Privacy Policy

PNG Safety Ltd, trading as Blouzaki, Serifou 20A, 3046 Limassol, Cyprus, is the data controller for the personal data processed through this site.

For any privacy-related question or to exercise your rights, contact us at orders@blouzaki.com.

Point of contact for data protection matters: Maria Charalambous (a contact point, not a formally appointed Data Protection Officer), email: g.loucaides@pngsafety.com.

We collect and process the following categories of personal data:

• Identity and contact details — name, email address, phone number, delivery and billing address, company name and VAT number (B2B).
• Account credentials — email address, hashed password, session identifiers.
• Order and transaction data — items purchased, prices, order status, invoice records, correspondence relating to an order.
• Payment data — card details are entered on Viva.com’s own hosted payment page; we never see or store card numbers. For each transaction our system stores only the payment reference (order code), the order number, the amount and currency, the payment status, the customer email and the delivery address, and the relevant timestamps.
• Technical data — IP address, browser type, device information, pages visited, session cookies, security logs. Used to run and secure the site.

We process personal data on the following legal bases under Article 6 GDPR:

We do not currently use analytics or advertising tracking. If we introduce optional analytics or advertising cookies in the future, they will be used only with your prior consent and this policy will be updated first.

• Performance of a contract (Art. 6(1)(b)) — to accept and fulfil your order, arrange shipping via our supplier and courier, handle returns and withdrawals, and provide customer support.
• Legal obligation (Art. 6(1)(c)) — to issue invoices and retain accounting records for the period required by Cypriot tax law, and to respond to lawful requests from public authorities.
• Legitimate interests (Art. 6(1)(f)) — to secure the site, prevent fraud and keep the records needed to run the store. Our legitimate interests are balanced against your rights and freedoms.

We share personal data only with the partners necessary to run the site and fulfil orders:

• Shopify International Ltd (Ireland) — e-commerce and order-management platform; receives order, customer and delivery details. Acts as a processor.
• Supabase (Supabase Inc.) via Lovable Cloud — application hosting, database and authentication for the site; stores account and order data. Acts as a processor.
• Viva.com (Viva Payment Services Single Member S.A., Greece) — card-payment provider; operates the hosted payment page where card details are entered and processes the payment. Acts as an independent controller for the payment processing it performs.
• Velilla Group (Velilla Confección Industrial S.A., Spain) — supplier and shipping origin for stocked products; receives the delivery details necessary to ship the order. Acts as an independent controller for the fulfilment it performs.
• Courier partners — as required to deliver your order (name, address and phone number).
• Professional advisors, auditors and public authorities — where required by law.

Viva.com (Greece) and Velilla (Spain) are established in the EU, so no transfer outside the EEA takes place for their processing.

Shopify and Supabase/Lovable Cloud may process data on infrastructure outside the EEA (for example in the United States). Where this occurs, the transfer relies on the safeguards permitted by GDPR, such as Standard Contractual Clauses or the EU–US Data Privacy Framework where the provider is certified under it.

If you would like details of the safeguards that apply to a specific transfer, contact us at orders@blouzaki.com and we will provide them.

We retain personal data only for as long as necessary for the purposes above:

Please note: deletion of expired records is currently performed manually on request and in periodic clean-ups; automated deletion is not yet implemented for all categories.

• Order and invoice records — 6 years from the end of the relevant tax year, to comply with Cypriot tax and accounting law.
• Customer accounts — while the account is active; if you ask us to delete your account we do so, subject to the order and invoice records we must keep by law.
• Withdrawal and return records — kept with the related order records for the same period, as they evidence the performance of the contract.
• Website security logs — 12 months.

Under GDPR you have the right to access, correct, delete or restrict processing of your personal data, to object to processing based on legitimate interests or direct marketing, and to data portability. Where processing is based on consent you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact orders@blouzaki.com. We will respond within one month.

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (https://www.dataprotection.gov.cy) or with the supervisory authority in your country of residence.

The site uses only the following cookies and similar storage:

We do not use analytics, advertising or retargeting cookies, and no consent banner is therefore required at present.

• Strictly necessary cookies and storage — authentication session (stored by our hosting platform), cart contents, and your language preference (bz_lang). These are required for the site to function and do not require consent.

We apply appropriate technical and organisational measures to protect personal data, including HTTPS/TLS encryption in transit, hashed account passwords, row-level access controls in the database, and restricted administrative access. No system can be guaranteed 100% secure; you are responsible for keeping your account credentials confidential.

We may update this Privacy Policy from time to time. Material changes will be notified via the site and, where appropriate, by email. The "Last updated" date at the top reflects the most recent revision.