Privacy Policy

1Data Controller

The data controller responsible for processing your personal data is Keto Nova, operating the website ketonova.shop and its localized versions (ES, PT, HU).

For any privacy-related request, you can contact us through the support form available on our website.

2Data We Collect

We only collect the data strictly necessary to provide our service. This includes:

2.1 Data you provide directly

• Full name — to identify you and process your order.
• Phone number — to confirm your order and coordinate delivery.
• Delivery address — to ship the product to you (collected during the confirmation call).
• Communications — any messages you send to our support team.

2.2 Data collected automatically

• Technical data: IP address, browser type, device type, operating system.
• Usage data: pages visited, time spent, referring URLs.
• Tracking data: UTM parameters (utm_source, utm_medium, utm_campaign), click IDs (gclid, fbclid), and affiliate sub-IDs used to measure the effectiveness of our advertising campaigns.

3How We Use Your Data

We use your personal data to:

• Process and confirm your order via phone call.
• Ship the product to your address through our courier partners.
• Provide customer support and handle returns or refunds.
• Measure the effectiveness of our advertising campaigns (analytics and affiliate tracking).
• Comply with legal, tax, and accounting obligations.
• Prevent fraud and misuse of our website.

We do not use your data to send unsolicited marketing communications without your explicit consent.

4Legal Basis for Processing

Under the GDPR, we process your personal data based on the following legal grounds:

• Performance of a contract (Art. 6(1)(b) GDPR) — to process your order and deliver the product.
• Legal obligation (Art. 6(1)(c) GDPR) — to comply with tax, accounting, and consumer-protection laws.
• Legitimate interest (Art. 6(1)(f) GDPR) — to prevent fraud, secure our website, and measure advertising performance.
• Consent (Art. 6(1)(a) GDPR) — where you explicitly agree (e.g., optional cookies).

5Data Sharing

We do not sell your personal data. We may share it with the following categories of recipients, strictly for the purposes described above:

• Courier and logistics partners — to deliver your order.
• Affiliate and advertising networks (e.g., dr.cash) — to track conversions and pay partners for referred sales.
• Analytics providers — to measure website performance and improve our service.
• IT service providers — for hosting, security, and technical support.
• Legal authorities — when required by applicable law.

All third-party processors are contractually bound to protect your data and to process it only for the agreed purposes.

6International Transfers

Your data is primarily processed within the European Economic Area (EEA). If a third-party provider is located outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

7Data Retention

We retain your personal data only as long as necessary for the purposes for which it was collected:

• Order data: retained for the duration of the contract and for the period required by tax and accounting laws (typically 10 years in the EU).
• Marketing and analytics data: retained for a maximum of 24 months.
• Customer support communications: retained for up to 3 years after the last interaction.

8Your Rights

As a data subject under the GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your data, subject to legal retention obligations.
• Restriction — limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, where processing is based on consent.
• Lodge a complaint — with your local Data Protection Authority (Garante in Italy, AEPD in Spain, CNPD in Portugal, NAIH in Hungary).

9Cookies

We use cookies and similar tracking technologies to improve your browsing experience and to measure the effectiveness of our advertising. For full details, please see our Cookie Policy.

10Security

We implement appropriate technical and organizational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include HTTPS encryption, access controls, and secure storage systems.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

11Children

Our products and services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us so we can delete it.

12Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated version will be published on this page with a new "Last updated" date. We encourage you to review this policy periodically.

13Contact

For any question about this Privacy Policy or your personal data, please contact us through the support form available on our website. We are committed to handling your request promptly and fairly.