Privacy Policy

Last updated: [OPERATOR: date]. This is how we collect, use and protect your personal data under the UK GDPR and the Data Protection Act 2018.

1. Who we are

NOCTA is the trading name of [OPERATOR: registered company name], a company registered in England and Wales, company number [OPERATOR], registered office [OPERATOR: address]. We are the data controller of your personal data. You can reach us at hello@nocta.co.uk.

2. What we collect

When you order

• Name, delivery address, billing address
• Email address and phone number (for delivery updates)
• Order details and payment confirmation (we do not store card numbers; these are handled by our payment provider)

When you contact us or subscribe

• Your name, email and the content of your message
• Marketing preferences if you opt in to emails

When you use the site

• Device, browser and general location (from IP)
• Pages viewed and actions taken, via cookies and analytics

3. Why we use it (lawful basis)

• Contract: to process orders, ship, and handle returns
• Legal obligation: to keep tax and accounting records
• Legitimate interests: to run and improve the site, prevent fraud, and answer your questions
• Consent: for marketing emails and non-essential cookies (you can withdraw any time)

4. Who we share it with

We only share what's needed to run the shop, with providers who act on our behalf:

• Payment processing (e.g. Stripe, Shopify Payments, PayPal)
• Ecommerce platform and cart (Shopify or equivalent)
• Shipping carrier and 3PL warehouse
• Email service (e.g. Klaviyo)
• Reviews platform (e.g. Loox or Judge.me)
• Analytics and ads (e.g. Google Analytics, Meta Pixel), only where you've consented
• Regulators, courts or law enforcement where legally required

We do not sell your personal data.

5. International transfers

Some providers process data outside the UK. Where they do, we rely on UK GDPR-approved safeguards such as the UK IDTA, UK Addendum to the EU SCCs, or adequacy decisions.

6. How long we keep it

• Order records: 7 years, for tax and accounting
• Marketing lists: until you unsubscribe
• Support emails: up to 3 years
• Website analytics: up to 26 months

7. Your rights

Under UK GDPR you can ask us to:

• Access a copy of your data
• Correct anything wrong
• Delete your data (where we're not legally required to keep it)
• Restrict or object to processing
• Move your data to another provider
• Withdraw consent for marketing at any time (use the unsubscribe link or email us)

Email hello@nocta.co.uk to exercise any of these. You also have the right to complain to the ICO at ico.org.uk.

8. Cookies

We use essential cookies to make the site work (cart, checkout, security). With your consent, we use analytics and marketing cookies to understand traffic and measure ads. You can change your choice at any time via the cookie banner.

9. Security

We use HTTPS, reputable providers, and access controls. No system is 100% secure, but we take it seriously and report breaches to the ICO where required.

10. Changes to this policy

We may update this page. Material changes will be flagged on the site or emailed to you if we hold your address.