Privacy Policy

1. Who is responsible for your personal data?

The data controller is Thakreonzlo.world, operating the website at https://thakreonzlo.world and the Zenvo product line. When this policy refers to “we” or “us,” it means that entity unless a separate controller relationship is explicitly stated, such as with a payment processor that determines portions of processing under its own agreement.

You can reach the privacy inbox at the email above. For postal correspondence, use the Oslo address on every page footer. We aim to acknowledge substantive requests within five business days and to resolve ordinary access or rectification requests within thirty days unless complexity or third-party involvement requires more time, in which case we will explain the delay.

2. Scope, language, and age limits

This policy covers processing connected to marketing pages, inquiry forms, ordering flows, customer service, quality callbacks, and post-market communication about Zenvo. It does not govern third-party websites you may open from outbound links; those sites publish their own notices.

Zenvo positioning assumes adult use. We do not knowingly collect personal data from anyone under sixteen without verifiable parental authority. If you believe a minor submitted data, contact us and we will delete or anonymise it where feasible.

3. Categories of personal data we process

Depending on how you engage, we may collect or infer the following categories, always limited to what is adequate and relevant:

• Identity & contact: name, delivery and billing addresses, email, optional phone, language preference.
• Commercial: order identifiers, cart history, subscription rhythm, promo codes applied.
• Wellness-inquiry content: free-text you choose to send. Avoid including highly sensitive health information unless you knowingly accept the risk of email transmission.
• Technical telemetry: IP address, approximate region derived from IP, device class, operating system, browser, referrer URL, timestamps, crash logs if you submit them.
• Cookies & similar technologies: as detailed in the Cookie Policy, including consent strings and analytics identifiers when you opt in.
• Fraud & abuse signals: velocity checks, mismatch between payment country and shipping country, device fingerprint hashes from anti-abuse vendors.

4. Purposes and lawful bases in plain language

Art. 6 GDPR requires a documented lawful basis for each processing purpose. We map them as follows:

• Performance of a contract (Art. 6(1)(b)): taking payment, fulfilling shipments, issuing invoices, honouring warranties or replacements described in our Refund Policy.
• Legitimate interests (Art. 6(1)(f)): securing accounts, detecting fraud, analysing aggregated product feedback, improving site reliability, training staff on anonymised transcripts, and enforcing terms. Our balancing tests consider your reasonable expectations and opt-outs.
• Consent (Art. 6(1)(a)): marketing emails beyond transactional notices, non-essential cookies, optional case studies referencing your quote, or sharing anonymised quotes externally.
• Legal obligation (Art. 6(1)(c)): tax archives, customs declarations, responses to lawful requests from courts or regulators.

Where national supplement laws impose stricter duties, such as transparency around profiling, we extend comparable disclosures even when not strictly mandated.

5. Recipients, processors, and onward direction

We use narrowly scoped subprocessors bound by Article 28 agreements: payment gateways, billing platforms, transactional email relays, hosting providers, ticket systems, label printers integrated with carriers, analytics vendors if you consent, and backup storage. Contractual clauses require deletion or return of data when services end.

We may disclose data to carriers for delivery, to insurers when a claim arises, or to professional advisers under confidentiality. If ownership of the business changes, your information may transfer as a business asset subject to notice and, where required, consent.

6. International transfers outside the EEA

Primary hosting remains in the European Economic Area. If a processor stores copies elsewhere, we implement Standard Contractual Clauses, UK IDTA addenda as needed, or rely on adequacy decisions. Copies of safeguards are available upon request, redacted only for commercial secrecy.

We document transfer impact assessments where required by Schrems II guidance, reviewing government access laws in destination countries and adding supplementary technical measures such as encryption or segmentation when proportionate.

7. Retention schedules and secure deletion

Retention follows necessity and law:

• Accounting & tax: up to ten full fiscal years after the last relevant transaction in line with Norwegian bookkeeping obligations.
• Marketing consents: until withdrawn, plus a short reconciliation window.
• Support tickets: twenty-four months after closure unless tied to an active dispute.
• Web static assets in caches: governed by CDN provider TTLs, generally under forty-eight hours for dynamic pages.
• Backups: rolling snapshots; deleted records purge from active systems first and naturally age out of encrypted backups within ninety days unless legally preserved.

8. Security measures and breach response

We combine organisational and technical measures: TLS 1.2+ on public endpoints, segregated production credentials, least-privilege access reviews quarterly, dependency patching SLAs, penetration testing on critical paths at least annually, and passwordless or hardware-key access for infrastructure operators where feasible.

If a breach risks your rights, we notify the Norwegian Data Protection Authority without undue delay and communicate to affected users when the GDPR threshold for direct notice is met, describing likely impact and remedial steps.

9. Automated decision-making and profiling

We do not make decisions producing legal or similarly significant effects solely by automated means. Risk scoring for fraud may flag orders for manual review but never auto-cancels without human validation except where payment providers decline a charge independently.

10. Rights available to you

Subject to applicable law, you may request access, rectification, erasure, restriction, portability, and objection, and withdraw consent without retroactive invalidity. You may also instruct us to provide your data to another controller where technically feasible.

To exercise rights, email ask@thakreonzlo.world with sufficient detail for us to verify identity. We may request additional proof before releasing sensitive extracts. Responses are free unless manifestly unfounded or excessive.

11. Supervisory authority and complaints

You may lodge a complaint with Datatilsynet at www.datatilsynet.no or your habitual residence authority. We welcome the chance to resolve issues directly first.

12. Policy updates and questions

Material updates appear on this page with a refreshed “effective” dynamic stamp at the top. Continued use after non-material adjustments constitutes awareness; material changes affecting core rights trigger additional notice when legally required.