Privacy policy
Last updated: 18 July 2026
Version: 2.1
This Policy explains how WE ARE XYZ DESIGN STUDIO S.R.L. (Nara Knits) collects, processes and protects the personal data of naraknits.com users.
Data controller:
- Name: WE ARE XYZ DESIGN STUDIO S.R.L.
- Registered office: Str. Av. Popișteanu 54B, 10th floor, ap. 102, Bucharest, Romania
- Trade Registry No.: J40/6312/2017 · Company ID (CUI): 37500897
- GDPR contact e-mail: hello@naraknits.com
- Phone: +40 750 291 690
Processing complies with Regulation (EU) 2016/679 (GDPR), Romanian Law 190/2018 and Directive 2002/58/EC (ePrivacy) transposed by Romanian Law 506/2004.
Data Protection Officer (DPO): Nara Knits is not required to appoint a DPO under Art. 37 GDPR (it does not carry out large-scale processing of sensitive data). For any GDPR request, contact hello@naraknits.com.
1. Categories of data processed
| Category | Examples | Source |
|---|---|---|
| Identification data | first and last name | directly from the customer |
| Contact data | e-mail, phone, address | directly from the customer |
| Payment data | card type (last 4 digits), cardholder name; Klarna payment data | processors |
| Order data | products, quantities, amounts, history | system |
| Account data | username, password hashes, preferences | customer + system |
| Ambassador / Community data | tier, NaraCredits, generated codes, referral statistics | system |
| Social media data | @ accounts for ambassadors | directly from the customer |
| Technical data | IP, browser, device, cookies | automatic |
| Marketing data | newsletter preferences, clicks, opens | automatic + customer |
| UGC content | photos, videos, reviews tagged @naraknits | directly from the customer |
2. Purposes and legal bases of processing
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Order processing and delivery | performance of the contract — Art. 6(1)(b) |
| Invoicing and tax obligations | legal obligation — Art. 6(1)(c) |
| Customer account (login, history) | performance of the contract — Art. 6(1)(b) |
| Administration of the Ambassadors Program (account creation, code allocation, NaraCredits calculation, program communications) | performance of the contract — Art. 6(1)(b) |
| Administration of Nara Community (enrolment, discount, cashback, communications) | performance of the contract — Art. 6(1)(b) |
| Fraud prevention in the loyalty programs (detection of duplicate accounts, return manipulation, self-purchases) | legitimate interest — Art. 6(1)(f) |
| Klarna flexible payment | performance of the contract — Art. 6(1)(b) + Klarna’s privacy notice |
| Customer support | performance of the contract / legitimate interest |
| E-mail marketing (newsletter) | consent — Art. 6(1)(a) |
| Analytics & marketing cookies | consent — Art. 6(1)(a) (see the Cookie Policy) |
| Site security & fraud detection | legitimate interest — Art. 6(1)(f) |
| UGC (use of tagged content) | legitimate interest — Art. 6(1)(f) (promoting our products through public content in which you voluntarily tag us); you may object at any time (Art. 21) at hello@naraknits.com |
| Legal compliance (GDPR, consumer protection) | legal obligation — Art. 6(1)(c) |
3. Retention periods
| Category | Period | Basis |
|---|---|---|
| Customer account data (inactive) | account closure + 3 years | civil law — limitation period |
| Orders & invoices | 5 years | Romanian Accounting Law 82/1991 (as amended by Law 36/2023) |
| Marketing data (newsletter) | until unsubscribe + 30 days | withdrawal of consent |
| Application logs (access, errors) | 90 days | security |
| NaraCredits & transaction data | account closure + 3 years | proof of transactions |
| Analytics cookies | 12–24 months | per settings |
| Marketing cookies | up to 24 months | per settings |
| Support tickets | 3 years from closure | proof of the relationship |
| Published UGC | until revocation + a reasonable period for materials already distributed | contractual licence |
4. Third-party providers (processors) and recipients
To provide our services, we share certain data with the following recipients/processors:
4.1. Platform and hosting
- Shopify Inc. (Canada / EU – Frankfurt) — e-commerce platform, checkout hosting, customer and order database.
- Vercel Inc. (USA + EU – Frankfurt) — hosting for our own Nara Ambassador application (NaraCredits management).
- Neon, Inc. / AWS (EU – Frankfurt, eu-central-1) — database for the Nara Ambassador application (NaraCredits, ambassadors, transactions).
4.2. Payments
- Shopify Payments (Shopify Inc., Canada) — card payment processing.
- Klarna Bank AB (publ) (Sweden) — flexible payment for users who choose Klarna. Klarna is an independent controller; its own privacy notice is available at klarna.com/ro. The data transmitted includes: contact details, order data, amount and, for instalment payments, information needed for the credit assessment.
4.3. Logistics
- Sameday Courier S.R.L. (Romania) — delivery of orders within Romania and internationally, per waybill. Data transmitted: recipient name, address, phone, e-mail, order contents (waybill label).
- Fluxsales — Shopify app used to automatically issue waybills (AWB); it processes order data (recipient, address, phone, e-mail, parcel contents) strictly for this purpose.
4.4. Marketing and communication
- Klaviyo, Inc. (USA) — e-mail marketing and automations (newsletter, cart recovery, loyalty and ambassador communications).
4.5. Loyalty, ambassadors, reviews
- Our own application Nara Ambassador (operated by us on Vercel + Neon) manages NaraCredits, ambassador tiers and redemption codes.
4.6. Analytics
- Google LLC (USA + EU) — Google Analytics 4, per the consent given in the cookie banner.
- PostHog, Inc. (USA + EU) — product analytics.
- Meta Platforms, Inc. (USA + EU) — Pixel/CAPI for ad attribution, per consent.
4.7. Support and operations
- Google Workspace (USA + EU) — business e-mail, documents.
4.8. Professional advisers
- Accounting firm and lawyer — on request, for tax and legal obligations.
5. International transfers
Certain providers (Vercel, Klaviyo, Google, Meta, Shopify) process data on servers in the United States or other countries outside the EEA. Transfers take place on the basis of:
- the EU–US Data Privacy Framework (DPF) — for certified providers; or
- the Standard Contractual Clauses (SCC) adopted by the European Commission through Decision 2021/914;
which ensure a level of protection equivalent to that in the EU. The list of providers and applicable mechanisms is updated periodically; for details, contact us at hello@naraknits.com.
6. Your rights
Under the GDPR, you have the following rights:
- Access (Art. 15) — to receive a copy of the data we hold about you;
- Rectification (Art. 16) — to correct inaccurate data;
- Erasure / the “right to be forgotten” (Art. 17) — as provided by law (exceptions for tax obligations);
- Restriction (Art. 18) — limiting certain processing;
- Portability (Art. 20) — receiving your data in a structured, machine-readable format;
- Objection (Art. 21) — against processing based on legitimate interest or direct marketing;
- Withdrawal of consent (Art. 7(3)) — without affecting the lawfulness of prior processing;
- Complaint to the Romanian supervisory authority (ANSPDCP) (dataprotection.ro).
Requests should be sent to hello@naraknits.com; we reply within a maximum of 30 days (extendable by a further 60 days for complex requests, with notice).
7. Automated decisions
-
Self-purchase detection (the automatic comparison of
customer.idoremailbetween the ambassador and the placed order) is an automated decision with minor effect (awarding 0 NaraCredits for that order) — it does not produce significant legal effects within the meaning of Art. 22 GDPR. Members can contest the decision by e-mail. - Klarna’s credit assessment is an automated decision managed by Klarna (an independent controller) — see their privacy notice.
8. Security
We apply reasonable technical and organisational measures (encryption in transit, password hashing, access control, audit logs, daily backups). In the event of a high-risk security incident, we notify the Romanian supervisory authority (ANSPDCP) and affected users in accordance with Arts. 33–34 GDPR.
9. Cookies
Our cookie policy is detailed in a separate document: the Cookie Policy.
10. Minors
10.1. The Site is not directed at children under 13.
10.2. Under Art. 8 GDPR and Art. 7 of Romanian Law 190/2018, in Romania the age of digital consent for information society services is 16. Below this age, the consent of a legal guardian is required.
10.3. For Nara Community: the minimum age is 16; for minors under 18, the agreement of a legal guardian is required to enter into the loyalty contract (limited legal capacity).
10.4. For Klarna: the minimum age is 18 (a legal requirement for BNPL products).
11. Changes
We may update this Policy. The version in force is published with the “Last updated” date. Material changes will be notified by e-mail or via a banner on the Site with at least 14 days’ notice.
12. Contact
For any questions about personal data:
WE ARE XYZ DESIGN STUDIO S.R.L. (Nara Knits)
E-mail: hello@naraknits.com
Phone: +40 750 291 690
Address: Str. Av. Popișteanu 54B, 10th floor, ap. 102, Bucharest, Romania
