This policy is a draft translation and must be reviewed for UK law before publication.
Last updated: [DATE OF LAST UPDATE]
This privacy policy describes how we collect, use and share your personal data when you visit or use our services, make a purchase from Nora-Mae, or otherwise communicate with us. In this privacy policy, "you" and "your" refer to the user of the services, whether that is a customer, a website visitor, or any other person whose information we have collected in accordance with this notice.
Please read this privacy policy carefully. By using and accessing our services, you agree to the collection, use and sharing of your data as described here. If you do not agree with this privacy policy, please do not use or access our services.
We may update this privacy policy from time to time to reflect new practices, legal requirements, or other operational or regulatory reasons. The updated privacy policy will be published on the website, as shown by the "Last updated" date, and we will take any other steps required under applicable law.
To provide our services, we collect your personal data from a variety of sources, as described below. The information collected and used varies depending on how you interact with us.
In addition to the specific purposes set out below, we may use the information collected to communicate with you, improve our services, meet our legal obligations, enforce the terms of use of our services, and protect our services, our rights, our users and others.
The types of personal data we collect about you depend on how you use our website and services. When we refer to personal data, we mean information that identifies you, describes you, or can in any way be associated with you. Below are the categories and specific types of personal data we collect.
The information you provide through our services may include:
Certain features of the services require you to provide specific information. If you choose not to share that information, you may not be able to use or access those features.
We may also automatically collect information about how you interact with our services ("Usage Data"). For this purpose we may use cookies, pixels and similar technologies ("cookies"). Usage Data may include information about how you access and use our website and your account, including data about your device, browser, network connection, IP address and other information about your interaction with our services.
Finally, we may also receive information about you from third parties, including suppliers and service providers who may collect data on our behalf, such as:
When you visit our website, open or click our emails, or interact with our services or advertising, we or third parties we work with may automatically collect information using online tracking technologies such as pixels, web beacons, SDKs, third-party libraries and cookies.
All information received from third parties will be processed in accordance with this privacy policy. See also the "Third-party websites and links" section below.
Providing products and services: We use your personal data to provide our services and perform our contract with you, including to process your payments, distribute your orders, send you messages about your account, purchases, returns, exchanges or other transactions, create, maintain and manage your account, arrange shipping, facilitate returns and exchanges, and other account-related functions. We may also improve your shopping experience by allowing Shopify to link your account to other Shopify services you choose to use. In that case, Shopify will process user data in accordance with its own privacy policy and consumer protection policy.
Marketing and advertising: We may use your personal data for marketing and advertising purposes, for example to send you marketing, advertising and campaign notifications by email, SMS or post, and to display advertising relating to products or services. This may also involve using your personal data to personalise the services and advertising on our website and on other websites. Where you are in the United Kingdom, the legal basis for this processing is our legitimate interest in selling our products, under Article 6(1)(f) of the UK GDPR, and, where required, your consent under the Privacy and Electronic Communications Regulations 2003 (PECR).
Security and fraud prevention: We use your personal data to identify, investigate and take countermeasures against fraudulent, illegal or harmful activity. If you choose to use the services and create an account, you are responsible for keeping your login credentials secure. We strongly recommend that you do not share your username, password or any other login credentials with anyone else. If you believe your account has been compromised, please contact us immediately. Where you are in the United Kingdom, the legal basis for this processing is our legitimate interest in keeping our website secure for you and for other customers, under Article 6(1)(f) of the UK GDPR.
Communicating with you and improving our service: We use your personal data to provide you with support and to improve our services. This is a legitimate interest that allows us to meet your needs, offer effective services and maintain our business relationship with you, under Article 6(1)(f) of the UK GDPR.
Like many others, we also use cookies on our website. For more information about the cookies we use to run our shop through Shopify, see https://www.shopify.com/legal/cookies. We use cookies to operate and improve our website and services (including to record information about your activities and preferences), and to carry out analytics and better understand how users interact with the services (which is our legitimate interest in operating, improving and optimising the services). We may also allow third parties and service providers to use cookies on our website in order to better tailor services, products and advertising on our website and on other websites.
Under the Privacy and Electronic Communications Regulations 2003, we will only place non-essential cookies on your device with your consent, which you can withdraw at any time. Most web browsers are set to accept cookies automatically by default, but you can change your browser settings to delete or refuse cookies. Please note that your experience may be adversely affected if you delete or block cookies; in addition, some services, such as certain features and general functionality, may no longer work in whole or in part. Blocking cookies may also not completely prevent information from being shared with third parties, such as our advertising partners.
In certain circumstances we may transfer your personal data to third parties in order to perform contracts, for legitimate purposes and for other reasons covered by this privacy policy. Examples of such circumstances include:
We share the following categories of personal data for the purposes described above under "How we collect and use personal data" and "How we share your personal data":
| Category | Categories of recipients |
|---|---|
| Identifiers such as basic contact details and certain order and account data | Suppliers and third parties who perform services on our behalf (for example internet service providers, payment providers, distribution partners, customer service partners and data analytics providers) |
| Commercial information, such as order, purchase and customer service data | Business and marketing partners |
| Internet or other similar network activity, such as usage data | Affiliates |
| Geolocation data, such as location determined via IP address or other technical methods | Suppliers and affiliates |
We do not use or share special category personal data without your consent, nor to draw inferences about you.
With your consent, we share personal data in order to carry out the advertising and marketing activities described above.
Our website may contain links to websites or other online platforms owned and operated by third parties. If you follow links to websites that are not owned by our affiliates or controlled by us, you should review their privacy and security policies as well as their other terms and conditions. We do not guarantee and are not responsible for the privacy or security of those websites, nor for the accuracy, completeness or reliability of the information found there. Information that the user provides in wholly or partly public places, including information shared on third-party social media platforms, may also be viewed by other users of the services and/or by users of those third-party platforms, without any restriction on how it may be used by us or by third parties. Our inclusion of such links does not mean that we endorse the content of those platforms, or their owners or operators, unless expressly stated in the services.
Our services are not intended for use by children, and we do not knowingly collect personal data about children. If a child in your care has provided us with their personal data, you can contact us using the contact details below to request its deletion.
As at the effective date of this privacy policy, we are not aware of having "shared" or "sold" (as defined by applicable law) personal data relating to persons under the age of 16.
Please note that no security measure is perfect or impossible to circumvent, and we cannot guarantee perfect security. Information that you transmit to us may not be protected during transmission. We recommend that you do not use insecure methods to send us sensitive or confidential information.
How long we retain personal data depends on a number of factors, such as the need to manage the user account, provide the services, comply with legal obligations, resolve disputes, or enforce other applicable contracts and policies.
Depending on where you live, you may have all or some of the rights listed below in respect of your personal data. These rights are not absolute, however, and may only apply in specific circumstances, with the law permitting us to refuse your request.
You can exercise these rights as indicated on our website or by contacting us using the contact details below.
Exercising your rights has no effect on your standing with us. We may need information from the user to confirm their identity, such as an email address or account information, before providing a substantive response to the request. In accordance with applicable law, the user may appoint a representative to make requests on their behalf in order to exercise their rights. Before accepting such a request from a representative, the representative must demonstrate that they are authorised to act on behalf of the user, and the representative may also be required to confirm their identity with us. We will respond to the user's request within the statutory time limits.
If you have a complaint about how we handle your personal data, please contact us using the contact details below. If you are not satisfied with how we have handled your complaint, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK data protection authority, at https://ico.org.uk. If you are located in the European Economic Area, you may instead lodge a complaint with your local supervisory authority.
Please note that we may transfer, store and process your personal data outside the country in which you live. Your personal data may also be processed by employees and external service providers (third parties) as well as by partners located in those countries.
If we transfer your personal data outside the United Kingdom, we will use recognised transfer mechanisms, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, unless the transfer is made to a country covered by UK adequacy regulations.
If you have questions about our privacy practices or this privacy policy, or if you would like to exercise any of your rights, please contact us by email:
Email: support@nora-mae.co.uk
Data controller: [REGISTERED COMPANY NAME]
Registered address: [REGISTERED COMPANY ADDRESS]
Company registration number: [COMPANY REGISTRATION NUMBER]
ICO registration number (if applicable): [ICO REGISTRATION NUMBER]
In accordance with applicable privacy law, and unless expressly stated otherwise, we are the controller of your personal data.
Every order is carefully handled by Royal Mail and dispatched as quickly as possible.
All payments are SSL-secured, so you can safely use your preferred payment method.
Not happy with your order? We offer a flexible 100-day return or exchange policy.
