Privacy Policy
Last updated: 29 September 2026
This Privacy Policy explains how Onyx Nails Cyprus ("we") collects, uses and protects your personal data when you visit onyxnailscyprus.com or buy from us. We apply the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Cypriot data protection law.
1. Data controller
The data controller is Onyx Nails Cyprus. For any question about your data, contact us through the contact form.
2. What data we collect
- Information you give us: name, shipping and billing address, email, phone number, your order details and the messages you send us through the contact form.
- Payment information: payments by card, Apple Pay and Google Pay are handled by our secure payment providers. We do not have access to your full card number.
- Customer account: your account details and order history, if you create an account.
- Newsletter: your email address, only if you subscribe.
- Browsing data: IP address, device and browser type, pages you visited and cookies (see section 7).
3. Purposes and legal basis
| Purpose | Legal basis (Article 6(1) GDPR) |
|---|---|
| Processing, shipping and servicing orders, returns | Performance of a contract (b) |
| Invoicing and keeping accounting and tax records | Legal obligation (c) |
| Answering your questions | Performance of a contract (b) or legitimate interest (f) |
| Newsletter, new shades and offers | Consent (a), which you can withdraw at any time |
| Store security, fraud prevention, improving the website | Legitimate interest (f) |
| Analytics and marketing cookies | Consent (a) |
4. Who we share your data with
We do not sell your personal data. We share it only as far as necessary with:
- Shopify, the platform that hosts the store and the checkout;
- our payment providers for cards, Apple Pay and Google Pay;
- the courier companies ACS Courier and Akis Express, to deliver orders;
- store apps that support functions such as cash on delivery;
- accountants, legal advisers and public authorities, when the law requires it.
5. Transfers outside the EEA
Some providers, such as Shopify, may process data outside the European Economic Area. In these cases the transfer is made with the safeguards provided by the GDPR, such as European Commission adequacy decisions or standard contractual clauses.
6. How long we keep data
- Orders and invoices: as long as tax and accounting law requires.
- Newsletter: until you unsubscribe (every email contains an unsubscribe link).
- Contact messages: as long as needed to help you.
- Customer account: until you ask us to delete it.
7. Cookies
We use essential cookies to run the store, such as the cart and the checkout. Analytics and marketing cookies are used only with your consent, which you give or refuse in the website's cookie banner. You can change your choice at any time in the same banner or in your browser settings.
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw your consent at any time. To exercise your rights, send us a request through the contact form; we will reply within one month.
You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy).
9. Security
The website uses an encrypted connection (HTTPS) and trusted providers. Access to your data is limited to the people who need it to serve you.
10. Changes to this policy
We may update this policy. The date at the top of the page shows the most recent change.