PRIVACY POLICY

Last updated: July 18, 2026

This Privacy Policy explains how Green Life 08 Ltd collects, uses, discloses, stores, and protects personal data when you visit, use, or make a purchase from the Vitalore online store, including its localized and country-specific storefronts.

1. DATA CONTROLLER

The controller responsible for your personal data is:

GREEN LIFE 08 LTD
UIC (ЕИК): 205419449
VAT number: BG205419449
Address: k.k. Slanchev bryag, kv. Kamelia 158, vh. 2, et. 5, ap. 21, 8240 Nesebar, Bulgaria
Email: info@vitalor.eu
Phone: +359 88 793 8322

Green Life 08 Ltd operates the Vitalore online store and is referred to in this Privacy Policy as “Vitalore”, “we”, “us”, or “our”.

2. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies when you:

• visit or browse our online store;
• create or use a customer account;
• place or attempt to place an order;
• subscribe to marketing communications;
• contact us by email, contact form, social media, or another communication channel;
• request customer support, a return, refund, replacement, or other remedy;
• interact with our advertisements or social-media content; or
• otherwise use our website or related services.

This Privacy Policy does not govern websites, applications, platforms, or services operated independently by third parties.

3. PERSONAL DATA WE COLLECT

Depending on how you interact with us, we may collect the following categories of personal data.

3.1 Identity and contact data

This may include:

• name;
• billing address;
• delivery address;
• email address;
• telephone number;
• customer-account details; and
• company or business details where provided.

3.2 Order and transaction data

This may include:

• products purchased, returned, viewed, or requested;
• order number;
• order value and currency;
• discounts and promotional codes;
• delivery method;
• payment status;
• transaction references;
• invoices;
• customs, shipping, delivery, and tracking information;
• returns, refunds, replacements, complaints, and claims; and
• communications relating to an order.

3.3 Payment data

Payments are processed by third-party payment service providers, such as Shopify Payments, PayPal, banks, card networks, and other payment partners.

We do not normally receive or store your complete payment-card number, card security code, or full online-banking credentials.

We may receive limited payment information, such as:

• payment method;
• transaction status;
• billing address;
• payment-provider reference;
• card type; and
• partial card details.

3.4 Website, device, and technical data

This may include:

• IP address;
• browser type and version;
• device type;
• operating system;
• language and regional settings;
• approximate location derived from an IP address;
• website activity;
• pages and products viewed;
• links and buttons selected;
• search activity;
• cart and checkout activity;
• referring website or advertisement;
• session information;
• cookie, pixel, and advertising identifiers;
• privacy and consent preferences;
• technical logs; and
• security and fraud-prevention information.

3.5 Marketing and advertising data

Where applicable, this may include:

• marketing preferences;
• consent records;
• interaction with marketing emails;
• interaction with advertisements;
• advertising identifiers;
• campaign and conversion information;
• products viewed or added to a cart;
• purchases attributed to an advertisement; and
• information used to measure or personalize advertising.

3.6 Communications and customer-support data

When you contact us, we may process:

• the content of your message;
• your contact information;
• photographs or documents you submit;
• delivery and tracking information;
• complaint, return, or refund details; and
• records of our communications with you.

3.7 Information received from third parties

We may receive personal data from:

• Shopify;
• payment providers;
• banks and card networks;
• couriers and logistics providers;
• customs intermediaries;
• fraud-prevention and security providers;
• analytics and advertising providers;
• social-media platforms;
• applications connected to our Shopify store; and
• publicly available sources where permitted by law.

4. INFORMATION YOU MUST PROVIDE

Certain information, including your name, delivery address, contact details, and payment information, is necessary to process and fulfil an order.

Where information is required for a contract or legal obligation and you do not provide it, we may be unable to:

• accept or fulfil your order;
• process your payment;
• deliver the goods;
• issue an invoice;
• process a return or refund; or
• comply with applicable legal requirements.

Providing information for marketing, non-essential analytics, and personalized advertising is optional.

5. HEALTH AND OTHER SENSITIVE DATA

We sell food supplements, cosmetics, and health-related products, but we do not require customers to provide medical records, diagnoses, prescriptions, or other health information when placing an order.

If you voluntarily provide sensitive information, we will process it only where necessary to respond to your request and where permitted by applicable law.

6. HOW AND WHY WE USE PERSONAL DATA

6.1 Processing and fulfilling orders

We may use personal data to:

• process purchases and payments;
• confirm and manage orders;
• prepare invoices and transaction records;
• package and dispatch products;
• provide delivery and tracking information;
• communicate about an order;
• process returns, refunds, replacements, and complaints; and
• provide customer support.

The legal basis is the performance of a contract or taking steps at your request before entering into a contract.

6.2 Legal and regulatory compliance

We may process personal data where necessary to:

• comply with tax and accounting obligations;
• comply with customs requirements;
• comply with consumer-protection and product-safety requirements;
• maintain legally required business records;
• respond to lawful requests from public authorities;
• comply with court orders and regulatory requirements; and
• establish, exercise, or defend legal claims.

The legal basis is compliance with a legal obligation and, where applicable, our legitimate interests in protecting our legal rights.

6.3 Security and fraud prevention

We may process personal data to:

• secure our website and customer accounts;
• detect suspicious transactions;
• prevent fraud, abuse, chargebacks, and unauthorized access;
• investigate security incidents;
• verify returns and refund requests; and
• protect our customers, business, and service providers.

The legal basis is our legitimate interest in operating a secure and reliable online store and, where applicable, compliance with legal obligations.

Our legitimate interests include preventing fraud, protecting our systems, verifying transactions, maintaining evidence of orders and communications, and defending legal claims.

6.4 Customer service and communications

We may use personal data to:

• answer questions;
• respond to complaints;
• provide requested information;
• investigate delivery issues;
• communicate about returns and refunds; and
• maintain appropriate records of customer correspondence.

We will normally contact you by email regarding your order, delivery, return, refund, or customer-support request. If we do not receive a response, or if the matter is urgent or important for processing or delivering your order, we may also contact you by telephone, SMS, WhatsApp, or another contact method you have provided. These communications are service-related and are not marketing communications.

The legal basis may be performance of a contract, taking pre-contractual steps, compliance with legal obligations, or our legitimate interests in providing customer service and maintaining appropriate business records.

6.5 Website analytics and improvement

Subject to your consent where required, we may use analytics technologies to understand:

• how visitors use our store;
• which pages and products are viewed;
• how visitors navigate the website;
• whether technical errors occur;
• how marketing campaigns perform; and
• how we can improve our website, services, and product presentation.

The legal basis is consent where consent is required by applicable law.

Strictly necessary technical processing may be based on the necessity to provide the requested service, compliance with legal obligations, or our legitimate interests in operating and securing the website.

6.6 Marketing and advertising

Subject to your consent or another lawful basis where permitted, we may use personal data to:

• send marketing communications;
• measure advertising performance;
• record conversions and campaign results;
• create or measure advertising audiences;
• show more relevant advertisements; and
• understand whether an advertisement resulted in a visit or purchase.

You may withdraw marketing consent at any time by using the unsubscribe option in a marketing message, changing your preferences, or contacting us.

7. SHOPIFY

Our online store is hosted and supported by Shopify.

Shopify may process customer, order, payment, device, usage, and transaction information to provide:

• ecommerce hosting;
• checkout functionality;
• customer accounts;
• payment services;
• security and fraud prevention;
• analytics;
• store administration; and
• related platform services.

Depending on the Shopify services and privacy settings enabled for our store, Shopify may also process information to improve its services, provide enhanced features, support personalization, measure performance, and prevent fraud.

More information is available in Shopify’s Consumer Privacy Policy .

Where available for your region, you may use the privacy choices or data-sharing opt-out function displayed in our store.

8. SHOPIFY NETWORK INTELLIGENCE

If Shopify Network Intelligence is enabled for our store, Shopify may securely use customer data together with data from other Shopify merchants to provide enhanced Shopify services.

These services may include:

• fraud prevention and security;
• improved checkout and payment services;
• analytics and measurement;
• service personalization;
• advertising measurement; and
• other Shopify platform features.

Where required by applicable law, the use of information for advertising, targeted advertising, sale, or sharing purposes is subject to your consent or applicable opt-out rights.

Where available, you may exercise relevant choices through our cookie banner, privacy controls, data-sharing opt-out page, a recognized browser-based privacy signal, or Shopify’s privacy portal.

9. ANALYTICS AND ADVERTISING SERVICES

9.1 Shopify Analytics

We use Shopify Analytics to understand store traffic, sessions, product performance, orders, sales, and customer interactions.

Shopify Analytics may process information such as:

• device information;
• IP address;
• browser information;
• website activity;
• cart activity;
• checkout events; and
• purchase information.

9.2 Google Analytics

We use Google Analytics to measure website use, performance, and interactions with our online store.

Depending on your consent choices and our configuration, Google Analytics may collect or receive information such as:

• IP address;
• device and browser information;
• page views;
• session and interaction information;
• approximate geographic location;
• referring sources;
• product views;
• cart and checkout activity; and
• purchase and conversion events.

Google Analytics mainly uses first-party cookies and similar technologies to measure how visitors interact with websites. Google processes information in accordance with its own privacy policies and terms.

More information about Google Analytics privacy and data safeguards is available in Google Analytics – Safeguarding your data .

Google’s Privacy Policy is available at: Google Privacy Policy .

You may prevent Google Analytics from measuring your activity across participating websites by installing the Google Analytics Opt-out Browser Add-on .

The browser add-on prevents Google Analytics JavaScript from sharing information about your visit activity with Google Analytics. It does not prevent our website or other analytics services from processing information.

You may also manage or withdraw your consent for Google Analytics through the Cookie Preferences link available in our store.

9.3 Google Consent Mode

Our consent-management settings may communicate your privacy choices to Google through Google Consent Mode.

Depending on your choices and our technical configuration, Google tags may adjust their behaviour for:

• analytics storage;
• advertising storage;
• advertising user data;
• advertising personalization;
• functionality storage;
• personalization storage; and
• security storage.

Google Consent Mode does not replace our cookie banner. It communicates the choices made through the banner to relevant Google services.

Where required by applicable law, analytics and advertising cookies or identifiers will not be used unless the relevant consent has been provided.

Depending on whether basic or advanced Consent Mode is used, Google tags may either remain blocked or send limited cookieless measurement and consent signals when consent is denied.

9.4 Meta Pixel

We use the Meta Pixel to measure advertising performance and understand how visitors interact with our store after viewing or selecting advertisements on Facebook, Instagram, or other Meta services.

Depending on your consent choices and our configuration, information shared with Meta may include:

• page views;
• product views;
• searches;
• cart activity;
• checkout activity;
• purchases;
• order value and currency;
• device and browser information;
• IP address;
• cookie or advertising identifiers; and
• hashed contact information where advanced matching is enabled.

Meta may process this information for advertising measurement, audience matching, personalization, security, and other purposes described in its policies.

More information is available in the Meta Privacy Policy .

10. COOKIES AND SIMILAR TECHNOLOGIES

We and our service providers use cookies, pixels, tags, local storage, server-side events, and similar technologies.

10.1 Strictly necessary technologies

These are required for functions such as:

• website security;
• shopping-cart operation;
• checkout;
• payment processing;
• customer login;
• delivery preferences;
• fraud prevention; and
• recording privacy choices.

These technologies may operate without consent where permitted because the requested service may not function correctly without them.

10.2 Preference and functionality technologies

These technologies remember choices such as language, region, currency, and other website preferences.

Where required by applicable law, these technologies are used only after consent unless they are strictly necessary to provide a function requested by you.

10.3 Analytics technologies

These technologies help us understand website use, traffic, performance, interactions, and technical errors.

Where required by applicable law, analytics technologies are used only after consent.

10.4 Marketing technologies

These technologies help measure advertisements, record conversions, create advertising audiences, and display more relevant advertising.

Where required by applicable law, marketing technologies are used only after consent.

You may accept, reject, or change your choices through the cookie banner or Cookie Preferences link available in our store.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

You may also manage cookies through your browser settings. Blocking certain cookies may affect website functionality.

11. GLOBAL PRIVACY CONTROL AND OPT-OUT SIGNALS

Where required by applicable law and supported by our systems, we recognize valid browser-based privacy preference signals, such as Global Privacy Control.

A recognized signal may be treated as a request to opt out of:

• sale of personal data;
• sharing for cross-context behavioural advertising;
• targeted advertising; or
• certain non-essential data uses.

Browser-based signals generally apply to the browser or device from which they are sent and may not apply to other devices, browsers, or customer accounts.

12. MARKETING COMMUNICATIONS

We may send promotional emails or other marketing messages where you have consented or where otherwise permitted by applicable law.

You can unsubscribe at any time by:

• selecting the unsubscribe link in the message;
• changing your account preferences where available; or
• contacting info@vitalor.eu.

Administrative messages relating to orders, payments, delivery, returns, security, customer requests, or legal notices are not marketing communications and may still be sent where necessary.

13. WHEN WE SHARE PERSONAL DATA

We do not share personal data with unrelated third parties. We share only the information necessary with trusted service providers, professional advisers, and public authorities where this is required to process orders, deliver products, provide payment or technical services, comply with legal obligations, or protect our rights.

Personal data may be shared with the following categories of recipients.

13.1 Ecommerce and technology providers

This includes Shopify and applications or technical providers used to operate, maintain, secure, translate, analyze, or improve the store.

13.2 Payment providers

This may include Shopify Payments, PayPal, banks, card networks, and payment or fraud-prevention providers.

13.3 Delivery and logistics providers

We may share necessary contact, address, order, delivery, and customs information with:

• postal operators;
• couriers;
• delivery partners;
• fulfilment providers;
• customs intermediaries; and
• logistics providers.

13.4 Analytics and advertising providers

Subject to applicable consent and privacy choices, information may be shared with Shopify, Google, Meta, and other analytics or advertising service providers.

13.5 Professional advisers

We may share information with:

• accountants;
• auditors;
• lawyers;
• insurers;
• IT specialists; and
• other professional advisers.

13.6 Authorities and legal recipients

We may disclose information to tax authorities, customs authorities, courts, regulators, law-enforcement bodies, or other public authorities where required by law or necessary to protect our legal rights.

13.7 Business transactions

If our business or relevant assets are sold, reorganized, merged, or transferred, personal data may be disclosed to advisers and prospective or actual purchasers, subject to appropriate confidentiality and legal safeguards.

We require service providers that process personal data on our behalf to protect the information and use it only as necessary to provide their services, comply with applicable law, or follow our lawful instructions.

Some recipients, such as payment providers, banks, couriers, Shopify, Google, and Meta, may also act as independent controllers for certain processing carried out under their own terms and privacy notices.

14. PRIVACY CHOICES FOR ADVERTISING

We do not sell personal data for monetary compensation.

We may use analytics and advertising services, such as Google and Meta, subject to your consent and applicable privacy laws.

You can manage or withdraw your consent at any time through the Cookie Preferences controls available in our store. Where applicable, you may also submit a privacy request by contacting info@vitalor.eu.

15. INTERNATIONAL DATA TRANSFERS

Some service providers may process personal data outside Bulgaria, the European Economic Area, the United Kingdom, or your country of residence.

Where required, international transfers are protected through one or more appropriate safeguards, such as:

• an adequacy decision;
• Standard Contractual Clauses approved by the European Commission;
• the United Kingdom International Data Transfer Agreement or Addendum;
• participation in a recognized data-transfer framework where applicable;
• binding corporate rules; or
• another lawful transfer mechanism.

Where required, supplementary technical, contractual, or organizational safeguards may also be used.

You may contact us for further information about safeguards relevant to your personal data.

16. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy and to comply with legal obligations.

The applicable retention period depends on the nature of the information, the purpose for which it was collected, and relevant legal requirements.

Retention periods may include:

• order, invoice, payment, tax, customs, and accounting records — for the period required by applicable tax and accounting law;
• customer-account information — while the account remains active and for a reasonable period afterwards;
• customer-service and complaint records — for as long as necessary to resolve the matter and manage possible legal claims;
• return and refund records — for the applicable legal, accounting, and dispute-resolution periods;
• consent and privacy-choice records — for as long as needed to demonstrate compliance;
• marketing information — until consent is withdrawn, an objection is made, or the information is no longer required;
• fraud-prevention and security logs — for a period proportionate to the security and fraud risks involved; and
• cookie and analytics information — according to the duration of the relevant cookie, consent, service settings, and provider retention configuration.

We may retain information for longer where required by law, necessary for legal proceedings, or required to prevent fraud and abuse.

When personal data is no longer required, it will be deleted, anonymized, or securely restricted, where appropriate.

17. AUTOMATED PROCESSING AND FRAUD SCREENING

Shopify, payment providers, and fraud-prevention services may automatically assess transactions using information such as:

• IP address;
• device data;
• payment information;
• billing and delivery information;
• order history; and
• transaction patterns.

These tools may assign a risk level, delay processing, or identify a transaction for additional review.

We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects without appropriate safeguards where such safeguards are required by law.

Where applicable, you may contact us to:

• request information about the decision;
• express your point of view;
• contest the decision; or
• request human review.

18. YOUR DATA-PROTECTION RIGHTS

Depending on your location and applicable law, you may have the right to:

• request access to your personal data;
• receive a copy of your personal data;
• request correction of inaccurate or incomplete information;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing;
• withdraw consent at any time;
• receive certain personal data in a structured, commonly used, and machine-readable format;
• request transfer of certain information to another controller where applicable;
• request information about international-transfer safeguards;
• request human intervention in relation to certain automated decisions; and
• lodge a complaint with a competent supervisory authority.

Where the GDPR or UK GDPR applies, these rights include access, rectification, erasure, restriction, objection, data portability, withdrawal of consent, and safeguards relating to certain automated decisions.

These rights are not absolute. A request may be limited or refused where permitted by applicable law, including where information must be retained to comply with a legal obligation or to establish, exercise, or defend legal claims.

19. UNITED STATES PRIVACY RIGHTS

Depending on the US state in which you reside and whether the relevant law applies to our activities, you may have the right to:

• confirm whether we process your personal data;
• request access to personal data;
• request correction;
• request deletion;
• obtain a portable copy of certain data;
• opt out of sale;
• opt out of sharing;
• opt out of targeted advertising;
• opt out of certain profiling;
• limit the use of certain sensitive information;
• appeal a refusal of a privacy request; and
• receive equal service and pricing when exercising an applicable right.

You may exercise an applicable opt-out right through the privacy choices available in our store or by contacting info@vitalor.eu.

20. HOW TO EXERCISE YOUR RIGHTS

To exercise a privacy right, contact:

Email: info@vitalor.eu
Suggested subject: Privacy Request

Please clearly describe your request and provide enough information to help us identify the relevant account, order, or interaction.

To protect your personal data, we may take reasonable steps to verify your identity before responding. We may request additional information only where necessary to confirm your identity and prevent unauthorized disclosure.

Where permitted by applicable law, you may submit a request through an authorized agent. We may require evidence that the agent is authorized to act on your behalf.

21. RESPONSE TIMES

We will respond to privacy requests without undue delay and within the period required by applicable law.

Where the GDPR or UK GDPR applies, we will normally respond within one month of receiving a valid request. Where permitted, this period may be extended by up to two additional months if the request is complex or if we have received a number of requests. We will inform you of any extension and the reason for it within the initial one-month period.

For requests governed by US state privacy laws, we will respond within the applicable legal timeframe.

22. PRIVACY COMPLAINTS

You may submit a privacy complaint to info@vitalor.eu.

Please provide enough information for us to understand and investigate your concern.

We will review your complaint without undue delay and inform you of the outcome or any further steps required under applicable law.

23. SUPERVISORY AUTHORITIES

You have the right to lodge a complaint with a competent data-protection authority if you believe that your personal data has been processed unlawfully.

The Bulgarian supervisory authority is:

Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia
Bulgaria
Email: kzld@cpdp.bg
Website: https://www.cpdp.bg

You may also lodge a complaint with the data-protection authority in the country where you live, work, or believe an infringement has occurred.

If UK data-protection law applies, you may contact the UK Information Commissioner’s Office .

24. SECURITY

We use appropriate technical and organizational measures designed to protect personal data against accidental loss, unlawful destruction, unauthorized alteration, disclosure, access, or other unlawful processing.

These measures may include encrypted website connections, access controls, secure payment processing, service-provider security measures, fraud monitoring, backups, and restricting access to personal data to those who need it for legitimate business purposes.

However, no website, transmission, or storage system can be guaranteed to be completely secure.

25. CHILDREN’S PRIVACY

Some products available in our store are intended for use by babies or children.

Orders must be placed by an adult or by a person who has the legal authority to make the purchase.

We do not knowingly collect personal data directly from children where this is not permitted by applicable law.

If you believe that a child has provided personal data to us without appropriate authorization, please contact us at info@vitalor.eu.

26. THIRD-PARTY LINKS

Our store may contain links to third-party websites, social-media platforms, payment services, delivery services, or other external resources.

Those third parties operate independently and have their own privacy practices and policies. We are not responsible for how they collect or process personal data.

We recommend reviewing the relevant third-party privacy notice before providing personal data or using their services.

27. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our services, business practices, technologies, privacy settings, legal requirements, or service providers.

The updated version will be published on our website with a revised “Last updated” date.

Where required by applicable law, we will provide additional notice or obtain new consent before making material changes to how we process personal data.

28. CONTACT

For questions about this Privacy Policy, privacy requests, opt-out requests, or complaints, please contact:

GREEN LIFE 08 LTD
UIC (ЕИК): 205419449
VAT number: BG205419449
Address: k.k. Slanchev bryag, kv. Kamelia 158, vh. 2, et. 5, ap. 21, 8240 Nesebar, Bulgaria
Email: info@vitalor.eu
Phone: +359 88 793 8322