Draft for checking. Nurielle Cosmetics needs to check this page before the shop opens and fill in the words in [square brackets]. It is a starting point, not legal advice.
Who we are
Nurielle Cosmetics is run by [to fill in: legal name], [to fill in: postal address]. We decide how the personal information collected on this website is used, which makes us its “controller” under UK data protection law. [to fill in: ICO registration number, once registered.]
If you have a question about your information, email hello@nuriellecosmetics.com.
When you place an order
We collect your name, email address, phone number, billing and delivery addresses, what you buy, what you paid, any discount code and any note you add. We use them to take payment, pack and post your order, send you emails about it and handle returns. We need them to carry out our contract with you, and the law requires us to keep sales records for tax.
Card payments are handled by our payment provider. We never see or keep your full card details.
Your account
If you create an account, we keep your name, email address, password (stored scrambled, so no one can read it), addresses, orders, wishlist and the display name shown on any review you write. You can change your details at any time in My account, under Account details and Addresses. To delete your account, email hello@nuriellecosmetics.com. We’ll delete it, and keep only the order records the law asks us to keep.
If you save products to a wishlist without an account, we keep that list for 30 days, linked to a cookie in your browser.
The Nurielle letter
If you sign up to our newsletter, we keep your email address, when and where on the website you signed up, and when you confirmed (with the internet address your device used each time), so we can show you asked to join. We only send the letter after you click the link in our confirmation email. Your welcome email includes a personal discount code linked to your email address.
We see whether our emails are opened and which links are clicked, so we know what’s useful. We send the letter because you agreed to it. You can unsubscribe with the link in any email, and we stop straight away.
Messages and trade applications
When you use our contact form, we receive your name, email address, topic, order number (if you give one) and message by email. When you apply for a trade account, we receive your name, business name, email address, phone number, website or Instagram, postcode, type of business, what you’re interested in and anything you tell us. Neither form is stored on the website. We use them to answer you, and we keep the emails for [to fill in: for example two years] unless they relate to an order.
If we approve a trade account, your account is marked as a trade account and your orders as trade orders.
Cookies and your cookie choices
We use cookies to keep the shop working and, only if you agree, to see how people find us. Our Cookie policy lists them all.
When you make a cookie choice, we keep a record of it: your choice, the date and time, your browser, your country and your internet address with its last part removed. To work out your country, our cookie tool, CookieAdmin (made by Softaculous), looks up your full internet address on its own server. We keep this record to show what you chose, which the law requires.
If you accept analytics cookies, WooCommerce records how you reached the shop (for example a search engine or a newsletter link) and what kind of device you used, and saves it with any order you place.
Who we share it with
We never sell your information. We share only what each of these services needs to do its job for us:
- Our payment provider, to take card payments.
- Royal Mail, your name and delivery address (and your email address or phone number for delivery updates), to deliver your parcel.
- Brevo (Sendinblue SAS, France), which sends our order emails and the Nurielle letter.
- Our website host, [to fill in: company name and country], which stores the website and its data.
- Google Fonts: our pages load their fonts from Google, which sees your internet address and browser when a page loads.
- Softaculous, for the country lookup described above.
- Our accountant or other advisers, and the authorities where the law requires it.
Information outside the UK
Some of these services handle information outside the UK: Brevo in the European Union, and Google also in the United States. Where that happens, the information is protected by UK adequacy rules (which cover the EU and, for signed-up companies, the United States) or by contract terms approved in the UK.
How long we keep it
- Orders and payment records: six years after the end of the tax year they fall in, as HMRC requires.
- Your account: until you ask us to delete it.
- The Nurielle letter: until you unsubscribe.
- A bag you haven’t checked out: 2 days. A wishlist without an account: 30 days.
- Messages and trade applications: as above.
- Your cookie choice: the choice lasts 6 months in your browser. [to fill in: how long the record is kept.]
Your rights
You can ask us for a copy of the information we hold about you, to correct it, to delete it, to limit how we use it, to stop using it, or to send it to you or another company in a common format. Where we rely on your agreement (the Nurielle letter and analytics cookies), you can withdraw it at any time. Email hello@nuriellecosmetics.com and we’ll reply within one month.
If you’re unhappy with how we’ve handled your information, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Changes to this policy
If we change how we use your information, we’ll update this page and the date at the top.