Privacy policy
Last updated: 7 August 2026
This policy describes how we process your personal data when you visit this site and place an order, under Regulation (EU) 2016/679 (GDPR). We process only the data necessary to manage your order, to measure our campaigns, and to prevent fraud, and we do not send marketing communications.
1. Data controller
Starbrand Group s.r.o.
Registered office: Varšavská 715/36, Vinohrady, 120 00 Praha 2, Czech Republic
IČO: 24607754, DIČ: CZ24607754
Email: info@noleacollective.com
2. What data we process
- Order data. First name, last name, email, phone number, delivery address (street, city, postcode, country), and any notes for the carrier. These are the details you enter in the checkout form.
- Payment data. For card payments, the card details are entered and processed directly by our payment provider (Stripe); we do not store the full card number. For cash on delivery, we do not collect payment data.
- Technical and navigation data. IP address, browser and device type (user-agent), referring page, and similar data generated during your visit.
- Conversion measurement data. Click identifiers from advertising campaigns, UTM parameters, any affiliate partner identifier, and a neutral session identifier (txn) that links a visit to an order. These identifiers are collected and stored server-side, not on your device (see Cookie Policy).
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Order fulfilment: processing, shipping, payment, support, and transactional communications (order confirmation, dispatch). | Performance of a contract, Art. 6(1)(b) GDPR. |
| Compliance with legal, accounting, and tax obligations (for example, retention of sales records). | Legal obligation, Art. 6(1)(c) GDPR. |
| Measurement and attribution of conversions from our campaigns (statistical and reporting purposes), fraud prevention, and ensuring security. | Legitimate interest, Art. 6(1)(f) GDPR. |
| Sharing conversion events with advertising platforms (Meta, Google, and similar networks) for campaign optimization and profiling purposes, where this feature is active. | Consent, Art. 6(1)(a) GDPR. |
4. Conversion measurement and advertising platforms
Conversion measurement takes place server-side: we do not use advertising pixels in the browser and we do not install tracking cookies on your device. Click identifiers from campaigns are collected and stored in our systems, not on the device.
This data is processed at two distinct levels with different legal bases:
- Measurement and reporting (without consent). To count and attribute a conversion, calculate any commissions to affiliate partners, and prevent fraud, we process data on the basis of our legitimate interest. This takes place independently of advertising consent.
- Sharing with advertising platforms (only with your consent). Sending conversion events to platforms such as Meta and Google, for ad optimization and profiling, takes place only if you give consent via the banner or a dedicated field at checkout. You can withdraw consent at any time: withdrawal applies going forward and does not affect processing already carried out. Without consent, we do not share events with these platforms.
We do not send marketing emails and there is no newsletter subscription: the only emails you receive relate to your order.
5. Data recipients
- Payment service providers (Stripe) for processing card payments.
- Carriers and logistics providers (for example GLS) for delivery and return management.
- Providers of conversion measurement and fraud prevention services, who process conversion data and related technical identifiers on our behalf or as independent controllers.
- Affiliate networks and partners, to whom, for the purpose of settling commissions, we pass a minimized set of data (click identifier, order value and status, partner sub-identifiers). We do not pass them your personal identifying details or your IP address in readable form.
- Advertising platforms (Meta, Google, and similar networks), solely with your consent (see point 4).
6. Transfers outside the European Economic Area
Data is processed primarily within the European Union. Some recipients, in particular advertising platforms, may also process data outside the EEA. In such cases the transfer takes place on the basis of appropriate safeguards under the GDPR, such as the European Commission’s standard contractual clauses or adequacy decisions.
7. Retention period
- Order data. Retained for the period necessary to perform the contract and thereafter for the period required by applicable legal, accounting, and tax obligations.
- IP address and user-agent in readable form. Anonymized or deleted within 45 days. For fraud prevention purposes we retain, beyond this period, a pseudonymized version of the IP address (an encrypted value that cannot be directly matched to the original IP).
- Proof of consent. Retained for the period necessary to demonstrate the lawfulness of the processing, even after the other data has been deleted.
8. Your rights
As a data subject you have the right, within the limits of the GDPR, to access your data, to rectify or erase it, to restrict processing, and to data portability. You also have the right to object to processing based on legitimate interest and to withdraw any consent given at any time, without prejudice to the lawfulness of processing carried out before the withdrawal.
9. How to exercise rights and complaints
You can exercise your rights by writing to info@noleacollective.com. If you believe that the processing infringes the GDPR, you have the right to lodge a complaint with a supervisory authority: in the Czech Republic with the Office for Personal Data Protection (www.uoou.cz), or with the supervisory authority of the state of your residence or of the alleged infringement.
10. Changes to this policy
We may update this policy. The version published on this page with the relevant date is the one in force.