Privacy Policy

1. Information We Collect

1.1 Personal Data You Provide Voluntarily

• Order and Payment Information: Name, shipping address, billing address, email address, phone number, payment card details (processed by third-party payment providers, not stored by us), and order preferences when you purchase our unbleached bamboo and recycled paper products.
• Account Information: If you create an account, your chosen username, password, and contact details (to manage your orders and preferences).
• Communication Data: Messages, inquiries, or feedback you send to us via our contact forms, email, or other communication channels.

1.2 Automatically Collected Personal Data

• IP address
• Browser type and version
• Device type, operating system, and screen resolution
• Pages you visit on the Site and the time/date of your visit
• Referral source (how you found our Site)

2. Purposes of Processing Your Personal Data

1. Performance of a contract (Article 6(1)(b)): To process and fulfill your product orders, arrange shipping and delivery, process payments, and provide order confirmations and updates.
2. Legitimate interests (Article 6(1)(f)): To maintain the security and functionality of our Site (e.g., detecting fraud or technical issues), improve our products and Services, and respond to your inquiries or feedback. Our legitimate interests do not override your fundamental rights and freedoms.
3. Your explicit consent (Article 6(1)(a)): If you opt-in to receive marketing communications (e.g., newsletters, product updates, promotions), we will process your contact details to send these communications. You may withdraw your consent at any time (see Section 7).
4. Compliance with legal obligations (Article 6(1)(c)): To retain transaction records for tax, accounting, and regulatory purposes as required by UK law.

3. Sharing of Your Personal Data

• Payment Service Providers: To process credit/debit card payments and ensure secure financial transactions (e.g., PayPal, Stripe). These providers do not store your payment details on our behalf.
• Logistics and Shipping Partners: To deliver your orders to the provided shipping address (e.g., Royal Mail, DPD).
• IT and Hosting Providers: To host our Site and maintain its technical functionality (data is stored on secure UK-based servers).

4. Data Retention

• Order and Transaction Data: Retained for 7 years from the date of your order to comply with UK tax and accounting regulations.
• Account Data: Retained for as long as your account is active, or for 12 months after your last interaction with us (whichever is later), then securely deleted.
• Communication Data: Retained for 6 months after the resolution of your inquiry/feedback, then securely deleted.
• Automatically Collected Technical Data: Retained for 30 days from your last Site visit, then anonymised (so it can no longer identify you).

5. Cross-Border Data Transfers

• We ensure the recipient country provides an adequate level of data protection as determined by the UK Information Commissioner’s Office (ICO); or
• We use UK International Data Transfer Agreements (IDTA) or EU Standard Contractual Clauses (SCC) to impose binding data protection obligations on the third-party recipient.

6. Data Security

• Encryption of data in transit (HTTPS protocol) and data at rest (for stored personal data).
• Strict access controls—only authorised Company staff have access to your personal data, and only for the purposes outlined in this policy.
• Regular security audits and updates to our Site and IT systems to address vulnerabilities.
• Secure data processing by third-party providers (as outlined in Section 3).

Data Breach Notification

1. Notify the UK Information Commissioner’s Office (ICO) within 72 hours of discovering the breach;
2. Notify you without undue delay (via email or post) of the breach, including details of the data involved, the potential impact, and the measures we are taking to address it.

7. Your Data Protection Rights Under UK GDPR

1. Right to Access: Request a copy of the personal data we hold about you and confirmation of how we process it.
2. Right to Rectification: Request correction of any inaccurate or incomplete personal data we hold about you.
3. Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data if it is no longer necessary for the purposes we collected it, you withdraw your consent, or you object to processing (and no legal basis for processing remains).
4. Right to Restriction of Processing: Request that we restrict processing of your personal data (e.g., if you contest the accuracy of the data or the lawfulness of our processing).
5. Right to Data Portability: Request a copy of your personal data in a structured, commonly used, machine-readable format (e.g., CSV, Excel) for transfer to another data controller.
6. Right to Object: Object to the processing of your personal data for the purpose of our legitimate interests (Section 2) or direct marketing.
7. Right to Withdraw Consent: Withdraw your explicit consent to processing (e.g., marketing communications) at any time—this does not affect the lawfulness of processing before your withdrawal.
8. Right to Lodge a Complaint: Lodge a complaint with the UK Information Commissioner’s Office (ICO) if you are dissatisfied with how we process your personal data (ICO contact details: https://ico.org.uk, 0303 123 1113).

8. Marketing Communications

• Clicking the "unsubscribe" link in any marketing email we send you;
• Contacting us directly using the details in Section 9;
• Updating your preferences in your account settings (if you have an account).

9. Contact Us

• Email: support@mail.nicepaper.co.uk

10. Changes to This Privacy Policy