Privacy Policy

PNG Safety Ltd ("PNG Safety", "we", "us", "our"), Serifou 20A, 3046 Limassol, Cyprus, is the data controller for the personal data processed through this Site.

For any privacy-related question or to exercise your rights, contact us at orders@pngsafety.com.

Data Protection Officer / point of contact: [TO CONFIRM: DPO name and email, or state "not appointed — enquiries handled by the address above"].

We collect and process the following categories of personal data:

• Identity and contact details — name, email address, phone number, delivery and billing address, company name and VAT number (B2B).
• Account credentials — email address, hashed password, session identifiers.
• Order and transaction data — items purchased, prices, order status, invoice records, correspondence relating to an order.
• Payment data — we do NOT store card numbers. Payments are handled by JCC Payment Systems on a PCI-DSS hosted page; we receive only a transaction reference, the amount, and success / failure status.
• Technical data — IP address, browser type, device information, pages visited, session cookies, security logs. Used to run and secure the Site.
• Marketing preferences — where you have opted in, your consent record for newsletters and marketing emails.

We process personal data on the following legal bases under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)) — to accept and fulfil your order, arrange shipping via our supplier and courier, handle returns, and provide customer support.
• Legal obligation (Art. 6(1)(c)) — to issue invoices and retain accounting records for the period required by Cypriot tax law (currently [TO CONFIRM: 6 years]), and to respond to lawful requests from public authorities.
• Legitimate interests (Art. 6(1)(f)) — to secure the Site, prevent fraud, analyse aggregated usage, and improve our products and services. Our legitimate interests are balanced against your rights and freedoms.
• Consent (Art. 6(1)(a)) — for optional marketing emails and non-essential cookies. You can withdraw consent at any time.

We share personal data only with the processors and partners necessary to run the Site and fulfil orders:

• Velilla Confección Industrial S.A. (Spain) — supplier and shipping origin for stocked products; receives delivery details necessary to ship the order.
• JCC Payment Systems Ltd (Cyprus) — card-payment processor; handles the hosted payment page and returns a transaction reference to us.
• Shopify International Ltd (Ireland / EU) — e-commerce and order-management platform.
• Supabase / Lovable Cloud — application hosting, database and authentication provider for the Site.
• Courier partners — as required to deliver your order (name, address and phone number).
• Professional advisors, auditors and public authorities — where required by law.

Some of our processors may transfer personal data outside the European Economic Area (e.g. to hosting infrastructure in the United States). Where this occurs we rely on the safeguards permitted by GDPR, including Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable.

We retain personal data only for as long as necessary for the purposes above:

• Order and invoice records — [TO CONFIRM: 6 years] to comply with Cypriot tax and accounting law.
• Customer accounts — while the account is active plus [TO CONFIRM: 2 years] of inactivity, after which the account is deleted or anonymised.
• Marketing consent records — until consent is withdrawn plus a short period to evidence the withdrawal.
• Website security logs — [TO CONFIRM: 12 months].

Under GDPR you have the right to access, correct, delete or restrict processing of your personal data, to object to processing based on legitimate interests or direct marketing, and to data portability. Where processing is based on consent you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact orders@pngsafety.com. We will respond within one month.

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (https://www.dataprotection.gov.cy) or with the supervisory authority in your country of residence.

We use a minimal set of cookies and similar technologies:

• Strictly necessary — session cookies for authentication, cart state and security. These do not require consent.
• Analytics — [TO CONFIRM: state whether analytics cookies (e.g. Google Analytics, Plausible) are used; if yes, list them and the retention period].
• Marketing — [TO CONFIRM: state whether marketing / retargeting cookies are used].

We apply appropriate technical and organisational measures to protect personal data, including HTTPS/TLS in transit, encrypted database storage, row-level access controls, hashed passwords, and restricted administrative access. No system can be guaranteed 100% secure; you are responsible for keeping your account credentials confidential.

We may update this Privacy Policy from time to time. Material changes will be notified via the Site and, where appropriate, by email. The "Last updated" date at the top reflects the most recent revision.