preferences (e.g., language).

• Analytics cookies – measure traffic and usage (aggregated or pseudonymous).

• Marketing cookies – personalize ads and measure campaigns.

Where required by law, we use a cookie consent banner allowing you to accept or reject non-essential cookies. You can update your preferences at any time via the banner’s “Manage Cookies” link.

Example Cookie Table (edit to match your stack)

* Adjust durations to your actual configuration and local requirements.

8) Payment processing

Payments are processed by Stripe/PayPal/…. These providers act as independent controllers for certain processing (e.g., anti-fraud, regulatory checks). We receive payment status but do not store full card numbers. See their privacy policies: Stripe , PayPal, etc.

9) Anti-spam & security

We may use automated anti-spam and security services (e.g., reCAPTCHA, Akismet) to protect our forms and site. These services may collect technical data (IP, user-agent) to detect abuse. See provider policies: Akismet, reCAPTCHA, etc.

10) Subprocessors & recipients

We share data with trusted service providers who help us operate our business, under data-processing agreements:

• E-mail & newsletters: info@natyka.store

• Analytics/metrics: Google Analytics

• Payments: Stripe/PayPal

• Customer support/chat: Respond.io

• Anti-spam/security: reCAPTCHA

• Order logistics: Courier / 5PL if any

We may also disclose data: (i) to comply with laws or lawful requests; (ii) to protect our rights or users; (iii) during corporate transactions (merger, acquisition), subject to safeguards.

11) International transfers

If data is transferred outside the EEA/UK (e.g., to the United States), we use appropriate safeguards such as EU Standard Contractual Clauses (and UK equivalents) and conduct transfer risk assessments where required.

12) Retention periods

We keep data only as long as necessary for the purposes described above:

• Account data: while the account is active and up to 5 years after inactivity.

• Orders & invoices: up to 10 years (or as required by tax/accounting law).

• Customer support: 5 after the ticket is closed.

• Marketing data: until you withdraw consent or after 5 years of inactivity.

• Cookies/analytics: per the durations listed in the Cookie Table.

• Security logs: typically 12 months.

13) Your rights

Subject to conditions and local law, you have the right to:

• Access your data and obtain a copy;

• Rectify inaccurate or incomplete data;

• Erase your data (“right to be forgotten”);

• Restrict or object to certain processing;

• Data portability in a commonly used, machine-readable format;

• Withdraw consent at any time (for consent-based processing);

• Lodge a complaint with your local data protection authority.

To exercise your rights, contact info@natyka.tn. We may verify your identity before responding.

14) Children’s privacy

Our Services are not directed to children under 16 (or the age required by local law). We do not knowingly collect personal data from children. If you believe a child provided us data, please contact us to delete it.

15) Automated decision-making

We do not engage in automated decision-making producing legal or similarly significant effects on you without human involvement. If this changes, we will inform you and explain your rights.

16) How we protect your data

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (HTTPS), access controls, least-privilege principles, and regular monitoring. No internet transmission is 100% secure, but we strive to protect your information.

17) Changes to this Policy

We may update this Privacy Policy from time to time. We will post the new version with an updated Effective date above, and, where appropriate, notify you by email or on-site notice.

18) Contact

For any privacy questions or requests:
Email: info@natyka.tn
Postal: Kuwait, Kuwait City, Sharq, block 5, Khalid Ibn Al-Walid Street, KIPCO tower, floor 41
If applicable, you may also contact our DPO at: Data.protection@natyka.store.