Privacy Policy

Last updated: October 10, 2026

1. Who we are and what this policy covers

Office Gift Lab is operated by NORYX VENTURES SRL, a company registered in Romania, with the following details:

• Company identification number (CUI): 55273113
• Trade Register number: J2026045656000
• Registered office: Sat Feleacu, nr. 474 A, ap. 2, județul Cluj, 407270, Romania
• Email: officegiftlab@gmail.com
• Telephone: +40 741 730 470

In this Privacy Policy, “Office Gift Lab”, “we”, “us” and “our” refer to NORYX VENTURES SRL. We are the controller of personal information processed for the operation of our store, fulfilment of orders and other purposes described below, except where another organisation acts as a controller for its own purposes, as explained in this policy.

This policy explains how personal information is collected, used, shared and retained when you visit our website, browse or purchase products, contact us or otherwise use our store and related services (the “Services”). Our store currently delivers only within Romania. This delivery restriction does not mean that all personal information is processed or stored in Romania.

Our store is hosted on Shopify. Shopify's role, including its processing for Shopify Network Intelligence, is explained in Section 6.

For matters concerning the processing of personal information, this Privacy Policy takes precedence over any conflicting provision of our Terms of Service. This policy provides information about our practices; visiting the website or reading this policy does not, by itself, constitute consent to optional marketing or non-essential tracking.

2. Personal information we collect

Personal information means information relating to an identified or identifiable individual. Information that has been irreversibly anonymised so that an individual can no longer be identified is not personal information. Pseudonymised information remains personal information where it can still be linked to an individual.

Depending on how you use the Services, we process the following categories:

• Identity and contact details: your name, email address, telephone number, billing address and delivery address, including recipient details you provide when ordering for someone else.
• Order and transaction details: products and variants selected, items placed in your cart, order history, amounts paid, discounts, delivery status, cancellations, returns, refunds and related correspondence. Where needed for invoicing, this may include business invoicing details and information identifying a business contact.
• Payment information: payment method, transaction references, payment status and confirmation, refund details and the payment information made available to us by the payment provider. Card details entered during checkout are processed by the relevant payment provider to authorise and complete payment. Please do not send full card numbers, card security codes or online banking credentials to us by email or other support channels.
• Account information, where you use an available customer account: your account identifier, contact details, saved addresses, preferences and associated order history. Authentication information is processed through the sign-in method offered by Shopify.
• Communications: the information you provide when contacting us, including questions, requests and photographs supplied to explain a product or delivery problem.
• Device and technical information: IP address, browser and device information, cookie identifiers, language settings and similar technical information generated when you access the Services.
• Usage information: pages and products viewed, interactions with the store and checkout, referral information and related browsing activity, subject to your consent choices where required.
• Privacy and communication preferences: cookie choices, any marketing subscription choices, consent records, withdrawals and requests concerning your personal information.

Shopify may also derive information about interests or preferences from interactions with our store, other merchants and Shopify, as described in Section 6.

Please provide only the information needed for your order or request. If you provide someone else's details, for example a gift recipient's delivery address, ensure you are entitled to do so and make this policy available to them.

3. Where personal information comes from

We obtain personal information:

• From you, when you place an order, enter checkout details, use an account, select privacy preferences or contact us.
• From your use of the website, through technical logs, cookies and similar technologies, subject to applicable consent requirements.
• From service providers, including Shopify, payment providers, our production and fulfilment provider and delivery companies, for example payment confirmation or delivery updates.
• From another person acting on your behalf or ordering for you, where they provide your details for an order, delivery or support request.

Shopify may combine information from additional sources for its own processing described in Section 6 and its Consumer Privacy Policy.

4. Why we use personal information and our legal bases

We process personal information under the General Data Protection Regulation (GDPR) using the legal basis appropriate to each purpose.

Orders, payments and delivery

We use identity, contact, order and payment information to take steps you request before a purchase, process and fulfil your order, arrange production and delivery, send order updates and administer cancellations, returns and refunds.

Legal basis: taking steps at your request before entering into a contract and performing our contract with you (Article 6(1)(b) GDPR). Where processing is necessary to meet statutory consumer rights or other legal requirements, we rely on compliance with a legal obligation (Article 6(1)(c)).

Where you are a gift recipient or a contact person for a business customer rather than a party to the contract, our basis for using the necessary contact and delivery details is our legitimate interest in fulfilling the purchaser's order and communicating with the intended recipient or business contact (Article 6(1)(f)).

Customer accounts and support

We use relevant information to provide account functions you request and respond to questions about orders, products or the Services.

Legal basis: contract or requested pre-contractual steps where the request relates to a purchase or requested service; otherwise our legitimate interest in answering enquiries and providing customer support. Statutory complaints and data protection requests may also require processing to comply with a legal obligation.

Accounting, tax and legal compliance

We use transaction and invoicing information to keep required records, fulfil accounting and tax obligations and respond to lawful requests from competent authorities.

Legal basis: compliance with applicable legal obligations, including Romanian accounting and tax legislation.

Security, fraud prevention and legal claims

We use relevant technical, transaction and communication information to protect the store and customers, investigate suspicious activity, prevent misuse and establish, exercise or defend legal claims.

Legal basis: our legitimate interests in maintaining secure services, preventing fraud and protecting our legal rights, or compliance with a legal obligation where applicable. Processing based on legitimate interests must be necessary and balanced against your rights and interests.

Operating and improving the store

We use technical and usage information to maintain website functions, diagnose errors and understand how the Services perform.

Legal basis: contract where necessary to provide a service you request, or our legitimate interest in operating a reliable website. Where optional analytics, personalisation or other non-essential tracking requires consent, we rely on consent (Article 6(1)(a)) rather than treating a business interest as permission to bypass that requirement.

Optional marketing

If you choose to subscribe through an available marketing sign-up option, we use your contact details and recorded preferences to send the communications covered by that choice.

Legal basis: your consent. You can withdraw it at any time by using the unsubscribe mechanism in the communication or contacting us. Subscribing is optional and is not a condition of purchase. Order confirmations, delivery updates and responses to your requests are service communications and are separate from marketing.

This policy does not mean that every possible marketing channel or third-party advertising tool is in use. We will provide appropriate information and obtain any required consent before introducing new processing that requires it. Shopify Network Intelligence is currently enabled and is described separately below.

Required and optional information

Information needed to process payment, fulfil and deliver an order, or issue legally required records is necessary for those purposes. If you do not provide it, we may be unable to accept or fulfil your order or provide the requested service. Optional marketing consent and consent to non-essential cookies are not required to purchase products.

5. Cookies and similar technologies

Our Shopify store uses cookies and similar technologies. These may remember shopping cart contents, support checkout and authentication, keep the website secure, record privacy preferences and, where permitted by your choices, support measurement, personalisation and advertising.

Strictly necessary technologies support functions essential to the service you request. These do not require consent where the applicable legal exemption applies. Non-essential technologies, including optional analytics and advertising tracking, require your prior consent where required by law.

We use Shopify's cookie banner for visitors in Romania to collect relevant choices. You may accept or refuse non-essential categories through the banner and change or withdraw your choices through the site's cookie preferences controls. If you need help accessing or changing your choices, contact us at officegiftlab@gmail.com.

Refusing non-essential cookies does not prevent you from placing an order. Disabling essential cookies through browser settings may prevent parts of the store or checkout from functioning correctly. Deleting cookies or using another browser or device may cause you to be asked for your choices again.

Cookies may expire when a browsing session ends or remain for a defined period, depending on their purpose. Shopify publishes information about its cookies, their purposes and durations in its Cookie Policy. That list describes Shopify technologies generally; the technologies used in a particular visit depend on the store features used and your consent choices.

For Shopify's own processing and additional privacy controls, see the next section.

6. Shopify and Shopify Network Intelligence

Shopify hosts our store and processes information about visits and purchases to provide the platform. For processing carried out on our behalf, Shopify acts as our service provider and processor under its data processing terms.

Shopify Network Intelligence is enabled for our store. This allows Shopify to use information about interactions with our store together with information from interactions with other merchants and Shopify to provide enhanced services. These can support personalisation, relevant advertising, reporting, improvements to products and services, and understanding interactions with stores and advertisements.

Information about your activity is shared with Shopify and relevant third parties, which may be located outside your country, for these purposes. This can include supporting personalised advertising based on activity across merchants and websites. Network Intelligence does not give other merchants access to our store's customer data.

For its own processing to provide these enhanced services, Shopify acts as a controller and is responsible for that processing and the associated rights requests. Shopify relies on consent for personalised advertising and may rely on its own legitimate interests for other purposes described in its privacy information, subject to applicable law. Shopify respects consent choices communicated through its integrated privacy tools.

Read the Shopify Consumer Privacy Policy for details about Shopify's information use, recipients, safeguards and retention. Use the Shopify Privacy Portal to learn about and exercise applicable rights directly with Shopify, including withdrawing consent or objecting to relevant processing. You can also contact us about processing connected with our store.

7. Who receives personal information

We share relevant information only where necessary for the purposes described in this policy and with an appropriate legal basis. Recipients may include:

• Shopify and its supporting providers, for hosting, checkout, store operation and the processing described in Section 6.
• Payment providers and financial institutions, to authorise payments, confirm transactions, process refunds and address fraud or payment disputes.
• Production and fulfilment providers, to prepare and dispatch ordered products and resolve product issues. They receive the order and recipient information needed for their role.
• Delivery companies, to deliver orders, communicate about delivery and handle delivery problems or returns.
• IT, hosting, email and customer communication providers, to operate the website and communications used to assist you.
• Accountants, legal advisers and other professional advisers, where needed for financial records, compliance, advice or legal claims.
• Marketing and advertising service providers, only where their services are used with an appropriate legal basis and any required consent. This includes the Shopify processing explained in Section 6 and does not imply that we currently use every type of advertising platform.
• Public authorities, courts and other recipients, where disclosure is legally required or necessary and lawful to establish, exercise or defend rights.
• Parties involved in a proposed or completed business transfer or restructuring, where disclosure is necessary, lawful and subject to appropriate confidentiality and data protection safeguards.

Providers processing information on our behalf must do so under appropriate contractual arrangements. Some recipients, such as certain payment providers, authorities and Shopify for its own purposes, act as independent controllers and provide their own privacy notices. We do not treat optional advertising disclosures as necessary for fulfilling your purchase.

8. International transfers

Although deliveries are currently limited to Romania, Shopify and other providers may process personal information in other countries, including countries outside the European Economic Area (EEA).

Where personal information is transferred outside the EEA, the applicable transfer must be supported by a lawful mechanism. Depending on the recipient and country, this may be a European Commission adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where necessary.

If UK data protection transfer rules apply to particular information, appropriate safeguards under those rules will also be used where required. You may contact us for information about the safeguards applicable to our transfers and to request a copy, subject to lawful redactions. Shopify provides information about its international processing in its Consumer Privacy Policy linked above.

9. How long we keep information

We retain personal information only for as long as necessary for the relevant purpose and applicable legal obligations. The period depends on the information and the reason for keeping it:

• Orders, delivery, returns and product complaints: for fulfilment and the handling of associated consumer rights, payment disputes and legal claims. Continued retention is assessed against applicable statutory obligations and limitation periods; an unresolved claim or proceeding may require relevant records to be kept until it is concluded.
• Accounting records and supporting documents, including relevant invoices: generally for five years calculated from 1 July of the year following the financial year in which they were drawn up, as provided by Article 25 of Romanian Accounting Law No. 82/1991. Different or longer periods apply where another legal obligation or a lawful preservation requirement requires them.
• Customer account information: for the provision of the account service, taking account of activity and requests to close or delete the account. Closing an account does not require deletion of transaction records that must be retained separately by law.
• Customer enquiries: until the enquiry and any related follow-up are resolved, with further retention only where needed for an associated order, complaint, legal obligation or legal claim.
• Marketing preferences and consent records: for the relevant subscription and as necessary to demonstrate consent and respect withdrawals. After withdrawal, limited information may be retained to record the objection and avoid contacting you again for that marketing purpose.
• Technical and security information: for the operational or security purpose for which it was collected, taking account of incident investigations and relevant legal requirements. Cookies have their own lifetimes as explained in Section 5.

When information is no longer needed, it is deleted or irreversibly anonymised. Information that must be retained for a limited legal purpose is not thereby available for unrelated marketing. Shopify's retention for processing it carries out as a controller is addressed in its own privacy policy.

10. Security

We use appropriate technical and organisational measures to protect personal information, taking account of the nature of the information and the risks involved. Access should be limited to people and providers who need the information for their role.

No website, transmission method or storage system can guarantee absolute security. Please keep account access details and verification codes confidential and avoid sending unnecessary sensitive information through support messages. This does not limit our legal obligations to protect your information or address personal data breaches.

11. Your rights and choices

Under the GDPR, subject to the conditions and exceptions applicable to each right, you may:

• Request access to your personal information and receive information about its processing.
• Request correction of inaccurate information or completion of incomplete information.
• Request erasure where there is no lawful reason for continued retention.
• Request restriction of processing in the circumstances provided by law.
• Request data portability for information you provided where processing is automated and based on consent or contract.
• Object to processing based on legitimate interests, on grounds relating to your particular situation. We must stop unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing is needed for legal claims.
• Object to direct marketing at any time, including profiling related to that marketing. We will stop processing your information for those purposes.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Exercise rights concerning solely automated decisions that produce legal or similarly significant effects, subject to the exceptions and safeguards in Article 22 GDPR. Where applicable, these safeguards include human intervention, expressing your point of view and contesting a decision.

The personalisation described in Section 6 may involve analysing browsing or purchase activity to infer interests and influence the products or advertisements shown to you. Shopify explains its own processing and related choices in its Consumer Privacy Policy and Privacy Portal.

To exercise rights concerning our processing, email officegiftlab@gmail.com or contact us using the details in Section 15. You may also use the relevant privacy controls on the Services. Requests concerning Shopify's independent processing can be made through the Shopify Privacy Portal.

We may request proportionate additional information if reasonably needed to verify your identity. An authorised representative may act for you if their authority can be verified. We do not require unnecessary identification documents as a routine condition of making a request.

We respond without undue delay and normally within one month of receiving a request. Where legally permitted because of the complexity or number of requests, this can be extended by up to two further months; we will inform you within the first month and explain why. Requests are normally handled free of charge. A reasonable fee or refusal is possible only where permitted by law, for example for a manifestly unfounded or excessive request, and we will explain the reasons and available remedies.

You will not be penalised for exercising your rights. However, deleting information required to provide a requested service may mean that we cannot continue that service. Information required for legal obligations or legitimate legal claims may be retained despite an erasure request.

12. Complaints

You may contact us if you have concerns about your personal information. You also have the right to complain directly to a competent data protection supervisory authority without first contacting us.

In Romania, the authority is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP):

• Website: www.dataprotection.ro
• Complaint information: ANSPDCP — Complaints

You may also complain to the supervisory authority in the EU/EEA country of your habitual residence, place of work or the alleged infringement, as applicable. This is without prejudice to your right to seek a judicial remedy.

13. Third-party links and children

The Services may contain links to websites or services operated by third parties. Their processing is governed by their own privacy information. Including a link does not mean we control or endorse their practices, and it does not remove our responsibility for processing for which we are legally responsible. Information you choose to post publicly on a third-party platform may be visible to others.

Our store is intended for an adult audience and does not target children. We do not knowingly seek children's personal information for marketing. If you believe a child has provided personal information inappropriately, contact us so that we can assess the circumstances and take appropriate action, including deletion where required. Please avoid including unnecessary information about children in order notes or support messages.

14. Changes to this policy

We may revise this policy to reflect changes in the Services, our use of personal information or applicable requirements. We will publish the revised version here and update the “Last updated” date.

Where required, we will give additional notice of significant changes and obtain fresh consent before undertaking processing that requires it. Continuing to browse the website does not, by itself, provide consent to new optional marketing or tracking purposes.

15. Contact

For privacy questions or to exercise your rights, contact:

NORYX VENTURES SRL — Office Gift Lab
CUI: 55273113
Trade Register number: J2026045656000
Registered office: Sat Feleacu, nr. 474 A, ap. 2, județul Cluj, 407270, Romania
Email: officegiftlab@gmail.com
Telephone: +40 741 730 470