Privacy Notice

N&N Clothing Ltd is the controller of your personal data for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered in England & Wales (company number 12345678) at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.

For anything relating to your personal data, email privacy@nnclothing.co.uk or write to Data Protection, N&N Clothing Ltd, at the address above.

We collect only what we need to run the shop:

• Account data — name, email address, password (stored hashed), phone number and saved addresses.
• Order data — items purchased, delivery address, order history and customer service correspondence. Payment card details go directly to our payment processor; we never see or store them.
• Marketing data — your newsletter subscription status and the consent you gave (including when and where you signed up).
• Analytics data — with your consent only, pages visited, searches and device information, collected via cookies described in our cookie policy.
• Reviews and wishlist — product reviews you write and items you save, linked to your account.

We do not use automated decision-making that produces legal or similarly significant effects, and we never sell your personal data.

We share data only with service providers who process it on our instructions under written contracts:

• Stripe — secure card payment processing.
• Resend — sending transactional and (with consent) marketing emails.
• MeiliSearch — powers site search. It is self-hosted on our own infrastructure; search queries are not shared with any third party.
• Hosting and infrastructure providers — who store our databases and run this website.
• Delivery carriers — your name, address and contact details, so they can deliver your order.

We may also disclose data where required by law, or to professional advisers and authorities in connection with legal claims, fraud prevention or a business sale.

We store your data in the UK wherever possible. Some of our processors (for example Stripe and Resend) are based in, or use infrastructure in, the United States. Where data leaves the UK we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement / Addendum, so that your data receives an equivalent standard of protection.

• Order records — 6 years after the transaction, to meet tax, accounting and legal claim requirements.
• Account data — for as long as your account is active; deleted or anonymised within 30 days of a deletion request (order records are retained as above).
• Marketing data — until you unsubscribe, plus a suppression record so we don't email you again.
• Analytics data — up to 26 months, in aggregated form.
• Customer service correspondence — 2 years after the query is resolved.

Under UK GDPR you have the right to:

• access — a copy of the personal data we hold about you;
• rectification — correction of inaccurate or incomplete data;
• erasure — deletion of your data where we no longer need it;
• restriction — limiting how we use your data in certain circumstances;
• portability — your data in a structured, machine-readable format;
• object — to processing based on legitimate interests, and to direct marketing at any time; and
• withdraw consent — at any time, without affecting processing already carried out.

To exercise any of these rights email privacy@nnclothing.co.uk. We respond within one month and will never charge for a reasonable request.

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the UK supervisory authority: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk or 0303 123 1113.

We review this notice regularly and will post any changes on this page, updating the “last updated” date above. If a change significantly affects how we use your data, we will tell you directly where we reasonably can.