Privacy policy
You should know what happens to your personal data when you shop. This notice explains our purposes, legal grounds, service providers and your choices.
Who controls your data
- Trading name
- NailMarket
- Operator
- Belom group OÜ
- Registered office and return address
- Narva mnt 7a, Tallinn, 15172, Estonia
- Commercial register
- Estonian e-Business Register; code 17614732
- VAT number
- EE103037239
- info@belom.eu
- Website
- nailmarket.eu
The operator above is the controller for the store’s customer relationship, order handling and support. Contact info@belom.eu to ask a privacy question or exercise your rights. Shopify provides the commerce platform and also acts as a controller for certain services described below.
What we collect
We receive the information you provide when ordering, creating or using an account, contacting us or subscribing: name, email, telephone where needed for delivery, postal addresses, optional company details, products, order history and the content of your message. Payment providers process payment credentials; we receive the transaction details and status needed to manage the order. Do not put a card number or account password in a support message.
Our platform also processes technical information such as IP address, browser, device, session and security information. Optional analytics or advertising data depends on the services enabled and your cookie choices. See Cookies Policy.
Why we use data and the legal grounds
| Purpose | Data involved | Legal ground |
|---|---|---|
| Orders, payment, dispatch and returns | Contact details, addresses, order and payment status | Performance of a contract, GDPR Art. 6(1)(b) |
| Accounts and requested support | Account information and messages | Contract, or legitimate interest in answering a non-contract enquiry, Art. 6(1)(f) |
| Optional AI shopping assistance | Your question, relevant conversation, product context and current basket product identifiers with every question submitted through the general shopping or basket assistant | Legitimate interest in answering your voluntary shopping enquiry, Art. 6(1)(f); you can object and use human support instead |
| Tax and accounting records | Invoices, transactions and legally required details | Legal obligation, Art. 6(1)(c) |
| Fraud prevention, security and legal claims | Technical records, transactions and relevant correspondence | Legitimate interests, Art. 6(1)(f), subject to your rights |
| Email marketing and optional tracking | Email, subscription and consent preferences; optional usage data | Consent where required, Art. 6(1)(a) |
We do not require newsletter consent to place an order. You can unsubscribe in a marketing email, contact us or change optional cookie choices. Order and service messages continue where necessary to fulfil your purchase.
Shopping assistance
If you choose to use our automated shopping assistant, your question, relevant conversation and product context are processed by our service and the OpenAI API. Each question submitted through the general shopping or basket assistant automatically also includes identifiers of products currently in your basket and their relevant public catalogue details, even if the question is not about your basket. The assistant opened for an individual product uses that product as its context instead. The general shopping or basket request automatically supplies up to 30 distinct product identifiers; it does not automatically include basket quantities, an order number or delivery contact fields. Information you type into a question is still part of that request. This may involve processing outside the EEA, including the United States. The international-transfer safeguards described below apply. The assistant is AI, not a person. It can help find products and explain catalogue information. It is not a clinician and does not make decisions with legal or similarly significant effects about you.
Do not send health records, payment credentials or other sensitive information to the assistant. A question about a medical condition should be directed to an appropriate healthcare professional. The current service keeps conversation context in browser memory for the session; it does not save a customer chat archive in our application. Requests disable persistent response storage at the AI provider. OpenAI may retain abuse-monitoring logs for up to 30 days, or longer where legally required, and does not use API inputs or outputs for model training by default. See OpenAI’s API data controls. You can use the store without using the assistant and can ask a person for order support through Contact.
Who receives information
We share only the information needed for the relevant purpose with commerce and hosting providers, payment providers, delivery partners, support and communications providers, accounting advisers and technology providers supporting requested shopping assistance. A carrier needs delivery contact details and an address; it does not need your complete browsing history. Authorities or professional advisers may receive data where legally required or necessary for a claim. Providers’ responsibilities depend on the service and their contract.
Shopify processes store interactions to provide and improve its platform. Shopify Network Intelligence is enabled for the store. This enhanced service can use information about interactions with this and other merchants to improve services, personalisation and advertising, with Shopify responsible for that processing and optional tracking subject to applicable consent choices. Read the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal for rights relating to Shopify’s own processing.
Retention and international processing
Order and accounting records are kept for the statutory retention period; Estonian accounting source documents are generally retained for seven years from the end of the relevant financial year. Name, order contact information and a deliverable address are needed to fulfil an order; if you do not provide the required checkout fields, we cannot process or deliver it. Company details are optional unless needed for the requested business invoice. Marketing consent and AI assistance are optional.
Other account, support, security and assistance data is retained only for the purpose for which it is needed, taking account of account activity, resolving a request, legal claims and security requirements. We do not promise deletion of records we are legally required to keep.
Providers may process data outside Estonia or the EEA. Where a restricted international transfer occurs, the applicable safeguard is used, such as an adequacy decision or the European Commission’s standard contractual clauses, with additional measures where required. Ask us for information about the safeguards relevant to your request.
Your rights and how to use them
Subject to the conditions in data protection law, you can request access, correction, erasure, restriction and data portability. You can object to processing based on legitimate interests, and can object to direct marketing at any time. You can withdraw consent without affecting earlier lawful processing. We do not discriminate against you for exercising these rights.
Email info@belom.eu with the request. We may ask for proportionate information to verify identity, but do not send identity documents unsolicited. We normally respond within one month; where a lawful extension is needed, we will tell you within that month and explain it.
You may complain to the Estonian Data Protection Inspectorate or the competent authority where you live, work or believe an infringement occurred. You do not have to contact us first to exercise that right.
Security, children and updates
Access controls and other appropriate technical and organisational measures are used to protect information, but no system can guarantee absolute security. Keep account access confidential and contact us if you suspect misuse. The store and its professional products are not directed at children; contact us if you believe a child has provided personal data so we can assess and address it.
We update this notice when our practices or legal requirements change and show the new date. Where necessary we also notify affected customers. Visiting the site is not, by itself, consent to optional marketing or cookies.
Last updated: 4 October 2026. Published by Belom group OÜ for NailMarket.