Privacy & Cookies policy

Last updated: 2 November 2026.

With this privacy policy we inform you about how we process your personal data. We know that the protection of this data is important to you and we appreciate the trust you place in us. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), the Italian Personal Data Protection Code (Legislative Decree 196/2003) for recipients in Italy and the applicable Maltese legislation (Data Protection Act, Cap. 586).

1. Who is responsible for data processing and who can I contact?

Anteprima Brands International Ltd. operates this website ("Website").

Contact details: Anteprima Brands International Ltd. 1, Ferris Building St. Lukes Street, Guardamangia PTA1020, Pieta Malta Telephone: +35620106811 Email: privacy@nuvitababy.com

2. For what purposes do we process your data and on what legal basis?

We process personal data in accordance with the provisions of the GDPR and applicable national law for the following purposes:

The processing of personal data (Article 4(2) GDPR) takes place to provide this website and to market the products, in particular to answer questions relating to our business relationships and for all activities necessary for the operation and administration of the company.

Anteprima Brands International Ltd. processes the personal information you provide as a user at registration, for purchase purposes. In particular, the following data are processed: name, email address, address (billing and, where applicable, a different shipping address), order information and telephone number.

In addition, we process your data beyond what is necessary for the website and the actual performance of the contract in order to pursue legitimate interests of third parties or our own, in particular in the following cases:

Answering your questions, whether or not related to a purchase;
Advertising, market and opinion research, provided you have not objected to the use of data;
Asserting legal claims and defending against legal disputes;
Ensuring IT security and IT operations;
Preventing or investigating crimes;
Business management and product development.

Our legitimate interest is to market our products in the best possible way, to develop these products and our company further, or to protect our company from threats and to assert our rights.

To the extent that you have given us your consent to the processing of personal data for specific purposes (e.g. evaluation or use of data for marketing purposes, tracking of email opens), the lawfulness of this processing is based on your consent. Consent can be withdrawn at any time. This also applies to the withdrawal of consents you gave us before the GDPR became applicable (before 25 May 2018). Please note that withdrawal only takes effect for the future. Processing carried out before the withdrawal is not affected.

In addition, we are subject to various legal obligations (for example anti-money laundering law, tax laws) which require the processing of data.

3. Who receives my data?

Within the respective controlling company, the departments that need your personal data to fulfil our contractual and legal obligations are given access to your data.

In addition, we transmit your data to the recipients expressly indicated in this privacy policy. We also transmit it to the following categories of recipients if this is necessary to fulfil a contractual relationship with you or to implement pre-contractual measures (Article 6(1) GDPR) or to pursue legitimate interests (Article 6(1)(f) GDPR):

IT service providers, in particular software as a service, hosting, storage and cloud computing providers,
logistics service providers,
email marketing service providers (including Klaviyo and Zoho) and customer service providers,
marketing service providers, in particular Google Ads consulting and WhatsApp service providers,
payment service providers for the collection of their fees.

To the extent that processing is required to pursue legitimate interests, such as the use of IT services, our legitimate interest is to outsource functions.

In addition, your personal data is forwarded or transmitted if required by law (Article 6(1)(c) GDPR), or if you have consented (Article 6(1)(a) GDPR).

4. How long will my data be stored?

To the extent necessary, we process and store your personal data for the duration of our contractual relationship. Please note that our contractual relationship is generally a continuing obligation.

Where a contractual relationship or another civil-law claim exists, the retention period is also governed by the statutory limitation periods.

The retention period of cookies depends on the individual case and is usually between 12 and 24 months.

Data collected through the tracking pixel is stored for 24 months. Newsletter data is stored until consent is withdrawn.

Google Analytics data is stored for 14 months, renewable with each new visit by the user.

5. Is data transferred to a third country or an international organisation?

Anteprima Brands International Ltd. itself does not transfer data to third countries (countries outside the European Economic Area, EEA). However, some of the recipients mentioned above will transfer personal data to third countries, but this will only take place on the basis of a decision by the EU Commission (for example, for US providers certified under the EU-US Data Privacy Framework) or, as indicated below, on the basis of standard data protection clauses of the EU Commission (available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) or binding corporate rules.

6. Website: log files

When you visit our website, the browser used on your device automatically sends information to the server hosting our website. This information is temporarily stored in a so-called log file. The following information is collected without your intervention and stored until automatic deletion: IP address of the requesting computer, date and time of access, name and URL of the file retrieved, website from which access is made ("referrer URL"), where applicable the search engine used, the browser used and, where applicable, the operating system of the computer and the name of the access provider.

The legal basis for this type of data processing is Article 6(1)(f) GDPR. The legitimate interests we pursue are in particular:

ensuring a smooth connection to the website,
ensuring comfortable use of our website,
invoicing,
statistical evaluation using a pseudonym to optimise our website and to offer quality and range,
evaluation of system security and stability,
further administrative purposes.

7. Marketing

To the extent that you have expressly consented pursuant to Article 6(1)(a) GDPR, we use your email address to inform you by email about our newsletter, our offers and special promotions. Your consent will be recorded.

To receive the newsletter, an email address is sufficient.

Consent can be withdrawn at any time, for example via the link at the end of every email. Alternatively, you can send your withdrawal at any time by email to privacy@nuvitababy.com. In that case, your email address will be removed from our mailing list and added to our blacklist. Withdrawal of consent only takes effect for the future and does not affect actions taken in the past.

7.2 Tracking pixel

The newsletters and promotional emails we send you contain a tracking pixel (or web beacon): a small invisible image that loads when you open the message. The pixel is associated with a technical identifier linked to your email address in the systems of the providers we use for sending (Klaviyo and Zoho Campaigns).

When you open an email, we may record the date and time of opening, the number of openings, information about the device and email program used, and the IP address (from which we derive the country). We also record clicks on the links contained in the message.

We use this information to understand which communications are most useful, to improve our content, to make it more relevant to your interests, and to decide how often to send messages.

Legal basis: your consent (Article 122 of the Italian Privacy Code and Article 6(1)(a) GDPR). For subscriptions made before 29 October 2026, tracking continues, after informing you, until you express a different choice.

How to choose: you can refuse tracking at any time by writing to privacy@nuvitababy.com: you will continue to receive our emails, but without tracking. If you refuse tracking, we do not limit the receipt of emails or the use of our services. Withdrawal takes effect for the future and does not affect the lawfulness of processing already carried out.

7.3 Advertising to existing customers

To the extent that you have already purchased our products, we will inform you from time to time by email about similar products and services from us, unless you have expressly objected to this.

The legal basis for the processing is Article 6(1)(f) GDPR. We have a legitimate interest in direct marketing, taking into account recital 47 of the GDPR.

You may object to the use of your email address for promotional purposes at any time at no additional cost, for example via the link at the end of every email or by email to privacy@nuvitababy.com.

Emails sent under this paragraph may contain the tracking pixel described in section 7.2, with the same terms and the same options.

8. Cookies and similar technologies

We use cookies on our website that collect your data using pseudonyms. Cookies are small text files generated by a website and saved by the internet browser on the hard drive when you visit the website. Depending on the cookie, different data are collected.

On our website we use technically necessary cookies, functional cookies, web analytics cookies and tracking cookies for advertising purposes.

If you wish to prevent the use of cookies, you can generally do the following:

You can delete existing cookies in your browser,
you can prevent the storage of (third-party) cookies in your browser settings,
you can use tools such as Ghostery (https://www.ghostery.com/) that block tracking tools,
you can deactivate personalised ads from providers that take part in the About Ads self-regulatory campaign (http://www.aboutads.info/choices),
you can use the opt-out functions of the Network Advertising Initiative (http://optout.networkadvertising.org/) or of the page http://www.youronlinechoices.com/ to prevent tracking.

Please note that it may not be possible to use all functions of our website if you block cookies.

8.1 Technically necessary cookies

Many of the cookies we use are technically necessary to allow you to use our website and the services offered on it ("session cookies"). These cookies allow, for example, placing goods in a shopping cart or logging in to the protected area. The legal basis for the processing is Article 6(1)(b) GDPR. The data will not be combined with other personal information and will not be used for advertising purposes. Session cookies are deleted at the end of the respective browser session, at the latest after seven days.

8.2 Functional cookies

We use temporary cookies to improve usability. These cookies are stored on your device for a certain period of time, allowing them to be recognised when you visit our site again and your preferences to be set automatically. The legal basis for the processing is Article 6(1)(f) GDPR.

8.3 Web analytics cookies

We use cookies to create user profiles with pseudonyms for web analytics purposes ("web analytics cookies"). These cookies allow us to recognise returning users (device owners), analyse their behaviour on our website, optimise our website and measure their interaction. The legal basis for the data processing is your consent (Article 122 of the Italian Privacy Code and Article 6(1)(a) GDPR). If you have given your consent, the data collected with Google Analytics may be shared with Google Ads and used to measure and optimise our campaigns, as described in section 8.4.

8.3.1 Google Analytics

For this web analysis we use the Google Analytics service (Google Analytics 4 version), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

Google Analytics uses cookies (in particular the _ga cookie and the _ga_ cookie followed by the property identifier) and similar identifiers that allow an analysis of your use of the website, such as the pages visited, the duration of the visit, the origin, the type and model of device, the browser and the operating system used. IP addresses are not logged or stored in Google Analytics 4: they are used only temporarily to derive an approximate location (country, region, city).

We have activated the Google Signals function. If you are logged in to your Google account and have consented to ads personalisation, Google may associate the information about your visit with that of your account, also across different devices, and use it for the reports we receive and for the personalisation and measurement of advertising. You can manage ads personalisation in your Google account settings (https://myadcenter.google.com).

Our Google Analytics account is linked to our Google Ads account. If you have given your consent, data about your visit may be shared with Google Ads to measure the results of our campaigns (for example conversions) and to create audiences of users to whom to show our advertising (remarketing), as described in section 8.4.1.

On our behalf, Google processes this information as a processor pursuant to Article 28 GDPR, to evaluate the use of the website, compile reports on website activity and provide us with further related services. We have also activated data sharing with Google for the improvement of its products and services: for this purpose Google processes some data as an independent controller, in accordance with its own privacy policy (https://policies.google.com/privacy). According to Google, such data are not used for Google's own ads personalisation.

Legal basis and consent: the processing is based on your consent (Article 122 of the Italian Privacy Code and Article 6(1)(a) GDPR), which you can give or withdraw at any time by changing your cookie preferences on the website. Without your consent, Google Analytics is not activated.

Retention: data collected by Google Analytics are stored for 14 months, after which they are automatically deleted. For data associated with the individual user the period is renewed with each new visit: they are therefore kept as long as you return to the site within 14 months of your last activity. Aggregated reports do not contain personal data.

Transfers outside the EU: some data may be transferred to Google LLC in the United States. The transfer is covered by the adequacy decision of the European Commission of 10 July 2023 on the EU-US Data Privacy Framework, pursuant to Article 45 GDPR, as Google LLC is certified under that framework (https://www.dataprivacyframework.gov).

Opt-out: you can prevent the collection of data by Google Analytics by downloading and installing the browser add-on (https://tools.google.com/dlpage/gaoptout?hl=en).

For further information on the terms of use and privacy of Google Analytics, visit https://marketingplatform.google.com/about/analytics/terms/us/ and https://support.google.com/analytics/answer/6004245?hl=en.

8.3.2 Other cookies

We continually adapt our web data analysis to market needs. The use of cookies therefore changes continuously. Through the cookie banner on our website, we provide information on other cookies used and the purpose of their use.

8.4 Tracking cookies for advertising purposes

We also use tracking cookies for the purposes of targeted, interest-based online advertising ("advertising cookies"). These cookies collect and store information about the use of our website in pseudonymised form. The legal basis for the data processing is Article 6(1)(a) GDPR, that is, your consent. You can withdraw your consent at any time. The lawfulness of processing carried out on the basis of your consent until withdrawal remains unaffected.

We use the information to place advertisements in line with your interests on our website and on third-party websites (if they are part of our advertising network). You will benefit because you will be shown fewer advertisements that do not reflect your interests. We also use the information to measure and optimise the success of our advertising campaigns.

In particular, we use the following tracking cookies (and tracking pixels) for advertising purposes.

8.4.1 Google Ads

This website uses the online advertising service Google Ads with conversion tracking, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

We use the service to place ads on the results page of a Google search or on a website of the Google advertising network (so-called Google Ads). Our purpose is to draw your attention to our offers. Conversion tracking allows us to measure the success of our individual advertising measures using certain parameters (e.g. placement of ads or clicks by the user).

When you click on an ad placed by Google, Google stores a conversion tracking cookie on your computer. These cookies usually expire after 30 days and are not intended to identify you personally. For this cookie, the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions) and opt-out information (a marker that the user no longer wishes to be targeted) are generally stored as analysis values.

These cookies help Google recognise your browser. If you visit certain pages on the website of a Google Ads customer and the cookie has not yet expired, Google and the customer may recognise that you clicked on the ad and were redirected to the website. A different cookie is assigned to each Google Ads customer. The cookies therefore cannot be tracked across the websites of Google Ads customers. From Google we receive statistical evaluations, such as the total number of users who clicked on an ad and were redirected to a website with a conversion tracking tag, and we can define audiences of users to whom to show our ads (remarketing). We do not receive data that directly identifies you, such as your name or email address. Based on these evaluations we can recognise which of the advertising measures used are particularly effective.

Our Google Ads account is linked to our Google Analytics account (see section 8.3.1) and we may use remarketing audiences.

Thanks to the technologies used, your browser automatically establishes a direct connection to a Google server in the United States. The transfer of information to a third country outside the EU is covered by the adequacy decision of the European Commission of 10 July 2023 on the EU-US Data Privacy Framework, pursuant to Article 45 GDPR, as Google is certified under that framework (https://www.dataprivacyframework.gov).

By integrating Google Ads with conversion tracking, Google receives the information that you have visited the corresponding page of our website or clicked on one of our ads. If you are registered with a Google service, Google may associate the data with your account. Even if you are not registered or logged in to Google, it is possible that Google may obtain and store your IP address.

Further information on data processing in the context of Google Ads is available at https://policies.google.com/privacy?hl=en.

8.4.2 Other cookies

We continually adapt our online advertising to market needs. The use of cookies for this purpose therefore changes continuously. Through the cookie banner on our website, we provide information on other cookies used and the purpose of their use.

8.5 Hotjar

On our website, using technologies provided by Hotjar (Hotjar Ltd., St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 1000, Malta) with the analytics service "Hotjar", visitor interaction data are collected and stored to optimise the user experience and to improve customer satisfaction. For this purpose, mouse clicks, mouse movements and scrolling movements, as well as keyboard input, may be recorded.

Hotjar does not record this data on websites that do not use the Hotjar system. The collection and storage of data can be objected to at any time and you can opt out here: https://www.hotjar.com/opt-out. In some cases, deactivation may limit the functionality of our website.

8.6 LinkedIn

We have integrated components of LinkedIn Corporation on our website. LinkedIn is an internet-based social network that allows users to connect with existing business contacts and create new business contacts.

The operating company of LinkedIn is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. Privacy policy matters outside the United States are handled by LinkedIn Ireland, Privacy Policy Issues, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

Each time you visit our website, which has a LinkedIn component (LinkedIn plug-in), this component causes the browser used by the data subject to download a corresponding representation of the LinkedIn component. Further information on LinkedIn plug-ins is available at https://developer.linkedin.com/plugins. As part of this technical process, LinkedIn learns which specific subpage of our website is visited by the data subject.

If the data subject is logged in to LinkedIn at the same time, LinkedIn recognises with each visit to our website by the data subject, and for the entire duration of their stay on our website, which specific subpage of our website the data subject visits. This information is collected through the LinkedIn component and linked by LinkedIn to the LinkedIn account of the data subject. If the data subject activates a LinkedIn button integrated on our website, LinkedIn assigns this information to the personal LinkedIn user account of the data subject and stores this personal data.

LinkedIn always receives information through the LinkedIn component that the data subject has visited our website if the data subject is logged in to LinkedIn at the time of accessing our website; this happens regardless of whether or not the person clicks on the LinkedIn component. If the data subject does not wish this information to be transmitted to LinkedIn, they can prevent it by logging out of their LinkedIn account before visiting our website.

On https://www.linkedin.com/psettings/guest-controls, LinkedIn offers the option to unsubscribe from email messages, text messages and targeted ads, as well as to manage ad settings. LinkedIn also uses partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua and Lotame, which may set cookies. Such cookies can be refused at https://www.linkedin.com/legal/cookie-policy. LinkedIn's privacy policy is available at https://www.linkedin.com/legal/privacy-policy.

8.7 Facebook

The controller has integrated components of the Facebook company on this website. Facebook is a social network.

A social network is an internet-based social meeting place, an online community that generally allows users to communicate with each other and interact in virtual space. A social network can serve as a platform for the exchange of opinions and experiences or allow the internet community to provide personal or business information. Facebook allows users of the social network to create private profiles, upload photos and socialise through friend requests.

The operating company of Facebook is Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. The persons responsible for the processing of personal data, if a data subject lives outside the United States or Canada, are Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Each time one of the individual pages of this website, operated by the controller and on which a Facebook component (Facebook plug-in) has been integrated, is visited, the internet browser on the data subject's computer system is automatically prompted by the respective Facebook component to download a representation of the corresponding Facebook component from Facebook. An overview of all Facebook plug-ins is available at https://developers.facebook.com/docs/plugins/. As part of this technical process, Facebook receives information about which specific subpage of our website is visited by the data subject.

If the data subject is logged in to Facebook at the same time, Facebook recognises with each visit to our website by the data subject, and for the entire duration of their stay on our website, which specific subpage of our website the data subject visits. This information is collected through the Facebook component and assigned by Facebook to the respective Facebook account of the data subject. If the data subject activates one of the Facebook buttons integrated on our website, for example the "Like" button, or if the data subject makes a comment, Facebook assigns this information to the personal Facebook user account of the data subject and stores this personal data.

Facebook always receives information through the Facebook component that the data subject has visited our website if the data subject is logged in to Facebook at the same time as accessing our website; this happens regardless of whether or not the person clicks on the Facebook component. If the data subject does not wish this information to be transmitted to Facebook, they can prevent the transmission by logging out of their Facebook account before accessing our website. The data policy published by Facebook, available at https://www.facebook.com/about/privacy/, provides information on the collection, processing and use of personal data by Facebook. It also explains which options Facebook offers to protect the data subject's privacy.

As a Facebook member, you can also change your account settings at https://www.facebook.com/ads/website_custom_audiences/ and deactivate cross-device data collection via Custom Audiences. For further information on Facebook's privacy policy, visit: https://www.facebook.com/about/privacy/.

The use of our Facebook page is generally possible without providing personal information. To the extent that personal data (e.g. name, address or email addresses) are collected on our website, for example by contacting us directly via Facebook message, this is always done on a voluntary basis. This data will not be disclosed to third parties without your express consent.

We operate this site to draw attention to our services, events and other promotions and to contact you as a visitor and user of this Facebook page and of our website. As the operator of the Facebook page, we have no interest in the collection and further processing of your personal data for analysis or marketing purposes. Further information on how we handle personal data is available in our privacy policy on our website. The operation of this Facebook page, including the processing of users' personal data, is based on our legitimate interest in timely and supportive information and opportunities for interaction for and with our users and visitors (Article 6(1)(f) GDPR). We also process the information you provide to us voluntarily on the basis of your consent, pursuant to Article 6(1)(a) GDPR.

Processing of personal data by Facebook:

In its judgment of 5 June 2018, the Court of Justice of the European Union (CJEU) held that the operator of a Facebook page is, together with Facebook, a controller of the processing of personal data.

Facebook processes user data for the following purposes:

Advertising, analysis, creation of personalised advertising
Creation of user profiles
Market research

When you access this page, Facebook automatically saves information in a log file that your browser sends to Facebook. We expressly stress that we are not aware of the scope and content of the data collected by Facebook and of its processing and use or, where applicable, of its transmission to third parties via Facebook.

For information on Facebook's privacy practices, see Facebook's privacy policy at https://www.facebook.com/policy.php.

Facebook uses cookies to store and further process this information, that is, small text files that are stored on the users' various devices. If the user has a Facebook profile and is logged in, storage and analysis are also cross-device. Facebook's privacy policy contains further information on data processing at Facebook: https://www.facebook.com/about/privacy/.

Meta Platforms, Inc., the US parent company of Facebook Ireland Ltd., is certified under the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov), on which transfers of data to the United States are based pursuant to Article 45 GDPR.

The transmission and further processing of users' personal data to third countries, such as the United States, and the possible associated risks for users cannot be excluded by us as operators of the site.

Statistical data

Statistical data on the different categories of visitors to the Facebook page are available to us in Facebook "Insights". These statistics are generated and provided by Facebook. We have no influence on their generation and presentation as operators of the page.

We cannot disable this function or prevent the generation and processing of the data. For a selectable period and for each of the groups Fans, Subscribers and Interacting users, we receive the following data from Facebook about our Facebook page: total page views, likes, page activity, posts, reach, video views, range of contributions, comments, shared content, replies, share of men and women, origin by country and city, language, views and clicks in the shop, clicks on route planning, clicks on telephone numbers. It also provides data on the Facebook groups linked to our Facebook page. Because of Facebook's constant development, the availability and preparation of the data are changing, so we are looking for further details in the Facebook privacy policy mentioned above. We use this aggregated data to make our posts and activities on our Facebook page more interesting for users. For example, we use the age and gender distribution for a personalised approach and the preferred visiting times of users for optimised time planning of our contributions.

Information on the type of devices used by visitors helps us to adapt articles visually. In accordance with Facebook's terms of use, to which every user agreed when creating a Facebook profile, we can identify the subscribers and fans of the page and view their profiles and other shared information.

You can find the option to unsubscribe here: https://www.facebook.com/policies/cookies/ and here: http://www.youronlinechoices.com/.

8.8 Bing Ads conversion tracking

Our online services also use Microsoft conversion tracking (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA). Microsoft Bing Ads places a cookie on your computer if you have accessed our website through a Microsoft Bing ad. In this way Microsoft Bing and we can recognise that someone has clicked on an ad, was redirected to our website and reached a previously determined landing page (conversion page). We only record the total number of users who clicked on a Bing ad and were then redirected to the conversion page. No personal information about the identity of the user is provided. If you do not wish to take part in the tracking process, you can also refuse the setting of a cookie, for example through a browser setting that generally disables the automatic setting of cookies. For further information on privacy and the cookies used with Microsoft Bing, visit the Microsoft website.

8.9 Instagram

We have integrated components of the Instagram service on our website. Instagram is a service that qualifies as an audiovisual platform, which allows users to share photos and videos and also to redistribute such data through social networks.

The operating company of the Instagram services is Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, California, USA.

Each time you visit one of the individual pages of this website that is operated by us and on which an Instagram component (Insta button) has been integrated, the internet browser on the data subject's computer system is automatically prompted by the respective Instagram component to download a representation of the corresponding Instagram component. As part of this technical process, Instagram learns which specific page of our website is visited by the data subject.

If the data subject is logged in to Instagram at the same time, Instagram recognises each visit to our website by the data subject and which specific subpage the data subject visits during the entire duration of their stay on our website. This information is collected through the Instagram component and assigned via Instagram to the Instagram account of the data subject. If the data subject activates one of the Instagram buttons integrated on our website, the data and information transmitted with it are assigned to the personal Instagram user account of the data subject and stored and processed by Instagram.

Instagram always receives information through the Instagram component that the data subject has visited our website if the data subject is logged in to Instagram at the time of accessing our website; this happens regardless of whether or not the person clicks on the Instagram component. If the data subject does not wish this information to be transmitted to Instagram, they can prevent the transmission by logging out of their Instagram account before accessing our website.

Further information and Instagram's privacy policy are available at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

8.10 YouTube

We have embedded YouTube components on this site. YouTube is an internet video portal that allows video publishers to freely post video clips and other users to view, rate and comment on them free of charge. YouTube allows the publication of all kinds of videos, so that both complete film and television broadcasts, and music videos, trailers or videos made by users are available through the internet portal.

The operating company of YouTube is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

Each time you visit one of the pages of this site operated by us in which a YouTube component (YouTube video) is embedded, the internet browser on the data subject's computer system is automatically prompted by the respective YouTube component to download a representation of the corresponding YouTube component from YouTube. Further information about YouTube is available at https://www.youtube.com/yt/about/. As part of this technical process, YouTube and Google will know which specific page of our site the person is visiting.

If the person is logged in to YouTube at the same time, YouTube recognises, when a subpage containing a YouTube video is accessed, which specific page of our website the data subject has visited. This information will be collected by YouTube and Google and associated with the YouTube account of the data subject.

YouTube and Google always receive information through the YouTube component that the data subject has visited our website if the data subject is logged in to YouTube at the time of accessing our website; this happens regardless of whether or not the person clicks on a YouTube video. If the data subject does not wish this information to be transmitted to YouTube and Google, they can prevent the transmission by logging out of their YouTube account before accessing our website.

YouTube's privacy policy, available at https://policies.google.com/privacy, describes the collection, processing and use of personal information by YouTube and Google.

9. Payment service providers

9.1 PayPal as a payment method

We have integrated PayPal components on this website. PayPal is an online payment service provider. Payments are made through so-called PayPal accounts, which are virtual private or business accounts. In addition, PayPal can process virtual payments by credit card if a user does not have a PayPal account. A PayPal account is managed through an email address, which is why there is no classic account number. PayPal makes it possible to initiate online payments to third parties or to receive payments. PayPal also performs trustee functions and offers buyer protection services.

The European operating company of PayPal is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

If the data subject selects "PayPal" as a payment option during the order process in our online shop, the data subject's data will be automatically transmitted to PayPal. By selecting this payment option, the data subject consents to the transfer of the personal data necessary for processing the payment.

The personal data sent to PayPal are generally first name, last name, address, email address, IP address, telephone number, mobile number or other data required for payment processing. For the performance of the purchase contract, personal data in connection with the respective order are also necessary.

The purpose of the data transmission is payment processing and fraud prevention. The controller will provide PayPal with personal identification information, in particular if there is a legitimate interest in the transfer. The personal data exchanged between PayPal and the controller may be transferred by PayPal to credit reporting agencies. This transmission is for the purposes of identity and credit verification.

PayPal may disclose personal information to affiliated companies and service providers or subcontractors to the extent necessary to fulfil its contractual obligations or to process the data on behalf of the controller.

The data subject has the possibility to withdraw consent to the processing of personal data towards PayPal at any time. A withdrawal has no effect on personal data that must be processed, used or transmitted for (contractual) payment processing.

PayPal's applicable privacy policy is available at https://www.paypal.com/en/webapps/mpp/ua/privacy-full.

9.2 Visa and Mastercard as a payment method

We use external payment service providers, through whose platforms users and we can carry out payment transactions, for example Visa (https://www.visa.co.uk/legal/privacy-policy.html) and Mastercard (https://www.mastercard.com/global/en/privacy.html).

Payment transactions using the means of payment offered take place exclusively via an encrypted SSL or TLS connection. You can recognise an encrypted connection by the change in the address bar of the browser from "http://" to "https://" and by the padlock symbol in the browser bar. In the case of encrypted communications, the payment details you send us cannot be read by third parties.

The data processed by the payment service providers include inventory data, e.g. name and address, bank data such as account numbers or credit card numbers, passwords, TANs and checksums, as well as information relating to the contract, summary and recipient. The information is necessary to complete the transactions. However, the data entered will be processed and stored only by the payment service providers. We do not receive any account or credit card information, but only information confirming or negatively disclosing the payment. The data may be transmitted by the payment service providers to credit reporting agencies. This transmission is for the purpose of verifying identity and creditworthiness. For this we refer to the terms and privacy policy of the payment service providers.

For payment transactions, the terms and conditions and privacy policies of the respective payment service providers apply, available on their respective websites or transaction applications. We also refer to these for further information and for the assertion of withdrawal rights, information and other data subjects' rights.

10. What data protection rights do I have?

You have the right of access (Article 15 GDPR), the right to rectification (Article 16), the right to erasure (Article 17), the right to restriction of processing (Article 18) and the right to data portability (Article 20). You also have the right to object to our processing of your data (Article 21). To the extent that the processing of your personal data is based on consent (Article 6(1)(a) GDPR), you may withdraw it at any time; the lawfulness of processing carried out on the basis of consent until the withdrawal is not affected.

Consent to tracking can also be withdrawn separately from consent to receive emails.

To exercise all these rights and for further questions on personal data matters, you can write to privacy@nuvitababy.com or to our postal address (see section 1).

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your residence or place of work or of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR or other applicable data protection laws (Article 77 GDPR).