Privacy policy

Last updated: 16 June 2026

This Privacy Policy explains how Nutrikal LTD / “Nutrikal” EOOD, as data controller, collects, uses, stores, discloses and protects personal data when users access and use the website and online store collagenlab.eu.

CollagenLab® operates this website and online store, including the related information, content, features, tools, products and services, in order to provide users with a functional, secure and personalised shopping experience.

The online store is powered by Shopify, which enables us to provide services related to product browsing, shopping cart functionality, checkout, payments, orders and other store features.

Please read this Privacy Policy carefully. By using the website, creating a customer account, placing an order, subscribing to marketing communications or contacting us, you confirm that you understand how we process your personal data.

If there is any conflict between the Terms and Conditions and this Privacy Policy regarding the processing of personal data, this Privacy Policy shall prevail.

I. Data Controller Details

Data Controller: Nutrikal LTD / “Nutrikal” EOOD
Company Registration Number / UIC: 202245000
VAT Number: BG202245000
Registered office and address: Republic of Bulgaria, Varna 9002, Primorski District, 65 Trakia Street
Contact email: hello@collagenlab.eu
Phone: +359 882 91 91 40
Website: https://collagenlab.eu

For the purposes of applicable data protection legislation, including Regulation (EU) 2016/679 (GDPR), Nutrikal LTD / “Nutrikal” EOOD is the controller of personal data processed in connection with the operation of the online store collagenlab.eu.

II. What “Personal Data” Means

When we use the term “personal data”, we mean any information that identifies you or can reasonably be linked to you as an individual. This includes, for example, your name, address, phone number, email address, IP address, order details, payment-related information, communications with us and similar data.

Personal data does not include information that has been anonymised or processed in such a way that it can no longer be linked to an identified or identifiable individual.

III. Personal Data We Collect

Depending on how you use the website and our services, we may collect and process the following categories of personal data:

  • First and last name;
  • Delivery address;
  • Billing address, where applicable;
  • Phone number;
  • Email address;
  • Customer account data, including username, preferences and settings, where applicable;
  • Order data, including purchased products, returned products, cancelled orders and transaction history;
  • Information about products you view, add to cart, purchase or return;
  • Payment-related information, payment method, payment confirmation and related transaction information;
  • Communications with us, including enquiries, complaints, return requests, customer support and other correspondence;
  • Device information, browser information, operating system, IP address, network connection and other technical identifiers;
  • Usage information, including how and when you interact with the website, which pages you visit, actions you take and how you navigate the website;
  • Data collected through cookies, pixels, tags and similar technologies;
  • Marketing preferences, including whether you have consented to receiving commercial communications.

We do not request or intentionally collect special categories of personal data, such as health data, ethnic origin, religious beliefs or biometric data. If you voluntarily provide such information in communication with us, it will be processed only to the extent necessary to respond to your request and in accordance with applicable law.

IV. Sources of Personal Data

We may collect personal data from the following sources:

  • Directly from you, when you place an order, create an account, complete a contact form, subscribe to our email newsletter or communicate with us;
  • Automatically through the website, including from your device, browser, IP address and through the use of cookies and similar technologies;
  • From service providers that support the operation of the website, payments, delivery, marketing, analytics, security and customer support;
  • From Shopify, which provides the technological platform for the online store;
  • From business, marketing or advertising partners, where lawful and applicable.

V. Purposes for Processing Your Personal Data

We process your personal data for the following purposes:

  • Accepting, processing and fulfilling orders;
  • Processing and confirming payments;
  • Organising and carrying out delivery;
  • Creating, maintaining and managing customer accounts, where applicable;
  • Remembering preferences, products in the cart and other information necessary for the functioning of the store;
  • Communicating with you regarding orders, deliveries, returns, complaints, customer support and enquiries;
  • Processing returns, exchanges, cancellations and refunds;
  • Issuing accounting documents and complying with tax and legal obligations;
  • Providing, adapting and improving the services, website and user experience;
  • Recommending products related to your purchases or interests, where applicable;
  • Protecting against fraud, abuse, unauthorised access and malicious activity;
  • Ensuring secure payment and shopping;
  • Sending marketing communications, promotions, offers, recipes, news and other content, where you have given consent or where permitted by law;
  • Displaying and measuring online advertisements, including advertisements based on your behaviour on the website, where permitted;
  • Analysing website traffic, user behaviour, campaign performance and technical website performance;
  • Establishing, exercising or defending legal claims;
  • Complying with applicable legal, regulatory, judicial or administrative requirements.

VI. Legal Bases for Processing

We process your personal data only where we have a valid legal basis under applicable law, including:

  • Performance of a contract - where processing is necessary to accept, process and fulfil an order or provide a service requested by you;
  • Legal obligation - where we are required to store or process certain data for accounting, tax, consumer protection, regulatory or other legal purposes;
  • Legitimate interest - for fraud prevention, website security, service improvement, technical support, protection of our rights and management of business operations;
  • Consent - for sending marketing communications, using certain cookies or in other cases where consent is required by law;
  • Protection of legal claims - where processing is necessary to establish, exercise or defend legal rights.

VII. Payments

Payments in the online store are processed through external payment providers and secure payment systems. We do not store full bank card details, such as full card number, CVV code or other sensitive payment information.

When making a payment, you may be redirected to a payment provider or payment system that processes your data in accordance with its own terms and privacy policy.

VIII. Delivery and Courier Services

In order to fulfil your order, we provide the necessary delivery data to courier or logistics partners. This may include your name, delivery address, phone number, email address, order number and other information necessary for delivery.

Courier companies process this data for the purpose of carrying out the delivery and in accordance with their own privacy policies and applicable legal requirements.

IX. Relationship with Shopify

The online store is powered by Shopify. Shopify provides the technological infrastructure that enables the operation of the store, including hosting, checkout, order management, shopping cart data processing, security, analytics features and other tools.

Information that you provide through the website may be transferred to and processed by Shopify and Shopify-related service providers, including providers that may be located outside the country where you live, for the purpose of providing, securing, improving and maintaining the services.

In certain cases, Shopify may process personal data as an independent controller for its own purposes related to security, service improvement, fraud prevention, analytics and other platform functions. For more information, you may review Shopify’s privacy policy.

X. Other Technology Providers

In connection with the operation of the website, we may use other service providers, including providers of hosting, email communications, SMS communications, analytics tools, marketing platforms, advertising platforms, fraud prevention systems, payment providers and apps integrated with Shopify.

These providers process personal data only to the extent necessary to provide the relevant service and in accordance with applicable law.

XI. Marketing and Advertising

If you have given consent, we may use your email address to send you news, promotions, special offers, recipes, product information and other marketing content related to CollagenLab®.

We may also use personal data and technical information to display, personalise and measure online advertisements on our website or on other websites and platforms, where permitted by law and in accordance with your cookie and privacy settings.

You may withdraw your consent to marketing emails at any time through the unsubscribe link included in each marketing message or by contacting us at hello@collagenlab.eu.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

XII. Cookies and Similar Technologies

The website uses cookies and similar technologies to function properly, improve user experience, analyse traffic, remember preferences and support marketing and advertising activities.

Cookies may include:

  • Necessary cookies - required for the basic operation of the website, cart, checkout process and security;
  • Analytics cookies - used to analyse website traffic and user behaviour;
  • Functional cookies - used to remember settings and preferences;
  • Marketing and advertising cookies - used to personalise ads and measure campaign performance.

Where the law requires consent, such cookies are used only after your explicit consent. You may manage your cookie preferences through the cookie banner or privacy settings on the website, where such functionality is available.

XIII. With Whom We Share Personal Data

We may share personal data only where necessary and lawful, including with the following categories of recipients:

  • Shopify and related technology providers;
  • Payment providers and banks;
  • Courier and logistics companies;
  • Email and SMS communication providers;
  • Marketing, advertising and analytics service providers;
  • Fraud prevention and payment security systems;
  • Accountants, legal and business advisers;
  • Public authorities, regulators, courts, law enforcement bodies or other institutions where required by law;
  • Suppliers and partners that support the operation of the website, order fulfilment and provision of our services;
  • Third parties where you have instructed, requested or consented to the disclosure of information.

We do not sell your personal data to third parties.

XIV. Third-Party Websites and Links

The website may contain links to external websites, social media platforms, payment systems, platforms or third-party services. If you follow a link to a website or service that is not operated by us, we recommend that you review their privacy policy, terms of use and security settings.

We are not responsible for the content, accuracy, security or privacy practices of external websites, platforms and third-party services.

XV. International Data Transfers

Some of our service providers, including Shopify and its subprocessors, may process, store or transfer personal data outside the country where you live, including outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, appropriate legal mechanisms and safeguards are applied in accordance with applicable data protection law.

Such mechanisms may include standard contractual clauses, adequacy decisions or other permitted safeguards under the GDPR.

XVI. Data Retention Periods

We store personal data only for the period necessary for the purposes for which it was collected, unless the law requires or permits a longer retention period.

Typical retention periods may include:

  • Order and billing data - for the period required under accounting and tax legislation;
  • Customer communication data - for the period necessary to process the enquiry and protect legal interests;
  • Customer account data - while the account is active or until deletion is requested, where applicable;
  • Marketing data - until consent is withdrawn or the user unsubscribes from marketing communications;
  • Technical, analytics and security data - for a reasonable period necessary for security, analytics, fraud prevention and service improvement;
  • Data required for legal claims - for the period necessary to protect our rights and legitimate interests.

XVII. Security of Personal Data

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction.

However, no method of transmitting or storing information over the internet can be guaranteed to be completely secure. Therefore, we cannot guarantee absolute or perfect security of data.

We recommend that you do not send sensitive or confidential information to us through insecure channels. The User is responsible for keeping their account login details secure and for using secure devices and networks.

XVIII. Your Rights

Under applicable law, you have the following rights regarding your personal data:

  • Right of access to the personal data we process about you;
  • Right to information about the processing of your personal data;
  • Right to rectification of inaccurate or incomplete data;
  • Right to erasure of personal data where legal grounds exist;
  • Right to restriction of processing;
  • Right to object to processing based on legitimate interest;
  • Right to object to direct marketing;
  • Right to data portability, where applicable;
  • Right to withdraw consent at any time where processing is based on consent;
  • Right to lodge a complaint with a supervisory authority.

These rights are not absolute and may be limited in certain cases provided by applicable law. In some situations, we may refuse to comply with a request where permitted by law.

To exercise your rights, you may contact us at hello@collagenlab.eu. We may request additional information to verify your identity before fulfilling your request.

We will not discriminate against you for exercising any of your rights.

XIX. Managing Communication Preferences

You may opt out of receiving promotional emails at any time through the unsubscribe link in the relevant message or by contacting us at hello@collagenlab.eu.

If you unsubscribe from marketing communications, we may still send you non-promotional messages related to your orders, deliveries, account, returns, complaints or other administrative and service communications.

XX. Complaints to a Supervisory Authority

If you believe that the processing of your personal data violates applicable law, you have the right to lodge a complaint with the competent supervisory authority:

Commission for Personal Data Protection
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Website: https://www.cpdp.bg

Before filing a complaint, you may contact us at hello@collagenlab.eu so that we can try to resolve the matter promptly.

XXI. Children’s Personal Data

The website and products are not intended for persons under the age of 18. We do not knowingly collect personal data from children.

If you are a parent or guardian and believe that a child has provided us with personal data, you may contact us at hello@collagenlab.eu to request deletion of that data.

XXII. Changes to This Privacy Policy

We may update this Privacy Policy periodically, including to reflect changes in our practices, services, technology solutions, providers or legal requirements.

The updated version will be published on this page and will take effect from the moment of publication, unless otherwise stated.

Where required by applicable law, we may provide additional notice of material changes.

XXIII. Contact Details

For questions about this Privacy Policy, the processing of personal data or the exercise of your rights, you may contact us through:

Email: hello@collagenlab.eu
Phone: +359 882 91 91 40
Trader: Nutrikal LTD / “Nutrikal” EOOD
Company Registration Number / UIC: 202245000
VAT Number: BG202245000
Address: Republic of Bulgaria, Varna 9002, Primorski District, 65 Trakia Street
Website: https://collagenlab.eu