Privacy policy

Nisaiyyah Privacy Policy (UK GDPR & PECR Compliant)

Last Updated: 17 December 2025

Nisaiyyah (“we”, “us”, “our”) operates this store and website to provide you with a curated shopping experience (the “Services”). This Privacy Policy explains how we collect, use, share, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations (PECR).

By using our Services, you agree to the practices described in this Privacy Policy.

1. Data Controller

Data Controller: Nisaiyyah
Address: 128 City Road, London, EC1V 2NX, United Kingdom
Email: nisaiyyah@outlook.com

2. Personal Information We Collect

We may collect and process the following categories of personal data:

  • Contact details: Name, billing and shipping address, email address, phone number

  • Financial information: Payment card details, bank account information, transaction history (processed securely by payment providers)

  • Account information: Username, password (hashed), preferences, settings

  • Transaction information: Items viewed, purchased, returned, or added to cart or wishlist

  • Communications: Emails, messages, or correspondence with customer support

  • Device and usage data: IP address, browser type, device information, pages visited, and interactions

  • Personalisation and profiling: To provide tailored content or product recommendations

We do not carry out automated decision-making that produces legal or similarly significant effects.

Providing certain personal data (such as contact and payment details) is necessary to enter into a contract with us. If you do not provide this information, we may be unable to provide the Services or fulfil your orders.

Anonymous or anonymised data is not considered personal data.

3. How We Collect Your Data

We collect personal data:

  • Directly from you when you create an account, place an order, contact us, or subscribe to marketing

  • Automatically through cookies, analytics tools, and similar technologies

  • From third parties, such as:

    • Shopify (website hosting)

    • Etsy (if you interact with us via Etsy)

    • Payment providers

    • Shipping and delivery partners

Third-party websites or embedded content may collect data independently. Please review their privacy policies.

4. Lawful Bases for Processing

We process personal data under the following lawful bases:

  • Performance of a contract – to process orders, deliver products, and manage accounts

  • Legal obligation – for tax, accounting, and regulatory compliance

  • Legitimate interests – fraud prevention, security, service improvement, and limited direct marketing (balanced against your rights)

  • Consent – for marketing communications and non-essential cookies

5. How We Use Your Information

We use your personal data to:

  • Provide and manage our Services

  • Process orders, payments, shipping, and returns

  • Communicate with you regarding orders or support requests

  • Improve website functionality and user experience

  • Send marketing communications (where consent has been given or where permitted by law)

  • Detect and prevent fraud or misuse

  • Comply with legal obligations

6. Sharing Your Data

We may share your personal data with trusted third parties, including:

  • Shopify (website hosting and data processor)

  • Etsy (if purchases or interactions occur via Etsy)

  • Payment processors (for secure payment handling)

  • Shipping and courier services (e.g., Royal Mail, DHL, UPS)

  • Third-party apps or plugins necessary for store functionality

  • Legal or regulatory authorities where required

All processors are contractually required to comply with UK GDPR and to protect your data.

7. International Transfers

Your personal data may be transferred outside the UK or EEA. Where this occurs, we rely on appropriate safeguards, including:

  • Standard Contractual Clauses (SCCs) together with the UK Addendum or the International Data Transfer Agreement (IDTA), as applicable

These measures ensure your data receives a level of protection equivalent to UK GDPR standards.

8. Cookies and Tracking Technologies (PECR)

We use cookies and similar technologies to operate and improve our website.

Types of Cookies Used

  • Essential cookies: Required for website functionality (always active)

  • Analytics cookies: Help us understand site usage

  • Preference cookies: Remember your settings

  • Marketing cookies: Used to deliver personalised advertising

Your Choices

When you first visit our website, you will see a cookie banner allowing you to:

  • Accept all cookies

  • Reject non-essential cookies

  • Manage preferences by category

You can withdraw or change consent at any time via the cookie banner or your browser settings.

Marketing cookies are only set after consent is given.

9. Data Retention

We retain personal data only as long as necessary:

  • Order and financial records: 6 years (tax and accounting requirements)

  • Account data: Until account deletion, plus up to 1 year for records

  • Marketing data: Until consent is withdrawn or you object

Data is securely deleted or anonymised once retention periods expire.

10. Your Rights Under UK GDPR

You have the right to:

  • Access your personal data

  • Rectify inaccurate data

  • Request erasure of your data

  • Restrict or object to processing

  • Data portability

  • Withdraw consent at any time

  • Object to direct marketing, including legitimate-interest marketing

To exercise your rights, contact us at nisaiyyah@outlook.com. We may need to verify your identity.

11. Children’s Data

Our Services are not intended for children under 16. We do not knowingly collect personal data from children. If you believe we have collected such data, please contact us to request deletion.

12. Security

We implement appropriate technical and organisational measures to protect personal data. However, no system is completely secure, and data transmission is at your own risk.

13. Marketing Communications

We send marketing communications only where:

  • You have provided consent, or

  • It is permitted under legitimate interests and you have not objected

You can opt out at any time by:

  • Clicking the “unsubscribe” link in emails or SMS

  • Contacting us directly

If you object to marketing, we will stop processing your data for this purpose immediately.

14. Complaints

If you have concerns about how we handle your data:

You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)
Website: https://ico.org.uk

15. Updates to This Policy

We may update this Privacy Policy to reflect legal or operational changes. The updated version will be posted on this page with a revised “Last Updated” date.