Privacy policy

Privacy Policy

Effective Date: 28 May 2026

This Privacy Policy explains how Belvicon Ltd, trading as TwoRelax ("we", "us", or "our"), collects, uses, and protects your personal data when you visit our website www.tworelax.com, contact us, or make a purchase.

We respect your privacy and process your personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Cypriot Law 125(I)/2018 on the Protection of Natural Persons with regard to the Processing of Personal Data. Where customers reside in Germany or Austria, the relevant national data-protection laws of those countries (BDSG and DSG respectively) also apply to the extent required by GDPR Article 6.


1. Data Controller

Belvicon Ltd (trading as TwoRelax)
Spyrou Kyprianou 78, Magnum Business Center, 3rd Floor
3076 Limassol, Cyprus
Cyprus Company Number: HE 492478
Email: [email protected]
Phone: +43 660 588 1567


2. Data We Collect

We collect and process personal data only as necessary for business purposes:

(a) When you visit our website:

  • IP address, browser type, operating system, date and time of access, pages visited.

(b) When you make a purchase:

  • Full name, billing and shipping address, email, phone number, payment details (processed securely via our payment provider).

(c) When you subscribe to our newsletter:

  • Email address and consent confirmation.

(d) When you contact us:

  • Name, email, and any information you include in your message.


3. Purpose and Legal Basis of Processing

We process your data based on the following legal bases under Article 6 GDPR:

Purpose Legal Basis Example
Fulfilling orders and delivering products Art. 6(1)(b) GDPR – Contract performance Processing and shipping your order
Customer support and communication Art. 6(1)(b) GDPR – Contract performance Responding to enquiries
Newsletter and marketing emails Art. 6(1)(a) GDPR – Consent Sending product news and offers
Website analytics (Google Analytics) Art. 6(1)(a) GDPR – Consent Analysing website traffic
Legal obligations (tax, accounting) Art. 6(1)(c) GDPR – Legal requirement Invoicing and record-keeping

You can withdraw consent at any time by contacting us at [email protected].


4. Data Retention

We retain personal data only as long as necessary:

  • Order and billing data: 7 years (tax-law requirement).
  • Customer communications: up to 2 years after resolution.
  • Newsletter data: until consent is withdrawn.
  • Analytics data: 14 months (Google Analytics default).


5. Data Sharing and Processing Partners

We share personal data only with trusted EU-based or GDPR-compliant service providers as necessary for our operations:

  • Website & hosting: Shopify International Ltd. (Ireland) & Shopify Inc. (Canada)
  • Payment processing: PayPal, Stripe, Shopify Payments, Klarna, EPS
  • Analytics: Google Analytics (see Cookie Policy)
  • Email newsletters: Shopify Email or equivalent GDPR-compliant provider
  • Freight forwarding and delivery services: third-party logistics providers for order fulfilment
  • Manufacturer integration: Wellis Magyarország Zrt. (Hungary) - order forwarding, warranty administration; data shared is limited to delivery address and product configuration

All partners are bound by Data Processing Agreements (DPAs) ensuring GDPR compliance.


6. International Data Transfers

If our service providers process data outside the EU/EEA (e.g. Shopify Inc. in Canada, Google in the United States), they do so under EU Standard Contractual Clauses (SCCs) or other approved transfer safeguards in accordance with Chapter V of the GDPR.


7. Cookies and Tracking

We use cookies to ensure website functionality and improve user experience.

Analytics cookies (Google Analytics) are only activated after you consent through our cookie banner (provided by Cookiebot.com).

You can change your cookie preferences at any time using the banner or your browser settings.


8. Newsletter

You can subscribe to our newsletter to receive updates, promotions, and product information.

  • You can unsubscribe at any time using the "unsubscribe" link in each email.

We never share newsletter email addresses with third parties.


9. SSL Encryption

Our website uses SSL encryption (HTTPS) for secure communication and data transfer. All personal data entered on the site is transmitted in encrypted form.


10. Your Rights Under GDPR

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure ("right to be forgotten") (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent at any time (Art. 7(3) GDPR)

To exercise your rights, contact us at [email protected].

You also have the right to lodge a complaint with the lead data-protection authority for our company:

Office of the Commissioner for Personal Data Protection (Cyprus)
1 Iasonos Street, 1082 Nicosia, Cyprus
Email: [email protected]
Website: https://www.dataprotection.gov.cy

If you reside in Germany or Austria, you may alternatively lodge a complaint with your local data-protection authority:

Germany: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) - www.bfdi.bund.de
Austria: Datenschutzbehörde (DSB), Barichgasse 40–42, 1030 Vienna - www.dsb.gv.at


11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal or operational changes. The current version will always be available on our website.