PRIVACY POLICY

1. INTRODUCTION

Aqua Architect Advisory Tallinn OÜ (Registry Code: 17242581), hereinafter "we", "us", or "the Company", is committed to protecting the privacy and personal data of users of the nobullshitdrinks.com website.

This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679) and the ePrivacy Directive.

Data Controller:
Aqua Architect Advisory Tallinn OÜ
Pärnu mnt 139e/2-8, 11317 Tallinn, Estonia
Email: contact@nobullshitdrinks.com
VAT: EE102884483

2. DATA WE COLLECT

2.1 Data You Provide Directly

When you use our website or place an order, we collect:

Identity: First name, last name
Contact: Email address, phone number, delivery address, billing address
Payment: Payment method information (processed by secure third-party providers)
Order history: Products purchased, order dates, amounts
Account: Username, password (encrypted), preferences

2.2 Data Collected Automatically

When you visit our website, we automatically collect:

Technical data: IP address, browser type, operating system, device used
Navigation data: Pages visited, duration, clicks, referrer URL
Cookies: See section 5 below

3. PURPOSE AND LEGAL BASIS OF DATA PROCESSING

Purpose	Legal Basis (GDPR)
Order processing and delivery	Contract execution (Art. 6.1.b)
Customer service and support	Contract execution (Art. 6.1.b)
Payment processing	Contract execution (Art. 6.1.b)
Sending promotional emails and newsletters	Consent (Art. 6.1.a)
Website analytics and improvements	Legitimate interest (Art. 6.1.f)
Fraud prevention and security	Legitimate interest (Art. 6.1.f)
Legal obligations (accounting, taxes)	Legal obligation (Art. 6.1.c)

4. DATA RETENTION

We retain your personal data for the following periods:

Account data: As long as your account is active, or up to 3 years after last activity
Order data: 10 years (legal accounting obligation)
Payment data: Encrypted and stored by payment providers (PCI-DSS compliant)
Marketing data: Until consent withdrawal or 3 years after last interaction
Analytics data: 26 months (Google Analytics default)

After these periods, data is securely deleted or anonymized.

5. COOKIES

5.1 What are Cookies?

Cookies are small text files placed on your device when you visit our website. They help improve your user experience and allow us to analyze site usage.

5.2 Types of Cookies Used

Essential Cookies (no consent required):

Session management (shopping cart, authentication)
Security and fraud prevention
Load balancing

Performance and Analytics Cookies (consent required):

Google Analytics 4 (traffic analysis, page views)
BigCommerce analytics

Marketing and Advertising Cookies (consent required):

Facebook Pixel (ad targeting, conversion tracking)
TikTok Pixel (ad targeting)
Google Ads (remarketing)

5.3 Managing Cookies

You can accept or refuse cookies via the cookie banner displayed on your first visit. You can also manage cookies in your browser settings:

Chrome: Settings > Privacy and security > Cookies
Firefox: Settings > Privacy & Security > Cookies
Safari: Preferences > Privacy > Cookies

Note: Refusing all cookies may limit certain website features (shopping cart, account access).

6. DATA SHARING

We may share your personal data with:

6.1 Service Providers

BigCommerce: Website hosting and e-commerce platform
Payment processors: Secure payment handling (Stripe, PayPal)
Shipping carriers: Order delivery (DHL, UPS, local carriers)
Email service: Transactional and marketing emails (to be defined)
Analytics: Google Analytics, Facebook Business Manager

All service providers are contractually bound to GDPR compliance and data security.

6.2 Legal Requirements

We may disclose your data if required by law, court order, or governmental authority.

6.3 No Data Sales

We NEVER sell your personal data to third parties.

7. INTERNATIONAL DATA TRANSFERS

Some of our service providers are located outside the European Economic Area (EEA):

BigCommerce (Australia): Protected by Standard Contractual Clauses (SCCs)
Google Analytics (USA): Protected by Google's GDPR commitments and SCCs
Meta (USA): Protected by Meta's GDPR commitments and SCCs

All transfers outside the EEA are secured by appropriate safeguards as required by GDPR Article 46.

8. YOUR RIGHTS (GDPR)

Under GDPR, you have the following rights:

Right of access (Art. 15): Request a copy of your personal data
Right to rectification (Art. 16): Correct inaccurate data
Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten")
Right to restriction (Art. 18): Limit processing of your data
Right to data portability (Art. 20): Receive your data in a structured format
Right to object (Art. 21): Object to certain data processing (e.g., marketing)
Right to withdraw consent (Art. 7.3): Withdraw consent at any time

How to Exercise Your Rights

To exercise any of these rights, contact us at: contact@aaa.paris

We will respond within 1 month (extendable to 3 months for complex requests).

Right to Lodge a Complaint

If you believe your data protection rights have been violated, you may lodge a complaint with your national data protection authority:

Estonia: Andmekaitse Inspektsioon (https://www.aki.ee)
France: CNIL (https://www.cnil.fr)
EU-wide list: https://edpb.europa.eu/about-edpb/about-edpb/members_en

9. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal data:

SSL/TLS encryption: All data transmitted is encrypted (HTTPS)
Secure payment: PCI-DSS compliant payment processors
Access control: Limited access to personal data (need-to-know basis)
Regular backups: Data backup and disaster recovery procedures
Security audits: Regular security assessments

10. CHILDREN'S PRIVACY

Our website is not intended for children under 16 years old. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us immediately for deletion.

11. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect changes in our practices or legal requirements. The "Last updated" date at the top will be revised accordingly. Significant changes will be communicated via email or website notice.

12. CONTACT US

For any questions or concerns about this Privacy Policy or your personal data, contact us at:

Aqua Architect Advisory Tallinn OÜ
Email: contact@nobullshitdrinks.com
Address: Pärnu mnt 139e/2-8, 11317 Tallinn, Estonia