Privacy Policy for Nocturnal Bags
1. Who we are (Data Controller)
Business Name: Nocturnal Bags
Contact Email: support@nocturnalbags.co.uk
We are the data controller for your personal information for our Shopify‑based UK e‑commerce store.
For privacy‑related enquiries please email the above address.
2. What personal data we collect
Data you provide us:
‑ Full name, billing / delivery address, contact telephone number, email address
‑ Order details
‑ Marketing‑preference selections
‑ Any messages you send via our contact form
Automatically collected data:
‑ IP address, device / browser details, website‑visit behaviour via cookies & analytics
‑ Payment details are processed by our payment provider; we do NOT store full card details on our store
3. How & why we use your data + our legal basis (UK GDPR)
Process, pack & ship your handbag order (including sharing with Royal Mail), Answer your customer‑service enquiries, Legitimate interest to respond to your request, Send marketing emails / SMS (only if you have opted‑in), Prevent fraud & keep our website secure, Comply with UK tax & accounting record‑keeping & Legal obligations
4. Who we share your personal data with
We only share data with trusted third parties required to run our shop:
‑ Shopify (our website platform)
‑ Payment processor [Shopify Payments / PayPal etc]
‑ Royal Mail (delivery for your order)
‑ Analytics / advertising providers (Google Analytics / Meta Pixel)
‑ Our accountant for tax records
All third‑party processors follow their own privacy policies; data transfers outside the UK use approved safeguards such as Standard Contractual Clauses.
5. Cookies (PECR)
Our site uses:
Strictly‑necessary cookies (shopping cart, checkout – always active)
Non‑essential cookies (analytics / advertising – only active once you give consent via our cookie banner)
You can manage / withdraw your cookie consent at any time via our cookie settings.
6. How long we keep your data
‑ Completed‑order records: 7 years (UK tax requirement)
‑ Marketing‑contact data: Until you unsubscribe / withdraw consent
‑ Analytics data: 24 months
7. Your UK GDPR Data Subject Rights
You have the right to:
1. Request a copy of your personal data (Subject Access Request)
2. Correct inaccurate personal details
3. Request erasure (“right to be forgotten”) where applicable
4. Restrict processing of your data
5. Data portability
6. Object to marketing / legitimate‑interest processing
7. Withdraw any previously‑given consent at any time (does not affect prior‑lawful processing)
To exercise any right email support@nocturnalbags.co.uk. We will respond within the statutory timescales.
You also hold the right to lodge a complaint directly with the UK Information Commissioner’s Office (ICO) if you are unhappy with how we handle your data.
8. Security
We use standard industry security measures to protect your personal data; however no online transmission method can be guaranteed 100 % secure.
9. Changes to this policy
We may update this privacy policy; the latest version will always be published on our Shopify footer privacy‑policy page with an effective date.
10. Contact
All privacy enquiries: support@nocturnalbags.co.uk
Effective Date: 11th November 2026