Legal

Privacy policy

Last updated: [Client to supply: date of last review]

This policy explains what personal data we collect when you use this website, why we collect it, and the rights you have under UK GDPR and the Data Protection Act 2018.

1. Data controller

The data controller is [Company legal name] (company number [Company number]), [Registered address]. For anything related to your data, email support@nandar.co.uk.

[Client to supply: ICO registration number and, if appointed, the data protection officer's contact details]

2. What we collect

Identity and contact details: name, email address, delivery address.
Order details: products ordered, payment reference, payment confirmation from our card processor. We never see or store your full card number.
Account data: points balance, credit balance, referral code, order history.
Consent records: age confirmation, research-use confirmation, marketing preferences, cookie choices.
Technical data: IP address (hashed where stored for analytics), browser type, device, pages viewed.
Communications: emails you send us and our replies.

3. Why we use it and our lawful basis

To process and deliver your order and to send order emails: performance of a contract.
To verify age and research-use eligibility and to prevent fraud: legal obligation and legitimate interests.
To run your account, points and referral programme: performance of a contract.
To send marketing emails: your consent, which you can withdraw at any time.
To remember an abandoned basket and email you about it: your consent given when you enter your email.
To measure and improve the website: your cookie consent, or legitimate interests for essential cookies.

4. Who we share it with

We share only what is needed with service providers acting on our instructions: our hosting and database provider, our transactional email provider, our delivery carrier, and our bank. We do not sell personal data.

[Client to supply: list named processors (hosting, email provider, carrier, analytics) and whether any are outside the UK with the safeguard relied upon]

5. Cookies and analytics

Essential cookies keep your basket and account session working. Analytics and marketing cookies are set only if you accept them in the cookie banner, and you can change your choice at any time.

[Client to supply: list the specific cookies set, their purpose and duration]

6. How long we keep it

Order and payment records: 6 years after the order, to meet accounting and tax obligations.
Account data: while the account is active and for a reasonable period afterwards.
Consent records: for as long as the consent is relied upon, plus a record of withdrawal.
Abandoned basket data: deleted or anonymised after a short period if no order follows.

[Client to supply: confirm retention periods]

7. Your rights

You can ask us to access, correct, delete or restrict the use of your data, object to processing, or ask for a copy in a portable format. Where we rely on consent you can withdraw it at any time. To exercise any right, email support@nandar.co.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

8. Marketing emails

We only send marketing emails if you have opted in. Every marketing email includes an unsubscribe link, and you can also opt out on our unsubscribe page.

9. Security

Data is transmitted over encrypted connections and stored with access limited to staff who need it. Account access is by single-use email links rather than passwords.

10. Changes

We will post any changes to this policy on this page and update the date at the top.