Privacy Policy

Last updated: 8 October 2026

This policy explains how personal data is used when you visit www.bovart.com, place an order, contact us or choose to receive marketing from BOVART. It also explains your choices and data protection rights.

1. Who is responsible for your data

The controller is NOMAMARE d.o.o. za trgovinu i usluge, which operates the BOVART brand and online store.

  • Address: Bračka 3, 21400 Supetar, Croatia
  • Croatian tax identification number (OIB): 29517387059
  • Court registration number (MBS): 060512909
  • Privacy contact: info@nomamare.com

References to “we”, “us” and “our” mean NOMAMARE d.o.o. You can contact us at the email or postal address above about this policy or to exercise your rights.

2. Information we collect and its sources

We receive information directly from you when you enter it on the website, place an order, use a form, subscribe or correspond with us. We also receive relevant payment results from Viva, delivery updates from postal providers, and service or consent records from our website and marketing systems.

Depending on how you use our services, this includes:

  • Contact and order details: your name, email address, delivery and billing addresses, telephone number where supplied, products ordered, amounts, order history and delivery information.
  • Payment records: payment method, transaction reference, payment status and refund information. Full card credentials are handled by the payment provider.
  • Account information, if you create an account: login credentials stored in protected form, account settings, saved addresses and order history.
  • Correspondence: messages, complaints, withdrawal requests, return details and any photographs or other information you choose to send.
  • Marketing and consent information: subscription status, the wording and time of your choices, form interactions, preferences and unsubscribe records.
  • Technical information: IP address, browser and device information, necessary session data and security logs.
  • Optional activity information, where you consent: pages or products viewed, cart and checkout events, purchases, advertising interactions and permitted email engagement data.

Optional behavioural tracking is controlled separately from information necessary to process an order or protect the website.

3. Why we use data and our legal bases

Order administration, payment, delivery, account services you request, and related customer support are based on performance of a contract or steps taken at your request before a contract (Article 6(1)(b) GDPR).

Invoices, accounting and tax records, statutory consumer obligations and responses to lawful requests from authorities are based on legal obligations (Article 6(1)(c) GDPR).

Newsletters, promotional emails, consent-based abandoned-cart reminders and optional website or email tracking are based on consent (Article 6(1)(a) GDPR), as explained below.

Website security, fraud prevention, resolving non-contractual enquiries, establishing or defending legal claims, and maintaining accurate consent and suppression records may be based on our legitimate interests (Article 6(1)(f) GDPR). We assess the necessity of that processing and balance it against your rights. Legitimate interests do not replace consent where consent is required for tracking or electronic marketing.

We do not require marketing or tracking consent as a condition of making an ordinary purchase.

4. Website hosting and store operation

The store runs on WordPress and WooCommerce, with Elementor used to build its pages. Hostinger provides hosting, email and related infrastructure services. Order and account data are stored in the store’s systems and backups, with access limited to people who need it for their work.

Authorised staff and technical providers may access necessary data to maintain the store, assist customers, fulfil orders and meet our obligations. Order exports used for fulfilment or accounting contain personal data and are handled for those purposes.

Our consent preferences are managed through the Pressidium Cookie Consent plugin. It records your choices and supports control of optional technologies. More information is in our Cookie Policy.

5. Payments and delivery

We use Viva.com (Viva Payments) and Viva Smart Checkout for online payments. Viva and the relevant payment institutions receive the information needed to authenticate and process payments, prevent fraud and handle refunds or disputes. Viva may act as an independent controller for its regulated payment activities and legal obligations. We do not store your full card number or card security code.

Read Viva’s Privacy Notice for details of its processing and rights procedures.

We share necessary recipient and delivery information with Hrvatska pošta and, where needed, the postal or delivery partners handling the destination part of the route. This is used to transport, track and deliver the goods, communicate about delivery and deal with delivery problems.

6. Newsletters and promotional forms

We use Omnisend to manage newsletter subscriptions, promotional popup and embedded forms, and permitted marketing automations. It processes contact details, subscription choices and related information on our behalf.

Our WooCommerce integration can synchronise contact, order and checkout data with Omnisend. We use relevant records to administer subscriptions and automations, avoid inappropriate messages such as reminders after a completed purchase, and tailor marketing where you have agreed to it. Administrative processing is limited to what is necessary for those purposes. A customer record in Omnisend does not automatically mean that the customer has subscribed to marketing.

We send newsletters and promotional emails when you choose to receive them. The form explains the subscription and any associated discount. You can withdraw consent at any time through the unsubscribe link in an email or by writing to info@nomamare.com. This does not affect a purchase or the lawfulness of processing before withdrawal.

Necessary order confirmations, payment messages, delivery updates and responses to your requests are service communications. They do not depend on newsletter consent.

For information about Omnisend, see its Privacy Policy and Data Processing Agreement.

7. Abandoned carts and email measurement

We may use Omnisend to send a reminder about an unfinished cart or checkout where you have given the relevant consent to receive those reminders. Entering an email address at checkout, without that consent, does not by itself authorise promotional reminders.

Website activity used to identify an abandoned cart for marketing is collected only with the required tracking consent. You can unsubscribe from reminders and change your website tracking choices independently.

We use delivery and bounce information to operate the email service. Where optional email open or link-click measurement is enabled, we explain it when collecting the relevant consent and use it only in accordance with that choice. Such measurement can record an interaction, its time and related device or technical data, and help assess or personalise campaigns.

Email tracking consent is separate from permission to receive newsletters. Website cookie choices do not automatically control tracking pixels or personalised tracking links inside an email. You can manage available email preferences through the preference link provided in our emails or contact us to withdraw the relevant consent.

8. Meta advertising tools when enabled

We may enable Meta advertising tools, including the Meta Pixel and, where configured, the Conversions API, to measure advertising, understand conversions and show relevant or retargeted ads on Facebook and Instagram.

When these tools are enabled, we collect and send optional advertising event data only after you consent to the relevant marketing category. Events may include page or product views, additions to a cart and purchases, together with IP address, browser information, cookie identifiers and transaction information.

If advanced matching or server-side matching is enabled, limited contact details such as an email address or telephone number may be transformed into a hashed form and sent for matching. Hashing does not make those data anonymous. Those features are subject to the same relevant consent requirements.

The EU provider is Meta Platforms Ireland Limited. For collection and transmission covered by Meta’s joint-controller arrangement, we and Meta act as joint controllers. Meta’s Controller Addendum explains the allocation of responsibilities. You can exercise your rights with us or Meta; Meta handles requests concerning data held in its own systems under that arrangement.

Meta may match events to its users and process information for its own purposes as an independent controller. Its Privacy Policy provides further information. Processing may involve Meta Platforms, Inc. in the United States.

This description does not mean that every Meta feature is active on every visit. Active optional technologies are identified through our Cookie settings. You can refuse or withdraw marketing tracking consent there without affecting your ability to buy from us.

9. Other recipients

We disclose relevant data only where needed for the stated purposes. Recipients may include our hosting and email provider, Omnisend, payment and postal providers, Meta where the relevant tools and consent apply, authorised technical support providers, accountants and professional advisers, and public authorities where disclosure is legally required.

Processors acting on our instructions are subject to appropriate data-processing terms. Some providers, including payment institutions and postal operators, may also have their own controller responsibilities. We do not give artists a customer marketing list merely because their products are sold in the store.

10. International transfers

Some providers and their subprocessors may process data outside the European Economic Area, including in the United Kingdom or the United States. The location of a delivery does not determine where service providers process data.

Where a transfer occurs, we rely on an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, with additional measures where required. The EU–US Data Privacy Framework may be used only where the recipient is certified and the transfer is covered.

Omnisend’s Data Processing Agreement describes its transfer safeguards. You can request information about the safeguards relevant to your data, including how to obtain a copy, by contacting us. Necessary redactions may protect confidential information or other people’s rights.

11. How long we retain information

We keep data for the time needed for its purpose and any applicable legal requirement, then delete it or anonymise it where appropriate.

  • Accounting records: invoices and supporting accounting documents are generally kept for at least 11 years where Croatian accounting law requires this, counted from the end of the relevant financial year.
  • Order and service records: retained to complete the purchase and handle returns, defects or disputes, then restricted to records needed for legal obligations or applicable claims periods.
  • Written complaints: the required complaint record is kept for at least one year after receipt, and longer only where another obligation or a specific dispute requires it.
  • Marketing records: used for marketing until you unsubscribe, withdraw consent or we discontinue the relevant purpose. We may keep limited consent evidence and an unsubscribe or suppression record for as long as needed to demonstrate compliance and respect your choice.
  • Account information: retained while the account is maintained. Closing an account does not remove records that must be kept for a separate legal reason.
  • Enquiries and technical records: retained for the time needed to resolve the enquiry, maintain security or investigate an identified issue, with longer retention only where necessary for a legal obligation or claim.
  • Cookies and local storage: retention depends on the item and your choices. Individual storage periods are shown in Cookie settings.

Backup copies are protected and removed or overwritten through the applicable backup cycle. Data retained only in a backup is not used for ordinary marketing.

12. Your rights and choices

Subject to the conditions in the GDPR, you can request access to your personal data, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests.

You have the right to object at any time to processing for direct marketing, including related profiling. We will stop that marketing processing. You can also withdraw consent at any time without affecting processing that was lawful before withdrawal.

Contact info@nomamare.com to exercise your rights. We may ask for proportionate information to verify your identity. We normally respond within one month. If a lawful extension is needed because of complexity or the number of requests, we will explain it within that first month.

You may complain to the Croatian Personal Data Protection Agency, AZOP, or to the supervisory authority in the EU/EEA country of your habitual residence, place of work or the alleged infringement. You do not have to contact us first.

13. Automated decisions and necessary information

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Marketing segmentation or recommendations may use the information and choices described above. Viva or other independent providers may apply their own fraud or regulatory checks under their privacy notices.

Some data is necessary to process a purchase, take payment, deliver goods or respond to a request. If you do not provide it, we may be unable to provide that service. Optional marketing and tracking data is not required to buy from us.

14. Security and changes

We apply technical and organisational measures appropriate to the data and risks, including access controls and safeguards for systems and records. No online service can guarantee absolute security.

We update this policy when our practices or legal requirements change. The current version will appear here with its update date. If a change requires new consent or a specific notice, we will obtain that consent or provide that notice before the relevant processing.