Privacy policy
PRIVACY POLICY
Novanila UK Ltd
Last Updated: August 17, 2026
Effective Date: August 17, 2026
1. INTRODUCTION AND OVERVIEW
Welcome to Novanila. This Privacy Policy explains how Novanila UK Ltd (“we,” “us,” “our,” or “Novanila”) collects, uses, processes, stores, discloses, and otherwise handles your personal information when you visit our website www.novanila.com (the “Website”), make a purchase, use our services, or otherwise interact with us.
Novanila is committed to protecting your privacy and ensuring you have a positive experience on our Website. This Privacy Policy is designed to be clear, transparent, and easy to understand. We comply with all applicable UK and European Union data protection laws, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).
By accessing and using the Website, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with our privacy practices, please do not use our Website or services.
For any questions about this Privacy Policy, please contact us using the details provided in Section 14 (Contact Information).
2. WHO WE ARE AND WHO IS RESPONSIBLE FOR YOUR DATA
Company Name: Novanila UK Ltd
Registered Address: Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom
Email: info@novanila.com
Phone: 07776 604181
Website: www.novanila.com
Data Controller: For the purposes of applicable data protection laws, Novanila UK Ltd is the data controller of your personal information. This means we determine how and why your information is processed.
Data Protection Officer: If you have specific data protection questions, you can contact us at info@novanila.com with the subject line “Data Protection Enquiry.”
3. PERSONAL INFORMATION WE COLLECT
We collect personal information in several ways. Personal information means any information that identifies you or could reasonably be linked to you. We do not collect information that has been anonymised or de-identified.
3.1 Information You Provide to Us Directly Account Registration:
Full name
Email address
Password and security questions Phone number
Date of birth (if provided) Delivery and billing addresses
Purchase and Transaction Information:
Products you browse, view, add to cart, or purchase Items you add to your wishlist
Purchase history and transaction details
Order tracking information
Return and exchange requests
Refund details
Payment Information:
Credit card number (processed securely through Shopify - we do not store full card
details)
Debit card number (processed securely through Shopify - we do not store full card details)
Bank account information (if applicable)
PayPal account information (if you choose this payment method) Billing address
Payment confirmation details
Communications with Us:
Messages sent through our contact form Customer support inquiries
Email correspondence
Chat messages
Social media messages Feedback and complaints Product reviews and ratings Comments and testimonials
Marketing and Newsletter Information:
Email address for newsletter signup Marketing communication preferences Product interests and preferences Event registration information
Survey and Feedback:
Responses to customer surveys
Feedback about your shopping experience Product recommendations
Satisfaction ratings
Social Media and Third-Party Authentication:
If you connect your social media account (Facebook, Instagram, etc.) to our Website, we receive basic profile information
Username and profile picture
Email address associated with the account
3.2 Information We Collect Automatically Device Information:
IP address
Browser type and version
Operating system
Device type (mobile, desktop, tablet) Device identifier
Mobile advertising ID
Device language and settings
Website Usage Information:
Pages you visit and in what order Time spent on each page
Links you click
Products you view
Items added to cart
Search queries you perform
Referral source (how you found our Website) Exit pages
Clickstream data
Navigation patterns
Cookies and Similar Technologies:
Session ID
Tracking IDs
Unique identifiers Preference settings Authentication tokens
Location Information:
Approximate location based on IP address Country and city level location
NOT precise GPS location tracking
Communication Metadata:
Email open rates
Click tracking in emails Delivery status
Device used to open email
3.3 Information from Third Parties From Our Service Providers:
Transaction information from payment processors Shipping and tracking information from delivery partners Analytics data from Google Analytics and similar tools Customer support data from support platforms
Email service provider data (Mailchimp, etc.)
From Our Business Partners:
Information shared through business partnerships Co-marketing partner information
Affiliate tracking information
From Shopify:
Transaction records
Account information Website analytics Fraud prevention data
From Advertising and Analytics Partners:
Website visitor information Advertising interaction data Conversion data
Audience insights
From Social Media Platforms:
If you interact with our social media content Pixel data from Facebook, TikTok, Instagram Advertising platform information
From Public Sources:
Publicly available business information
Public social media profiles (if you’re a public figure or influencer)
4. LEGAL BASIS FOR PROCESSING YOUR PERSONAL INFORMATION
Under UK GDPR and EU GDPR, we can only process your personal information if we have a valid legal basis. We process your information based on the following legal bases:
4.1 Contractual Necessity (Article 6(1)(b))
We process your personal information when it is necessary to: Create and maintain your account
Process your order and payment
Fulfill your purchase
Arrange and deliver your order
Process returns, exchanges, and refunds Provide customer service related to your order Send order confirmations and delivery updates
Without this information, we cannot provide our services to you. 4.2 Your Consent (Article 6(1)(a))
We process your personal information with your explicit consent when we: Send marketing emails and newsletters
Collect optional survey responses
Use certain cookies and tracking technologies
Collect information through forms (non-essential fields)
Share information with partners (with your permission)
You can withdraw consent at any time by unsubscribing or contacting us. 4.3 Legal Obligation (Article 6(1)(c))
We process your personal information when required by law: UK tax law (we retain transaction records for 6 years) Money laundering regulations
Law enforcement requests
Court orders
Data protection authority requests Anti-fraud compliance
Consumer protection laws
4.4 Legitimate Interests (Article 6(1)(f))
We process your personal information for our legitimate business interests when: Improving and optimizing our Website and services
Understanding how customers use our Website
Personalizing your shopping experience
Detecting and preventing fraud
Protecting our business and customers from harm
Enforcing our terms of service
Defending legal claims
Marketing and promotional purposes (where you haven’t opted out) Network and information security
Data analytics and business analysis
Our legitimate interests are always balanced against your rights and privacy. 4.5 Public Interest (Article 6(1)(e))
We process your personal information in the public interest when required by law.
4.6 Vital Interests (Article 9(2)(c))
In emergencies, we may process information to protect someone’s vital interests (health, safety).
5. HOW WE USE YOUR PERSONAL INFORMATION
5.1 Order Processing and Fulfillment
We use your personal information to: Create and maintain your account Process your payment securely Fulfill your order accurately
Ship products to your address
Provide tracking information
Send order confirmation emails Respond to questions about your order Process returns and refunds
Issue invoices and receipts
Maintain purchase history
Legal Basis: Contract Performance (Article 6(1)(b))
5.2 Customer Service and Support
We use your personal information to: Respond to your inquiries promptly Provide customer support
Resolve complaints and disputes Follow up on your experience Handle returns and exchanges Provide technical support
Update you on service issues
Legal Basis: Contract Performance and Legitimate Interest (Articles 6(1)(b) and 6(1)(f))
5.3 Marketing and Promotional Communications
We use your personal information to:
Send you marketing emails about new products
Share information about special offers and sales
Send seasonal collections information (e.g., Onam, Diwali) Notify you about upcoming events or launches
Show you targeted advertisements
Conduct customer surveys
Request product reviews and feedback
Legal Basis: Your Consent (Article 6(1)(a)) - We only send marketing with your permission and PECR compliance
PECR Compliance: Under the Privacy and Electronic Communications Regulations 2003, we have your prior express consent before sending marketing emails and SMS messages.
5.4 Website Improvement and Analytics
We use your personal information to:
Analyze website traffic and usage patterns Understand which products are popular Improve website design and functionality Optimize the user experience
Personalize product recommendations Conduct A/B testing
Fix technical issues
Improve page load times
Legal Basis: Legitimate Interest (Article 6(1)(f)) 5.5 Fraud Prevention and Security
We use your personal information to: Detect fraudulent transactions Prevent unauthorized account access Monitor suspicious activity
Verify identities
Protect against cyber attacks
Comply with anti-money laundering regulations Investigate potential violations
Legal Basis: Legitimate Interest and Legal Obligation (Articles 6(1)(c) and 6(1)(f)) 5.6 Legal Compliance and Enforcement
We use your personal information to:
Comply with UK and EU laws
Maintain business records for 6 years (tax requirements) Respond to legal process (subpoenas, court orders) Respond to law enforcement requests
Enforce our Terms of Service
Protect our legal rights
Establish, exercise, or defend legal claims
Legal Basis: Legal Obligation (Article 6(1)(c))
5.7 Data Analytics and Business Intelligence
We use your personal information to:
Analyze customer behavior and preferences Identify trends and patterns
Segment customers for targeted marketing Measure campaign effectiveness
Forecast sales and inventory
Make business decisions
Improve products and services
Legal Basis: Legitimate Interest (Article 6(1)(f)) 5.8 Communication and Notifications
We use your personal information to:
Send account notifications
Notify you of important changes to our policies Send security alerts
Provide order updates
Respond to your messages
Legal Basis: Contract Performance and Legitimate Interest (Articles 6(1)(b) and 6(1)(f))
6. WHO WE SHARE YOUR PERSONAL INFORMATION WITH
6.1 Service Providers and Data Processors
We share your personal information with carefully selected service providers who assist us in operating our Website and providing services. All service providers are contractually bound by Data Processing Agreements (DPAs) to protect your information according to applicable law.
Payment Processors:
Stripe, PayPal, or other payment gateways
Purpose: Process payments securely
Data shared: Payment details, transaction amount, billing address Legal basis: Contract performance
Security: PCI DSS certified
Shopify (Website Platform):
Shopify Inc., located in Canada
Purpose: Host our Website, manage orders, store data Data shared: All account and transaction information
Acts as: Joint data controller
Security: Enterprise-grade security
Their Privacy Policy: https://www.shopify.com/legal/privacy Their Privacy Portal: https://privacy.shopify.com/en
Email Service Provider:
Mailchimp or equivalent service
Purpose: Send marketing emails, newsletters, transactional emails Data shared: Email address, name, purchase history, preferences Security: Encrypted transmission
Compliance: GDPR and PECR compliant
Shipping and Logistics Partners:
DPD, Hermes, Royal Mail, or other couriers Purpose: Deliver your orders
Data shared: Name, address, phone number, order details Legal basis: Contract performance
Tracking: You receive tracking information
Customer Support Platform:
Zendesk, Gorgias, or similar support tools
Purpose: Respond to customer inquiries
Data shared: Communication history, order details, personal information Security: Secure servers with encryption
Web Hosting and Cloud Storage:
Amazon Web Services (AWS), Google Cloud, or similar Purpose: Store website data and backups
Data shared: Website data, order information, user accounts Security: Enterprise-grade security and encryption Locations: May be stored globally
Analytics Services:
Google Analytics 4
Purpose: Understand website usage and visitor behavior
Data shared: Device information, usage patterns, IP address (anonymized) Tracking: Google Analytics cookies
Opt-out: Available through their opt-out tools
Privacy: https://policies.google.com/privacy
Social Media and Advertising Platforms:
Facebook/Meta, TikTok, Instagram, Google Ads, Pinterest
Purpose: Display targeted advertisements and measure campaign performance Data shared: Device identifiers, browsing behavior, interests
Tools used: Pixel tracking, conversion tracking
Cookies: Meta Pixel, Google Ads Conversion Tracking
Opt-out: Available through platform ad preferences
Search Engine Marketing:
Google Ads, Bing Ads
Purpose: Track conversions and optimize advertising Data shared: Conversion data, website visitor information Tracking: Conversion pixels and tracking codes
Analytics and Data Analysis:
Third-party analytics tools and services
Purpose: Analyze business performance and customer trends Data shared: Aggregated and anonymized data (where possible)
6.2 Legal Requirements and Law Enforcement
We may disclose your personal information when required by law or in response to valid requests from:
UK law enforcement (police, HMRC) EU law enforcement authorities
Court orders and legal proceedings Regulatory authorities (ICO, FCA, etc.) Government agencies
Fraud investigation agencies
Data protection authorities
We will disclose the minimum information necessary and will notify you when legally permitted.
6.3 Business Partners and Marketing
With your consent or appropriate notice, we may share your information with: Co-marketing partners for joint promotions
Affiliate partners and influencers
Business partners for complementary services
Third parties you’ve consented to share with
Your information is shared in accordance with their privacy policies.
6.4 Business Transfers
If Novanila undergoes a business transition such as: Merger or acquisition
Bankruptcy or insolvency
Asset sale
Change of ownership
Corporate restructuring
Your personal information may be transferred to the new entity. We will notify you of any such change and any choices you may have.
6.5 Consent and Direction
We may disclose your information when:
You explicitly request it
You consent to sharing with a specific third party You use third-party integrations or social login You participate in promotions or partnerships
6.6 Aggregated and Anonymized Data
We may share aggregated, de-identified, or anonymized information that cannot identify you with:
Business partners for analysis Marketing partners for insights Analytics providers
Academic or research institutions
This data cannot reasonably be linked back to you.
7. INTERNATIONAL DATA TRANSFERS
7.1 Where Your Data Is Processed
Your personal information may be transferred to, stored in, and processed in countries outside the United Kingdom and European Union, including:
Canada (Shopify)
United States (AWS, Google, Meta)
Other countries where our service providers operate
7.2 Data Protection Safeguards
When we transfer your data outside the UK/EU, we ensure adequate protection through:
Standard Contractual Clauses (SCCs):
We use the European Commission’s approved SCCs
These include specific safeguards for international transfers Provides GDPR-compliant data transfer mechanism
Adequacy Decisions:
We only transfer to countries with adequate data protection
UK Government has issued adequacy decisions for certain countries
Your Consent:
We obtain your explicit consent where required by law
Consent is separate from our Privacy Policy agreement
Enhanced Safeguards:
Encryption during transmission
Restricted access to international recipients Supplementary measures to address risks
7.3 No Perfect Security Guarantee
We acknowledge that:
No data transfer across the internet is completely secure
Data transferred internationally may have different protection levels in some cases Risks include government surveillance and law enforcement access
We use best practices to minimize these risks
7.4 Your Rights Regarding International Transfers
You have the right to:
Ask about specific transfers and safeguards
Request information about countries where data is processed Object to transfers (with limited exceptions)
Refer concerns to the ICO
8. DATA RETENTION AND DELETION
8.1 Retention Periods
We retain your personal information for different periods depending on the type of data and the legal basis for retention:
Account and Contact Information:
Retained for: Duration of your relationship with us + 3 years Reason: Customer service, dispute resolution, legal claims Deletion: Automatically deleted after 3 years of inactivity
Payment and Transaction Records:
Retained for: 6 years
Reason: UK tax law requires 6-year retention period for financial records Deletion: Automatically deleted after 6 years
Marketing and Newsletter Lists:
Retained for: Until you unsubscribe
Reason: To manage your marketing preferences Deletion: Immediately upon unsubscribe
Website Cookies:
Retained for: Up to 24 months
Reason: To improve website experience and analytics Deletion: Can be deleted through browser settings
Website Analytics Data:
Retained for: 26 months
Reason: Google Analytics standard retention Deletion: Automatically deleted after 26 months
Customer Support Communications:
Retained for: 3 years after final contact
Reason: Dispute resolution and service improvement Deletion: Automatically deleted after 3 years
Fraud Prevention and Security Logs:
Retained for: 1-2 years
Reason: Ongoing security and fraud monitoring Deletion: Automatically deleted after security period
Return and Refund Records:
Retained for: 3 years
Reason: Dispute resolution and warranty purposes Deletion: Automatically deleted after 3 years
IP Addresses and Device Information:
Retained for: 90 days (analytics), 3 years (security) Reason: Analytics and security monitoring Deletion: Automatically deleted per policy
Email Communications:
Retained for: 3 years
Reason: Customer service and record-keeping Deletion: Archived and deleted after 3 years
8.2 Deletion Process
Once the retention period expires, we:
Securely delete your information
Use secure deletion methods (not just removing from view) Remove information from backups
Anonymize information that must be retained
Confirm deletion in writing if you request it
8.3 Legal Holds
We may retain information longer if: Required by pending legal proceedings Subject to a litigation hold
Needed to comply with a court order Required by regulatory authority
We will inform you of any such holds.
9. YOUR RIGHTS UNDER DATA PROTECTION LAW
Under UK GDPR, Data Protection Act 2018, and other applicable laws, you have the following rights:
9.1 Right of Access (Subject Access Request)
What it is: You can request a copy of all personal information we hold about you.
How to exercise it:
Email: info@novanila.com
Subject line: “Subject Access Request”
Include: Your full name, account email, and any order numbers
What you’ll receive:
Copy of all your personal information Explanation of how it’s used
List of recipients
Confirmation of retention periods
Timeline: Within 30 calendar days (can be extended to 90 days for complex requests) Cost: Free (unless request is excessive or repetitive)
9.2 Right to Rectification (Correction)
What it is: You can ask us to correct inaccurate or incomplete information.
How to exercise it:
Log into your account and update directly
Email: info@novanila.com with corrections
Include: What information is incorrect and the correct version
What we’ll do:
Correct the information
Notify third parties who received it (where feasible) Confirm the correction in writing
Timeline: Immediately or within 30 days
9.3 Right to Erasure (“Right to be Forgotten”)
What it is: You can request deletion of your personal information in many circumstances.
How to exercise it:
Email: info@novanila.com
Subject line: “Request for Erasure”
Clearly state what information should be deleted
When we can delete:
Information is no longer necessary You withdraw consent
You object to processing
Data was processed unlawfully Deletion is required by law
When we may NOT delete:
Needed to fulfill order
Required by tax law (6-year retention) Legal claims or defense
Public interest
Compliance obligation
Fraud investigation
We will explain if we cannot delete your data and why. Timeline: Within 30 days
9.4 Right to Restrict Processing
What it is: You can ask us to limit how we use your information.
How to exercise it:
Email: info@novanila.com
Subject line: “Request to Restrict Processing” Explain which processing you want restricted
Situations where this applies:
You dispute accuracy of data
Processing is unlawful but you don’t want deletion We no longer need data but you need us to retain it You’ve objected to processing (pending outcome)
What happens:
We’ll mark your data as restricted
We’ll only process it with your consent (with exceptions) We’ll notify you before removing restrictions
Timeline: Within 30 days
9.5 Right to Data Portability
What it is: You can receive your personal information in a structured, portable format and transfer it to another service.
How to exercise it:
Email: info@novanila.com
Subject line: “Data Portability Request” Specify which information and format
What you’ll receive:
Your information in machine-readable format (CSV, JSON, etc.) Can be transferred to another service
Includes data you provided and generated
We’ll transmit directly to another provider if you request
Limitations:
Only covers information you provided or generated Not information inferred or third-party data
Must not violate others’ rights
Timeline: Within 30 days
9.6 Right to Object to Processing
What it is: You can object to how we process your information in certain situations. You can object to:
Marketing and promotional emails Profiling for marketing purposes
Processing based on legitimate interest Targeted advertising and retargeting Cookies and tracking (non-essential)
How to exercise it:
Click “unsubscribe” in marketing emails
Email: info@novanila.com with “Objection to Processing” Manage preferences in your account
What happens:
We’ll stop the objectionable processing Confirm in writing
Honor your request immediately
Note: You cannot object to processing necessary for contract or legal obligation. Timeline: Immediate for marketing; 30 days for other objections
9.7 Right to Withdraw Consent
What it is: If you gave us permission to process your information, you can withdraw it.
Where this applies:
Marketing emails and newsletters
Newsletter signups
Cookie consent (non-essential)
Optional surveys and feedback
Any processing requiring your explicit consent
How to exercise it:
Click “unsubscribe” in any marketing email Update your preferences in your account Email: info@novanila.com
What happens:
We stop processing based on that consent
Withdrawal does not affect lawfulness of past processing Takes effect immediately
Important: Withdrawal only applies to the specific consent you’re withdrawing. Timeline: Immediate
9.8 Rights Related to Automated Decision-Making and Profiling What it is: You have protections against decisions made entirely by automated
processes.
What we do NOT do:
We do not make decisions based solely on automated processing that significantly affects you
We do not use profiling that produces legal or equally significant effects without human review
We do not make automated decisions about eligibility or credit
What we DO do:
We use automated tools to detect fraud (with human review)
We use recommendations based on your preferences (you can object) We use analytics to improve services
Your rights:
Request explanation of how algorithm works Object to automated decision-making Request human review
Lodge complaint
9.9 How to Exercise Your Rights Submitting a Request:
Send an email to: info@novanila.com Include in your request:
Full name and current email address Account number (if applicable) Order numbers (if relevant)
Specific right you’re exercising What information is involved Preferred format of response
Any supporting information
Identity Verification:
We may ask for proof of identity
This protects your privacy
Valid ID, utility bill, or account verification
Authorized Representatives:
You can appoint someone to make requests on your behalf We require written authorization and proof of ID
We may verify directly with you
Multiple Requests:
We handle one request per 30 days
Excessive or repetitive requests can be refused We’ll explain why if we refuse
Timeline:
Acknowledge receipt: Within 5 working days
Full response: Within 30 calendar days
Extensions: Up to 90 days for complex requests (we’ll explain)
Response Format:
Written response via email
Copy of information (if applicable)
Explanation of our decision
Information about further remedies
Cost:
Free for most requests
Can charge for excessive, repetitive, or unfounded requests We’ll inform you of costs before proceeding
10. COOKIES AND TRACKING TECHNOLOGIES
10.1 What Are Cookies?
Cookies are small text files stored on your device (computer, smartphone, tablet) when you visit a website. They allow websites to remember information about you and your preferences across visits.
10.2 Types of Cookies We Use
Essential/Functional Cookies (Required - Cannot Opt Out)
Session identification
Shopping cart functionality
Login and authentication
Security and fraud prevention
Payment processing
Website navigation
These cookies are necessary for the website to work
Analytics Cookies (Require Consent)
Google Analytics: Track visitor behavior, page views, session duration Heatmap tools: Show how users interact with pages
User ID tracking: Identify unique visitors
Purpose: Understand website performance and user behavior
Provider: Google
Opt-out: Google Analytics Opt-Out Browser Add-on Marketing and Advertising Cookies (Require Consent)
Facebook Pixel: Track conversions, build audiences, retarget visitors Google Ads: Conversion tracking, audience building
TikTok Pixel: Campaign tracking and optimization
Pinterest Pixel: Conversion tracking
Purpose: Show you relevant ads, measure campaign performance
Opt-out: Social media platform ad preferences Preference Cookies (Require Consent)
Remember language preference Remember previous product views Store browsing history
Remember customer preferences Purpose: Personalize your experience
Performance Cookies (Require Consent) Measure website speed
Monitor server performance
Identify technical issues
Optimize website loading
10.3 Third-Party Cookies
These companies place cookies on your device:
Google Analytics
Provider: Google LLC
Purpose: Website analytics and visitor tracking Privacy Policy: https://policies.google.com/privacy
Opt-out: https://tools.google.com/dlpage/gaoptout Meta/Facebook Pixel
Provider: Meta Platforms Inc.
Purpose: Conversion tracking and advertising
Privacy Policy: https://www.facebook.com/privacy/explanation Opt-out: Facebook Ad Preferences
Google Ads
Provider: Google LLC
Purpose: Search advertising and conversion tracking Privacy Policy: https://policies.google.com/privacy Opt-out: Google Ads Settings
TikTok
Provider: TikTok Inc.
Purpose: Campaign tracking and audience insights Opt-out: TikTok Ad Preferences
Shopify
Provider: Shopify Inc.
Purpose: Website functionality and analytics
Privacy Policy: https://www.shopify.com/legal/privacy
10.4 Cookie Consent and Management Our Cookie Banner:
Displays when you first visit our Website
Allows you to accept or reject cookies
Can be accessed anytime through our privacy settings Remembers your preferences
Managing Cookies in Your Browser:
Most browsers allow you to:
View cookies stored
Delete cookies individually Block cookies from specific sites Clear all cookies on exit
Enable “Do Not Track” (DNT) signals
Browser Settings:
Chrome: Settings → Privacy and Security → Cookies
Firefox: Preferences → Privacy & Security → Cookies
Safari: Preferences → Privacy → Manage Website Data
Edge: Settings → Privacy, search, and services → Clear browsing data
Browser Extensions:
Privacy Badger: Automatically blocks tracking uBlock Origin: Blocks ads and trackers Disconnect: Shows and blocks trackers DuckDuckGo Privacy Essentials: Privacy tool
Global Privacy Control (GPC):
Enable in your browser
We respect GPC signals
Automatically treated as opt-out request https://globalprivacycontrol.org/
“Do Not Track” (DNT):
We do not recognize standard DNT signals We do recognize Global Privacy Control
10.5 Consequences of Blocking Cookies If you disable essential cookies:
Website may not function properly Shopping cart may not work
Login may not work
Payment processing may fail
If you disable analytics cookies:
No consequence to website functionality
Helps protect your privacy
Website may still work slightly slower (no optimization data)
If you disable marketing cookies:
No consequence to website functionality You’ll see less targeted advertising
Ads will be less relevant to your interests
10.6 Email and Newsletter Tracking
We may use tracking in emails:
Open tracking: Knows if you opened an email Click tracking: Tracks which links you click Device tracking: Shows what device you used Location tracking: Shows approximate location
You can disable email tracking:
Disable tracking pixels in your email client Most email providers have privacy settings Request we stop tracking by emailing us
11. DATA SECURITY AND PROTECTION
11.1 Security Measures We Implement Technical Security:
SSL/TLS encryption (HTTPS): Secure connection to our Website (indicated by lock icon)
End-to-end encryption: Protects data in transit
Database encryption: Protects stored data
Firewall protection: Blocks unauthorized access
Intrusion detection: Monitors for attacks
Regular security updates: Keeps systems patched
Secure servers: Enterprise-grade hosting (AWS, Google Cloud) Malware scanning: Regular system scans
DDoS protection: Prevents denial-of-service attacks
Organizational Security:
Access controls: Only authorized staff access data Authentication: Multi-factor authentication for admin accounts Role-based permissions: Staff only see necessary data Employee training: Annual data protection training Confidentiality agreements: All staff sign NDAs
Vendor assessments: We vet all service providers
Incident response plan: Procedures for data breaches
Security audits: Regular third-party audits
Penetration testing: Tests for vulnerabilities
Physical Security:
Secure data centers: Guarded facilities Access restrictions: Limited physical access Surveillance: CCTV monitoring
Backup systems: Secure backup locations
11.2 Payment Card Security
PCI DSS Compliance:
We comply with Payment Card Industry Data Security Standards We do NOT store full credit card numbers
We do NOT store full debit card numbers
We do NOT store CVV/CVC codes
All payment processing through secure providers (Stripe, PayPal) Tokenization: Cards replaced with secure tokens
Encrypted transmission: Industry-standard encryption
Payment Processor Security:
Stripe: PCI DSS Level 1 certified
PayPal: Enterprise security standards Both use encryption and fraud detection
11.3 Limitations of Security Important Notice:
No security system is 100% secure or impenetrable
Data transmission over the internet is not completely secure Cyber criminals may develop new attack methods Third-party breaches beyond our control are possible
We cannot guarantee absolute security
You can help protect your account:
Use strong, unique passwords
Change passwords regularly
Do not share login credentials
Do not use public Wi-Fi for sensitive transactions Log out of your account when finished
Keep your devices updated with security patches
Use antivirus software
Monitor your accounts for suspicious activity
12. SHOPIFY AND THIRD-PARTY PROCESSORS
12.1 Shopify’s Role
Our Website is hosted and operated through Shopify. This means:
What Shopify Does:
Hosts our Website infrastructure Processes transactions and payments Stores customer account data Manages our store backend
Provides analytics and reporting
Handles technical support
Shopify’s Data Processing:
Acts as our data processor (on our instructions)
Also acts as a separate data controller for certain uses Collects information about your access and use of our store Uses information to provide and improve services
May use your information to enhance features
May use data for fraud prevention and security
Shopify’s Privacy:
Shopify has its own Privacy Policy: https://www.shopify.com/legal/privacy Shopify’s Consumer Privacy Policy: https://www.shopify.com/legal/privacy/app-
users
Shopify Privacy Portal: https://privacy.shopify.com/en Your Rights with Shopify:
You can exercise rights directly with Shopify
Shopify has its own data subject request process
See Shopify’s Privacy Portal for how to submit requests Shopify must comply with GDPR for data subjects in EU/UK
12.2 Shopify’s Use of Your Information
Shopify may use your information to:
Provide and improve Shopify’s platform Enhance features across their network Understand merchant and customer behavior Develop analytics and insights
Prevent fraud and abuse
Comply with legal obligations
12.3 Data Transfers to Shopify
When you shop with us:
Your information is transmitted to Shopify Shopify stores it in their systems
May be stored in Canada or United States Standard Contractual Clauses (SCCs) are in place Your information has GDPR-equivalent protection
13. SPECIFIC DATA PROTECTION TOPICS
13.1 Children’s Privacy Our Policy on Children:
Our Website and services are NOT intended for anyone under 18 years old We do not knowingly collect information from anyone under 18
If you are under 18, please do not provide your information
If Your Child Provided Information:
We will delete it immediately upon request
Parent or guardian should contact us at info@novanila.com Provide proof of age and guardianship
We will confirm deletion in writing
Parental Consent:
For anyone 16-18 in the EU, parental consent may be required We recommend parental guidance for anyone under 18 Parents can request information we hold about their child
Young People’s Rights:
Young people have the same data protection rights as adults They can request access to their information
They can request deletion (with restrictions)
They can lodge complaints with the ICO
13.2 Direct Marketing and PECR Compliance Email Marketing (PECR Compliance):
We only send marketing emails with your prior express consent
You must explicitly opt-in (checkbox must be unchecked by default) Consent is separate from Terms of Service
Every email includes unsubscribe option
You can unsubscribe anytime
We remove you within 48 hours of unsubscribe
SMS and Text Message Marketing:
We require explicit prior express consent before SMS Only permitted if you’ve opted in
Every message includes unsubscribe instructions You can reply STOP to unsubscribe
We comply with PECR SMS regulations
Telephone Marketing:
We only call with prior explicit consent
We do not use unsolicited cold calling for marketing You can register with Telephone Preference Service We check TPS before calling
Postal Mail Marketing:
We only send postal marketing with your consent You can opt out at any time
Unsubscribe request processed within 30 days
Direct Marketing Channels:
Email (requires consent)
SMS (requires consent)
Telephone (requires consent)
Postal mail (requires consent)
Social media (requires compliance with platform rules) Push notifications (requires device consent)
Managing Your Marketing Preferences:
Unsubscribe link in every marketing email Update preferences in your account Email us: info@novanila.com
SMS: Reply STOP to any SMS
We’ll process all requests within 48 hours
Legal Basis for Marketing:
UK GDPR: Your explicit consent (Article 6(1)(a)) PECR: Your prior express consent
Right to opt-out: Available for all marketing
Can use Global Privacy Control (GPC) signal
13.3 Marketing Retargeting and Targeted Advertising What Is Retargeting:
Shows you ads for products you viewed Follows you across websites
Uses cookies and pixels to track browsing Examples: Facebook, Google Ads, TikTok
How We Use Retargeting:
Show relevant product ads after you visit Remind you of items in your cart Promote related products
Measure campaign effectiveness
Build audience insights
Technologies Used:
Facebook/Meta Pixel Google Ads Pixel
TikTok Pixel
Other advertising networks
Your Consent:
Retargeting requires cookie consent You can reject cookies on visit
You can opt-out of retargeting anytime
How to Opt Out:
Adjust ad preferences in social media settings Facebook: Settings → Ad Preferences
Google: Google Ads Settings
TikTok: Settings → Ad Preferences
Disable tracking cookies
Use Global Privacy Control (GPC)
Browser extensions (Privacy Badger, uBlock)
Important Note:
Opting out of retargeting doesn’t stop all ads You’ll still see ads, but less relevant
We can still show non-targeted ads
13.4 Complaints and Dispute Resolution If You Have a Complaint:
Step 1: Contact Us
Email: info@novanila.com
Subject: “Privacy Complaint”
Include: Details of concern, what you want resolved Timeline: We’ll acknowledge within 5 business days
Step 2: Internal Review
We’ll investigate your complaint Provide full response within 30 days Explain our decision and reasoning Offer solutions where appropriate
Step 3: Appeal
If unsatisfied with our response
Email: info@novanila.com with “Appeal”
Include: Original complaint and why response unsatisfactory
Timeline: We’ll review within 30 days
Step 4: Escalate to ICO (UK)
If we don’t resolve your complaint
Contact: Information Commissioner’s Office (ICO) Website: www.ico.org.uk
Email: casework@ico.org.uk
Phone: 0303 123 1113
You can lodge a complaint directly with ICO anytime
Step 5: EU Authority (If Applicable)
For EU residents, contact your national data protection authority
Find your authority: https://edpb.europa.eu/about-edpb/board/members_en You can lodge complaints in any EU country
Your Right to Judicial Remedy:
You have the right to pursue legal action Against us in UK courts
For damages caused by our data processing If we breach your GDPR rights
14. CONTACT INFORMATION
For any questions, concerns, or to exercise your rights:
Novanila UK Ltd Suite RA01 195-197 Wood Street London, E17 3NU United Kingdom
Email: info@novanila.com
(General inquiries and data subject requests)
Email: info@novanila.com Subject: “Data Protection Request” (For specific data protection rights)
Phone: 07776 604181 (Customer service and inquiries)
Website: www.novanila.com Response Timeline:
Acknowledgment: Within 5 business days
Full response: Within 30 calendar days Complex requests: Up to 90 days (we’ll explain)
Data Controller Confirmation:
Novanila UK Ltd is the data controller Responsible for data protection compliance Committed to protecting your privacy Available to address all privacy concerns
15. CHANGES TO THIS PRIVACY POLICY
15.1 Policy Updates
We may update this Privacy Policy when: Our practices change
Laws or regulations change
We add new services or features
We add new service providers
For operational, legal, or regulatory reasons To improve clarity or transparency
15.2 How We’ll Notify You Posting the Update:
New version posted to www.novanila.com/policies/privacy-policy “Last Updated” date changed at top of policy
Archive of previous versions available upon request
For Significant Changes:
Email notification to registered customers Notice on Website homepage
May require new consent
Continued Use:
Your continued use of our Website means you accept updates Significant changes may require new explicit consent
We’ll make this clear in notification
15.3 Your Rights When We Change Policies
You can review the new policy before using Website You can request copy of previous policy
You can exercise rights under new policy
Changes don’t retroactively affect past processing
16. LEGAL COMPLIANCE STATEMENT
This Privacy Policy complies with:
UK General Data Protection Regulation (UK GDPR) 2016/679
Data Protection Act 2018
Privacy and Electronic Communications Regulations 2003 (PECR) UK Data Protection Bill 2018
ePrivacy Directive 2002/58/EC
ICO Guidance on Privacy
GDPR Article 13-14 Transparency Requirements Articles 6-9 Processing Requirements
Article 30 Records of Processing
Articles 33-34 Breach Notification
Articles 38-39 Data Protection Officer
All GDPR Rights (Articles 15-22)
Jurisdiction:
Governed by UK and EU data protection law ICO is supervisory authority (UK)
EU authorities for EU data subjects
UK courts for dispute resolution
17. SUMMARY FOR QUICK REFERENCE
What We Collect:
Account info, payment details, website activity, cookies
Why We Collect It:
Process orders, improve services, marketing (with permission), legal compliance
Who We Share It With:
Shopify, payment processors, shipping partners, email services, analytics, advertising platforms
Your Rights:
Access, correct, delete, portability, object to processing, withdraw consent
How to Request:
Email: info@novanila.com
Timeline: Within 30 days
How Long We Keep It:
Order data: 3 years; Payment records: 6 years; Analytics: 26 months; See Section 8 for full details
How We Protect It:
SSL encryption, secure servers, access controls, staff training
Contact:
info@novanila.com | 07776 604181 | www.novanila.com
18. DOCUMENT INFORMATION
Document Title: Novanila Privacy Policy Effective Date: August 17, 2026
Last Updated: August 17, 2026 Version: 1.0 (Final)
Status: Ready for Publication
Jurisdiction: United Kingdom and European Union
Compliance Standard: UK GDPR, PECR, Data Protection Act 2018 For: Novanila UK Ltd - www.novanila.com
Business Address:
Suite RA01
195-197 Wood Street London, E17 3NU United Kingdom
Contact Email: info@novanila.com Contact Phone: 07776 604181
END OF PRIVACY POLICY
This Privacy Policy is legally binding and supersedes any previous privacy policy. By using our Website and services, you agree to this Privacy Policy.
For questions, concerns, or to exercise your rights, contact us immediately.
We are committed to protecting your privacy and complying with all applicable data protection laws.
© 2026 Novanila UK Ltd. All Rights Reserved.
