Privacy Policy

This policy explains which personal data we process when you visit Novaora, shop with us or contact us, and which rights you have under the GDPR (DSGVO).

1. Controller

The controller within the meaning of Art. 4 (7) GDPR is the operator of Novaora named in the Impressum: Abdihakin Omar Mohamed; business address as published in the Impressum. Contact: support@novaora.de, +49 178 4270085.

2. What we process and why

2.1 Visiting the website

When you open the store, technically necessary data (IP address, date/time, requested page, browser and device type) is processed by our hosting provider to deliver the pages and ensure security (Art. 6 (1) f GDPR). Server logs are deleted after a short period.

2.2 Local storage (cart, wishlist, consent)

Your cart, wishlist, recently viewed products and cookie preferences are stored in your browser's local storage on your device. This data is technically necessary to operate the store (§ 25 (2) TDDDG) and is not transmitted to us until you check out. You can delete it at any time by clearing your browser data.

2.3 Product catalog and checkout via Shopify

Product data is loaded from our Shopify store. When you proceed to checkout, create a customer account or log in, you are transferred to Shopify Checkout / your Shopify customer account. Shopify International Limited (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, Ireland) processes your order, address and payment data on our behalf as a processor under Art. 28 GDPR; payment data is handled directly by the payment provider you choose. Legal basis: Art. 6 (1) b GDPR (performance of a contract). Shopify's privacy policy: shopify.com/legal/privacy.

2.4 Contact form, email and phone

If you contact us, we process the details you provide (name, email, optional phone and order number, category, subject, message) to handle your request (Art. 6 (1) b and f GDPR). Submissions are transmitted encrypted, stored on our server and forwarded to our customer-care mailbox support@novaora.de. To protect the form against abuse we process a hashed form of your IP address for a short period (rate limiting). Requests are deleted once fully processed and no retention obligations apply.

2.5 Newsletter

If you subscribe, we store your email address to send you our newsletter (Art. 6 (1) a GDPR). You can withdraw consent at any time via the unsubscribe link or by emailing us. Where our Shopify customer list is used for sending, Shopify acts as processor.

2.6 NOVA AI assistant

Messages you type into the NOVA AI chat are sent to our server and processed by an AI language model to generate a reply based on our live catalog and store policies. Please do not enter sensitive personal data (e.g. payment details) in the chat. Chat history is kept only in your browser session. Legal basis: Art. 6 (1) f GDPR (providing a shopping assistant). AI provider: Provider details will be disclosed in this policy before any production AI service processes personal data.

2.7 Order fulfilment by partner suppliers

To deliver your order, we share the necessary shipping data (name, address, ordered items, phone number for the carrier where required) with our fulfilment partners and carriers. Some partners may be located outside the EU/EEA; in that case transfers rely on Art. 49 (1) b GDPR (necessary for the performance of your contract) or EU standard contractual clauses. Partner list: Fulfilment partners may include CJdropshipping and other suppliers selected for the relevant product and destination.

3. Cookies and tracking

Without your consent we only use strictly necessary storage. Analytics or marketing cookies are set only if you choose "Accept all" or enable them in the cookie preferences, and you can change your choice any time via "Cookie settings" in the footer. Details in our Cookie Policy.

4. Recipients and hosting

Hosting provider of this storefront: Cloudflare (storefront hosting and delivery). Shopify (catalog, checkout, customer accounts), payment providers chosen at checkout, email/transactional providers and carriers receive data only as far as necessary.

5. Retention

We keep personal data only as long as necessary for the purposes above. Order and invoice data is retained for the statutory periods under German commercial and tax law (6–10 years, § 257 HGB, § 147 AO).

6. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and the right to withdraw consent at any time with effect for the future. To exercise your rights, email support@novaora.de. You may also lodge a complaint with a supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach.

7. Security

All connections are TLS encrypted. Payment data is never processed by our own systems.

Last updated: September 2026