Privacy Policy

Last updated: 13 October 2026

1. Who is responsible for your data

The controller for orders and customer service at noryto.com is the trader identified in our Terms and Conditions. For questions and requests: info@noryto.com.

This policy describes personal data processing under Regulation (EU) 2016/679 (GDPR) and applicable Bulgarian law.

2. Data we receive

When you order or contact us, we receive the name, email, phone number, delivery address, order, payment and correspondence details you provide. For personalization, we receive uploaded photos, text and audio recordings, which may include other people's data. We also receive reviews you submit.

When you use the website, the platform and connected service providers process technical data such as IP address, browser, device, identifiers, pages visited and store interactions. See our Cookie Policy for cookies and your choices.

3. Why we use data

  • Orders, personalization, delivery and service: to enter into and perform our contract with you, including preparing the photo and providing access to the NFC audio recording you ordered.
  • Accounting and legal obligations: to meet applicable requirements and handle product complaints.
  • Security and disputes: our legitimate interest in preventing abuse and establishing, exercising or defending legal claims, taking your rights into account.
  • Optional marketing messages, advertising and analytics cookies: consent where required. You can unsubscribe from marketing messages and change your cookie preferences.

Data needed for production, delivery and payment is required to fulfil your order. Accepting the Terms is not consent to every type of processing or to using your photos in advertising. Advertising use of supplied photos requires separate permission.

4. Photos, audio and access

We use supplied files to personalize and support your order. Working copies are downloaded and stored in Google Drive for editing, production and order records. Only upload content you have the right to provide, including any necessary permissions from other people pictured or recorded.

NFC recordings are hosted through Shopify and opened using the link stored in the product. Listening does not require an account login: someone with the product or recording link can access it. Only share the link with people you want to give access to the recording.

5. Providers and recipients

We use Shopify (platform, orders and hosting), Ymq Product Options (uploads and personalization options), Middleware.bg (ordering), Google Drive (working copies), Judge.me (reviews) and Hextom (language and currency). Data is also processed by people involved in fulfilling and supporting orders, payment providers, couriers including Econt and Speedy and, when needed, accounting and legal advisers and competent authorities.

The store integrates with Meta (Facebook and Instagram), Google and TikTok for measurement and advertising. Shopify Network Intelligence is enabled: Shopify uses interaction data from our store and other stores to improve services, personalization and advertising, subject to applicable settings and rights. See Shopify's Consumer Privacy Policy and Shopify's privacy portal.

External content delivery services, including jsDelivr for the audio player, may receive technical data when content loads. Providers receive data according to their service; this does not mean they all receive your photos and audio.

6. International processing

Some providers process data outside the European Economic Area. GDPR requires an applicable transfer mechanism, such as an adequacy decision or standard contractual clauses and necessary supplementary measures. You can request information about recipients and applicable safeguards at info@noryto.com.

7. How long data is kept

We retain personal data, including uploaded photos and working copies, only for as long as necessary for the purposes for which it was collected. When it is no longer needed, we delete it, unless retaining particular data is required by law or necessary to establish, exercise or defend legal claims. NFC audio recordings are retained to provide customers with continued access to the service they ordered. You can request erasure under your applicable rights.

Retention of order data, accounting documents, inquiries and disputes depends on order fulfilment, applicable statutory periods and the need to defend legal claims. Closing an account does not automatically delete all this data.

To request deletion of a photo, working copy or recording, email us with enough information to locate the file or order. We will assess your request under your applicable rights and explain any grounds for retaining particular data. Deleting hosted audio ends access through its NFC link; it cannot remove copies other people have independently saved.

8. Your rights and contact

Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction, portability and objection. You can object to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

Email info@noryto.com. We may request information to verify your identity when necessary. We respond without undue delay, normally within one month; if a lawful extension is needed, we will explain the reason and timing. You can complain to the Bulgarian Commission for Personal Data Protection or another competent supervisory authority.

Policy updates are published on this page with an updated date.