Privacy Policy
This Privacy Policy explains how Nuve ("we", "us") collects, uses, retains and protects your personal data when you visit nuve-shop.com or place an order with us. Nuve is operated by COSMOS ECOM CONSULTING LLC, the data controller for all personal data processed through this site. We sell adhesive, backless and strapless bra inserts, and we serve customers located in Italy. As a business offering goods to customers in Italy, we apply the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") in full to the personal data we process in connection with those customers, under Article 3(2) GDPR.
Data controller
COSMOS ECOM CONSULTING LLC, operator of Nuve
As data controller, COSMOS ECOM CONSULTING LLC determines the purposes and means of processing your personal data in connection with the nuve-shop.com online store. Shopify Inc. acts as data processor for platform and payment functions.
Registered entity
COSMOS ECOM CONSULTING LLC
30 N Gould St Ste R, Sheridan, Wyoming 82801, USA
Privacy contact
For any request regarding your personal data:
hello@nuve-shop.com
Monday to Friday, 9:00-18:00 (CET)
Data we collect
We only collect the personal data necessary to fulfil your order, support the customer relationship and keep our store operating lawfully. We do not collect data we do not need, and we do not retain it beyond the periods described in this Policy.
Personal data
First and last name
Email address
Shipping address
Billing address
Phone number (if provided)
IP address
Browser type and version
Device type and operating system
Order data
Items purchased and quantities
Order history
Payment method type (e.g. Visa, Mastercard, never the full card number)
Order number and transaction reference
Courier and tracking number
We never store your full card number, CVV code or expiry date
What we do not collect
We do not collect any special category data such as health information, racial or ethnic origin, religious beliefs or biometric data. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at hello@nuve-shop.comso we can remove it without delay.
How we use your data
We only use your personal data for the purposes listed below. We base our processing on performance of a contract (to fulfil your order), legitimate interest (fraud prevention, improving the site), legal obligation (accounting and tax obligations) and consent (marketing emails).
Order fulfilment
Processing and confirming your order
Processing payment via Shopify Payments
Arranging shipping and tracking your parcel
Handling returns, refunds and exchanges
Customer service
Responding to your questions and support requests
Handling warranty and after-sales questions
Sending order confirmations and shipping notifications
Following up on unresolved requests
Legal obligations & compliance
Preventing and detecting fraud
Accounting and tax obligations
Responding to lawful requests from administrative or judicial authorities
Site security and abuse prevention
Marketing (subject to consent)
Sending promotional emails and product news if you have consented
Improving the site using aggregated analytics data
You can unsubscribe at any time via the link in every marketing email
We never send marketing communications without your consent
Data sharing & third parties
We only share your personal data with the providers essential to running our store and fulfilling your order. All of our third-party providers are bound by contractual confidentiality obligations. We never sell your personal data, to anyone, for any reason.
Nuve does not sell, rent, trade or transfer your personal data to any third party for their own marketing, commercial or advertising purposes. This commitment applies to every one of our Italian customers, in line with GDPR requirements. Your data is used only to support your shopping experience with us.
Who we share your data with
Shopify Inc., our e-commerce platform and technical processor, which processes order, customer and payment data on our behalf under a data processing agreement.
Our payment processor (Shopify Payments), which processes your payment securely in line with the PCI DSS standard. We only share the information strictly necessary to authorise and complete your transaction.
Couriers, responsible for delivery within Italy. Your name and shipping address are shared with them to ship and track your parcel.
Marketing email provider (where applicable, only with your consent), which receives your email address solely to send you the communications you agreed to.
Google Analytics (or a similar analytics tool), for aggregated and anonymized analysis of site traffic. It does not receive directly identifying data.
Who we never share your data with
Data brokers or data aggregators
Social media platforms for advertising targeting without your consent
Any third party for their own marketing purposes
Any buyer of personal data (we never sell data)
Any party outside the scope of order fulfilment and customer service, unless you give explicit consent or we are under a legal obligation
Shopify as data processor
Shopify processes your data on our behalf and is bound by strict data processing obligations.
Shopify Inc. provides the e-commerce platform and payment infrastructure that runs nuve-shop.com. In this role, Shopify acts as a data processor under the GDPR, it only processes your personal data on our instructions, under a Data Processing Agreement. Shopify maintains its own privacy program and security infrastructure, including PCI DSS Level 1 certification for payment data and SOC 2 certification for platform security.
What Shopify processes
Order data, customer contact details, payment method information, shipping data and site statistics. Shopify does not use this data for its own marketing and does not resell it to any third party on our behalf.
Data location & transfers
Shopify may host and process data outside the European Economic Area. Where this occurs, transfers are governed by appropriate safeguards under the GDPR, in particular the European Commission's Standard Contractual Clauses. Shopify's privacy policy is available at shopify.com/legal/privacy.
Cookies & tracking technologies
We use cookies and similar technologies on nuve-shop.com to run essential site functions, measure traffic and, subject to your consent, show you personalized advertising. You can manage your preferences at any time via our cookie consent banner or your browser settings.
Managing your preferences
Cookie banner: on your first visit, a banner lets you accept, reject or configure non-essential cookies.
Change at any time: you can revisit your choice at any time via the "Cookie Settings" link in the site footer.
Browser settings: you can also block or delete cookies via your browser's privacy settings. See your browser's documentation for details.
Withdrawing cookie consent
Under the GDPR, you can withdraw your consent to analytics and marketing cookies as easily as you gave it.
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and has no effect on strictly necessary cookies.
For any question about our cookies, write to us at hello@nuve-shop.comwith the subject line "Cookies".
A note on essential cookies
Disabling essential cookies may prevent the core features of the site from working properly, including the cart and checkout. We recommend keeping these cookies enabled for the best shopping experience on nuve-shop.com.
Your GDPR rights
Because Nuve is established in Italy and serves Italian customers, the GDPR applies to our processing directly and natively, with no cross-border complexity involved. This section details the rights you hold over your personal data and the supervisory authority you can turn to.
Regulation (EU) 2016/679, Articles 15 to 22
You have extensive rights over your personal data under the GDPR.
The GDPR grants data subjects rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. These rights apply in full to any personal data collected, used or processed by Nuve (COSMOS ECOM CONSULTING LLC).
Right of access (Art. 15)
You can request confirmation that your data is being processed, along with a copy of that data, the purposes of processing, the categories of data involved and the recipients it has been shared with.
Right to rectification (Art. 16)
You can request the correction of inaccurate or incomplete data about you, for example your shipping address or contact details.
Right to erasure (Art. 17)
You can request deletion of your personal data, subject to the legal retention obligations that apply to us (accounting and tax obligations in particular).
Right to restriction (Art. 18)
You can request that we limit the processing of your data in certain cases, for example while a dispute about the accuracy of your data is being reviewed.
Right to portability (Art. 20)
You can receive your data in a structured, commonly used, machine-readable format, or ask that it be transmitted directly to another controller.
Right to object & withdraw consent (Art. 21-22)
You can object to processing based on legitimate interest (e.g. direct marketing) and withdraw your consent at any time, in particular for marketing communications.
Response timeframe
Under Article 12 of the GDPR, we respond to any request to exercise your rights within one month of receiving it. This period may be extended by a further two months (three months in total) for complex or numerous requests, after informing you within the first month and explaining the reasons for the delay.
How to exercise your rights
Email: hello@nuve-shop.com
Subject line: "GDPR Request"
Please include your name, the email address used for your orders, and the nature of your request. We may ask you to verify your identity before processing it.
No charge for your request
Exercising your GDPR rights is free of charge. We may only charge a fee for requests that are manifestly unfounded or excessive, particularly if repetitive, in line with Article 12(5) of the GDPR.
You will not experience any discrimination or reduction in service for exercising any of these rights.
Supervisory authority: Garante per la protezione dei dati personali
As an Italy-established business, Nuve is directly subject to the oversight of Italy's national data protection authority. We encourage you to contact us first so we can resolve your request directly, but you always retain the right to complain to the supervisory authority.
🇮🇹 Italy: Garante per la protezione dei dati personali
Garante per la protezione dei dati personali
Piazza Venezia, 11
00187 Roma
Italy
Competent to receive complaints from data subjects in Italy.
Judicial remedy
In addition to lodging a complaint with the Garante, you may bring an effective judicial remedy before the competent Italian courts, in line with Article 79 of the GDPR.
We encourage you to contact us directly first at hello@nuve-shop.comso we can address your concern without delay.
GDPR applies directly, no cross-border complexity
Because Nuve is established in Italy and processes the data of Italian customers, there is no extraterritorial question to resolve here: the GDPR simply applies to us as a matter of course, and the Garante per la protezione dei dati personali is the single supervisory authority responsible for overseeing our processing activities.
Data retention & security
We only retain your personal data for as long as necessary for the purposes it was collected, or for as long as required by law. We implement security measures in line with industry standards to protect your data against unauthorized access, loss or disclosure.
Order data
Retained for 10 years from the transaction date, in line with Italian accounting and tax obligations relating to the retention of commercial documents. After this period, data is securely deleted or anonymized.
Marketing data
Retained until you unsubscribe from marketing communications. After unsubscribing, we keep a record of your objection so we can make sure we do not contact you again.
Customer account data
Retained until you request deletion of your account or personal data, subject to our legal retention obligations. We will confirm deletion within one month of a valid request.
Analytics & cookies
Aggregated analytics data is retained in line with the default retention periods of Shopify Analytics and Google Analytics (generally up to 26 months). Session cookies are deleted at the end of each browsing session.
Security measures
Your data is protected by technical and organizational measures aligned with industry standards.
We rely on Shopify, a leading e-commerce platform with robust security infrastructure and a dedicated security team, to store and process your personal data. Payment data is handled exclusively by PCI DSS certified providers via Shopify Payments. We never see or store your full card number, CVV code or expiry date.
Technical measures
SSL/TLS encryption across the site. PCI DSS compliance via Shopify Payments. Role-based access controls and authentication for internal systems. Regular security updates and monitoring through Shopify's infrastructure.
Organizational measures
Access to personal data limited to staff who need it to fulfil orders or provide customer service. Data processing agreements in place with every third-party provider. Incident response and data breach notification procedures.
Data breach notification
Despite the security measures we implement, no system is completely immune to risk and we cannot guarantee absolute security of your personal data. If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Garante per la protezione dei dati personali within 72 hours of becoming aware of it, in line with Article 33 of the GDPR. Where the risk to you is high, we will also inform you directly, without undue delay, describing the nature of the breach, the data involved, the likely consequences and the measures taken or proposed.
Changes to this policy & contact
We periodically review and update this Privacy Policy to reflect changes in our practices, applicable law and the services we offer. We will notify you of any material change.
Policy updates
We may update this Privacy Policy at any time. The effective date shown at the top of this page always reflects the current version. For material changes (those that significantly affect your rights or how we process your data), we will notify you via a visible banner on nuve-shop.com before they take effect. We encourage you to review this Policy periodically.
Governing law
This Privacy Policy is governed by the General Data Protection Regulation (GDPR) and applicable Italian law, without prejudice to any other mandatory right you may have as a consumer.
Privacy contact
COSMOS ECOM CONSULTING LLC, operator of Nuve
For any privacy question, or any request for access, rectification, erasure, or any complaint, please contact us using the details below. We treat every request seriously and are committed to responding promptly and fairly.
Postal address
COSMOS ECOM CONSULTING LLC
30 N Gould St Ste R, Sheridan, Wyoming 82801, USA
Contact details
Email: hello@nuve-shop.com
Hours: Monday to Friday, 9:00-18:00 (CET)
Site: nuve-shop.com
Subject line: "Privacy Request"
Response times: in line with Article 12 of the GDPR, we respond to any request to exercise your rights within one month, which may be extended to three months for complex or numerous requests.
We prefer a direct conversation
We take any privacy concern seriously and do everything we can to resolve your request promptly and fairly. You always retain the right to lodge a complaint directly with the Garante per la protezione dei dati personali, but we encourage you to contact us first at hello@nuve-shop.com so we can resolve your request directly before any escalation.
A question about your data?
We respond to every privacy request within one to three months, in line with the GDPR.
hello@nuve-shop.comThis Privacy Policy applies to the processing of personal data of individuals in Italy by Nuve (COSMOS ECOM CONSULTING LLC) via nuve-shop.com. It is effective as of July 6, 2026. For questions about our shipping, returns, payments or terms, see our Shipping Policy, Returns & Refunds, Payment Policy and Terms of Service. COSMOS ECOM CONSULTING LLC, 30 N Gould St Ste R, Sheridan, Wyoming 82801, USA.