About us
The address of our website is: https://nomiandyou.com.
Thank you for your interest in www.nomiandyou.com, a website administered by the e-commerce company NOMI AND YOU DOO Skopje (hereinafter: NOMI AND YOU). As a personal data controller, NOMI AND YOU pays close attention to respecting privacy and protecting personal data, and for this reason we fully deserve your trust. Protecting personal data is our priority, so please read this privacy policy carefully.
Please note that you can visit our website without disclosing your personal data; however, if you wish to register as our user, we need to process your personal data. The personal data of the users of our website are processed in accordance with the Law on Personal Data Protection.
With this privacy policy, we inform you about the nature, scope and purpose for which we collect, use and process your personal data, about the way in which we protect your personal data, and about your rights arising from the Law on Personal Data Protection.
As a personal data controller, NOMI AND YOU applies a large number of technical and organizational measures to ensure full protection of the personal data processed through this website. Nevertheless, please bear in mind that absolute protection cannot be guaranteed when personal data are submitted over the Internet.
1. Definitions
Our privacy policy is based on the terms used in the Law on Personal Data Protection (hereinafter: LPDP). It should be understandable to our visitors and users. To make sure that this is the case, we will first explain the terms we use. In this privacy policy we use, among others, the following terms:
Personal data
Personal data means any information relating to an identified or identifiable natural person (data subject). An identifiable natural person is a person whose identity can be established directly or indirectly, in particular by reference to an identifier such as a name and surname, a personal identification number, location data or an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.
Data subject
A data subject is an identified or identifiable natural person whose personal data are processed by the controller responsible for the processing of personal data.
Processing of personal data
Processing of personal data means any operation or set of operations performed on personal data or on sets of personal data, whether by automated means or otherwise, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, viewing, use, disclosure by transmission, publication or otherwise making available, alignment or combination, restriction, erasure or destruction.
Restriction of processing
Restriction of the processing of personal data means marking stored personal data with the aim of limiting their processing in the future.
Controller
A controller is a natural or legal person, a state authority, a state body or a legal entity established by the state to exercise public powers, an agency or another body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of the processing of personal data are determined by law, the controller or the specific criteria for its designation are determined by that same law.
Processor
A processor is a natural or legal person, a state authority, a state body or a legal entity established by the state to exercise public powers, an agency or another body which processes personal data on behalf of the controller.
Recipient
A recipient is a natural or legal person, a state authority, a state body or a legal entity established by the state to exercise public powers, an agency or another body to which personal data are disclosed, whether it is a third party or not. However, state authorities and state bodies to which personal data are disclosed in the framework of a particular inquiry in accordance with the law are not regarded as recipients, and the processing of these data by those authorities must comply with the applicable data protection rules according to the purposes of that processing.
Third party
A third party is any natural or legal person, state authority, state body or legal entity established by the state to exercise public powers, agency or other body other than the data subject, the controller, the processor or the persons who, under the direct authority of the controller or processor, are authorized to process the data.
Consent
Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes, by a statement or by a clear affirmative action, which signifies agreement to the processing of his or her personal data.
2. Name and address of the controller
NOMI AND YOU DOO Skopje
ul. Ankarska 29A, Lok 1, Skopje
Republic of North Macedonia
Email: hello@nomiandyou.com
Website: https://nomiandyou.com/
3. Data protection officer
Name and surname: Irena Bogdanov Gogova
Email: hello@nomiandyou.com
4. How do we apply the principles of personal data protection?
Lawful, fair and transparent processing of personal data
We collect and process your personal data on the website on the basis of your consent, for the performance of a contractual obligation as defined in the Terms of Use of https://nomiandyou.com/, or for compliance with a legal obligation (Law on Trade, Law on Electronic Commerce, Law on Consumer Protection, Law on Obligations).
Purpose limitation
We collect and process your personal data on the website for the purposes of registering and creating your user account, for online shopping and for contacting us. Your personal data are not further processed for purposes other than those originally defined.
Limitation of the scope of personal data
The processing of your personal data is limited to the data necessary to fulfil the purposes of the processing. The scope of the personal data is appropriate to what is needed to fulfil the purposes set out in this privacy policy. If a need arises for additional processing of your personal data, we will inform you and ask for your consent to that additional processing.
Accuracy of personal data
We take reasonable measures to verify accuracy and to correct and/or erase inaccurate personal data that we process. In addition to these measures, we enable you to exercise your right to request correction, completion or erasure of personal data in an easy and simple way.
Limitation of the retention periods of personal data
We make sure that your personal data are kept within the periods set out in this Privacy Policy. When those periods expire, or once the purpose of the processing has been fulfilled, your personal data are erased.
Integrity and confidentiality of personal data
We take appropriate technical and organizational measures to protect the personal data collected through this website against unauthorized access, unlawful disclosure and destruction of the data. Access to personal data is limited to persons who are specifically authorized for it.
5. What is the legal basis and the purpose of processing your personal data?
The legal basis for processing your personal data on our website for the purposes of registering a user account and direct marketing is your consent. The legal basis for processing your personal data on our website for the purposes of selling and delivering purchased products is the contractual obligation arising from the Terms of Use and the Law on Electronic Commerce.
6. Which categories of personal data do we process?
“Register”
If you wish to register a user account on our website, you enter your name, surname and email address and choose your own password. You can also sign in with your Google account, in which case we receive your name, surname and email address from Google. For you as a registered user, we process the following personal data:
Name and surname
Email address
Password
Phone and date of birth, if you add them to your profile
Your NOMI Club points and the products you save as favourites
Details of your orders
Delivery address
IP address (stored automatically)
“Log in”
Once you are registered on our website, to log in you need to enter your personal data:
Email address
Password
IP address (stored automatically)
“Shop”
If you wish to buy our product(s) through our website, you need to select the product and choose one of the options offered for the product you want to buy, and then add it to the cart. Once you have added the selected product to the cart, you proceed to checkout, where you enter the following personal data:
Name and surname
Address (street and number)
City and postal code
Phone
Email address
IP address (stored automatically)
“Contact”
If you wish to contact us, you can do so through the contact form, which you use to send us a message. Through this form we process the following personal data:
Name and surname
Email address
The information you enter in your message
“Skin quiz”
If you take the skin quiz, we keep your answers and the products recommended to you, and, if you are signed in or leave your email address, we link them to you. If you add a photo for a more precise recommendation, it is sent together with your answers to our artificial intelligence provider only to prepare the recommendation, and it is not stored. If you ask for a personal routine by email, we keep the email address, the comment and the photo you send with that request, so that we can answer you.
“Chat with Nomi”
If you write to Nomi, our virtual assistant, your messages are sent to our artificial intelligence provider so that an answer can be prepared. If you are signed in, your name, your earlier orders and your points are also used for the answer. We do not store the conversations. Please do not enter sensitive personal data in the chat.
7. Cookies
Our website uses cookies. Cookies are text files stored on your information system through your web browser. Many cookies contain a so-called cookie ID, a unique identifier of the cookie consisting of a string of characters through which the websites visited can distinguish the browsers of their users from other browsers, by means of the unique cookie identifier.
By using cookies on our website, we offer you, our users, better services. Cookies enable us to recognize the users of our website. The purpose of this is to make it easier for you to use our website. If you use cookies on our website, you do not have to enter access data every time you visit the website, because they are taken over by the website and the cookie is stored on your information system.
As a user, you can at any time prevent cookies from being set through our website by using the appropriate setting of your web browser, or permanently refuse the setting of cookies, and you can also delete cookies that have already been set at any time through your web browser or other software programs. If you disable the setting of cookies in your web browser, you will not be able to use all the functions of our website in full.
When you first visit the website, the cookie notice gives you a choice. If you choose “Accept recommended”, we also use Google's analytics and advertising cookies, loaded through Google Tag Manager, to measure visits and the effect of our ads. If you choose “Decline”, only the cookies the website needs in order to work are set, such as those for your cart and your sign-in. Your choice is remembered for 180 days.
8. Collection of general data and information
Our website collects a range of general data and information when you access it. These general data and information are stored in the server log files. The data and information collected may relate to (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which the accessing system reaches our website, (4) the date and time of access to the website, (5) the Internet Protocol address (IP address), (6) the Internet service provider of the accessing system and (7) other similar information that may be used in the event of an attack on our information system.
When using these general data and information, we do not draw any conclusions about the user. Instead, we need this information to (1) deliver the content of our website correctly, (2) optimize the content of our website, (3) ensure the long-term viability of our information system and website technology, and (4) provide law enforcement authorities with the information needed for prosecution in the event of a cyber attack. We therefore analyze and collect statistical data anonymously, with the aim of ensuring an optimal level of protection for the personal data we process. The anonymous data from the server log files are stored separately from your personal data.
9. Links to other websites
When visiting and using www.nomiandyou.com, you may be shown links to other websites that we do not manage. If you click on a third-party link, you will be directed to that third party's website. We advise you to review the Privacy Policy of every website you visit.
www.nomiandyou.com has no control over and assumes no responsibility for the content, policies or privacy practices of third-party websites or services.
10. Protection of personal data when using the cPay module of CaSys as payment processor
Our website integrates the cPay component of International Card System AD Skopje (CASYS). cPay is a payment service that enables cashless payment for products and services on the Internet. cPay is a technical procedure through which we, as an online seller, immediately receive confirmation of payment. This enables us to deliver the products, or the buyer to collect them, immediately after the order.
If you choose “Card (Visa / Mastercard)” as the payment option in our online shop during the ordering process, your data will be forwarded to CASYS. By selecting this payment option, you agree:
That your personal data required for the payment process are forwarded to CASYS. The data exchanged with CASYS for the purposes of carrying out the payment process and preventing misuse are: start date, end date, order number, identification number, name and surname of the payer, name of the bank, type and status. You have the right to withdraw the consent given to CASYS for the processing of your personal data. Withdrawing consent has no effect on the personal data that must be processed, used or transmitted for the purposes of the payment. The applicable data protection provisions of CASYS can be found at the following links:
11. Do we transfer personal data?
To run the website www.nomiandyou.com we use service providers that process personal data on our behalf. Some of them are based in the United States of America, which involves a transfer of personal data to that country:
Vercel (USA): hosting of the website;
Neon (USA): the database, which is kept on servers in Frankfurt, Germany;
Bunny (Slovenia): storage and delivery of images;
Resend (USA): sending emails about your orders and account, and the newsletter if you subscribe;
Anthropic (USA): artificial intelligence for the chat with Nomi and for the skin quiz;
Google (Ireland and USA): sign-in with a Google account, and analytics and ad measurement if you accept those cookies;
International Card System AD Skopje (CASYS): card payments, as described in section 10.
The courier service that delivers your order receives your name and surname, delivery address and phone number.
These providers process the data only to provide their service to us, under their data processing terms.
12. How long do we keep personal data?
We process and keep your personal data only for the time necessary to achieve the purpose for which they were collected.
If the purpose for which they are processed has ceased, or if the retention period prescribed in our internal acts expires, the personal data are erased or their processing is restricted. If you decide to withdraw your consent to the processing of your personal data for any of the purposes of using the website www.nomiandyou.com, your personal data will be erased.
If you have used the online shopping service, all documents and records containing your personal data that relate to completed sales and payments are kept for the statutory periods set for keeping accounting documentation and records relating to payment transactions.
13. How do we protect your personal data?
Your personal data processed for the purposes of using www.nomiandyou.com are processed in accordance with the Law on Personal Data Protection, the Law on Trade, the Law on Electronic Commerce, the Law on Consumer Protection, the Law on Electronic Documents, Electronic Identification and Trust Services, and the Law on Obligations.
Passwords are stored only in encrypted (hashed) form, so neither we nor anyone else can read them. If you forget your password, you set a new one through a link that we send to your email address and that is valid for a limited time.
Communication on www.nomiandyou.com is secured with the https (Hypertext Transfer Protocol Secure) protocol and encrypted using the TLS (Transport Layer Security) protocol.
We also take appropriate security measures to protect against unauthorized access, unlawful disclosure or destruction of the data. Access to personal data is limited exclusively to authorized persons, and it is granted for the purpose of ensuring the smooth operation of www.nomiandyou.com.
14. How do we restrict the processing of your personal data?
We process and keep your personal data only for the time necessary to achieve the purpose for which they were collected and are processed.
15. Will we disclose your personal data in accordance with the law, and to whom?
We will disclose your personal data to the competent state authorities for the purposes of conducting proceedings in accordance with the law. We will keep a written record of every disclosure of your personal data and will inform you in an appropriate manner.
If in the future a need arises to disclose the data to a third party in a way not provided for in this policy, we will ask for your consent where this is necessary and will supplement the Privacy Policy before that processing begins.
16. What are your rights as data subjects?
a) Right to confirmation
As a data subject (user, buyer, visitor), you have the right to obtain confirmation from NOMI AND YOU as to whether we process your personal data.
b) Right of access
At any time and free of charge, you have the right to obtain information from NOMI AND YOU about your personal data, as well as a copy of these data. The LPDP guarantees you access to the following information: the purpose of the processing; the categories of personal data; the recipients or categories of recipients to whom the personal data have been or will be disclosed; where possible, the period for which the personal data will be kept or, if that is not possible, the criteria used to determine that period; the existence of the right to request correction or erasure of personal data or restriction of the processing of personal data; the existence of the right to lodge a request with the Personal Data Protection Agency; where the personal data are not collected from you, all available information about their source; the existence of automated decision-making, including profiling, and in those cases, relevant information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
c) Right to correction
You have the right to have your inaccurate personal data corrected without undue delay. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed.
d) Right to erasure (“right to be forgotten”)
You have the right to request the erasure of your personal data without undue delay. We are obliged to act on such a request if one of the following conditions is met: the personal data are no longer needed for the purposes for which they were collected or processed; you have withdrawn the consent on which the processing is based and there is no other legal basis for the processing; you have objected to the processing; the processing of the personal data is unlawful; there is a legal obligation to erase the personal data.
e) Right to restriction of processing
You have the right to restrict the processing of your personal data if one of the following conditions is met: you contest the accuracy of the personal data, for a period that enables us to verify their accuracy; the processing is unlawful, but you oppose the erasure of the personal data and request the restriction of their processing instead; NOMI AND YOU no longer needs to process your personal data, but you need them for the establishment, exercise or defence of your legal claims; you have objected to the processing, pending verification of whether our legitimate interests override your interests.
f) Right to data portability
You have the right to receive the personal data that we process by automated means on the basis of your consent in a structured, commonly used and machine-readable format, or to request that we transmit these data to another controller, where this is technically feasible.
g) Right to object
You have the right to lodge an objection with NOMI AND YOU against the processing of your personal data for direct marketing purposes. In the event of an objection, we will no longer process your personal data for this purpose.
h) Right to withdraw consent
You have the right to withdraw your consent to the processing of your personal data at any time.
The data protection officer will act on your request without delay.
For all questions regarding the protection of personal data, contact the data protection officer at:
Email: hello@nomiandyou.com
17. Is there an age limit for using nomiandyou.com?
www.nomiandyou.com is not intended for use by persons under 16 years of age. If you learn that your child under the age of 16 has disclosed personal data on www.nomiandyou.com without your consent, please notify the data protection officer at their email address.
If we discover that a person younger than 16 has registered, we will take all measures to erase the personal data shared by that person and will delete the user profile.
18. Changes to the Privacy Policy
Taking into account the experiences of users and upgrades to the functionality of www.nomiandyou.com, we will periodically supplement this Privacy Policy. We encourage you to follow the changes and additions to the Privacy Policy, so that you are informed in good time about the protection of the processing of your personal data.
19. Right to lodge a request with the Personal Data Protection Agency
If you believe that we do not process personal data in accordance with the LPDP, you can contact:
Personal Data Protection Agency
Blvd. “Goce Delchev” No. 18, Skopje