Privacy Policy

Privacy Policy

Last updated: 2026-08-24

At Nornelle we take the privacy of our customers seriously. This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit nornelle.com, make a purchase, contact us or use our services.

Read it together with our Terms of Service, Shipping Policy and Return & Refund Policy.

1. Data Controller / Business Responsible for Your Information

2. Notice at Collection — Summary Table

Category of personal information Examples Purpose Sold / Shared for advertising? Retention
Identifiers Name, email, postal address, phone, order number Order processing, support No 2 years after last order
Commercial information Products purchased, returns, purchase history Order and returns management No Tax retention period
Payment information Payment method, transaction status, billing address Payment and fraud prevention No Tax retention period
Internet / device activity IP address, browser, device, pages viewed, cart activity Analytics, site operation, advertising No 3 months
Geolocation (approximate) Country/region from IP Tax, shipping, fraud Yes 6 months
Inferences Preferences, audience segments Personalisation, advertising No  3 months

We do not knowingly collect sensitive personal information (health, religion, political opinions, biometrics, precise geolocation, racial or ethnic origin, sexual orientation). If you voluntarily include such information in a message to support, we process it only to handle that message.

3. Personal Information We Collect

  • Identification details: first and last name.
  • Contact details: email, shipping address, billing address, phone number where necessary.
  • Order details: products purchased, order number, purchase history, returns, incidents.
  • Payment details: payment method, confirmation and transaction data. Full card details are processed by our payment providers and are not stored by us.
  • Communication data: support messages, complaints, return requests.
  • Technical data: IP address, device type, browser, operating system, online identifiers, cookies, browsing data.
  • Usage data: pages visited, products viewed, items added to cart, on-site behaviour.
  • Marketing data: communication preferences, campaign interactions, subscription status.

4. Where We Get It

  • Directly from you, when you order, fill in forms or contact us.
  • Automatically, through cookies, device identifiers and analytics tools when you browse.
  • From service providers: Shopify, payment processors, shipping companies, support tools, email marketing providers, analytics platforms.
  • From advertising platforms and fraud prevention tools.

5. How We Use It

  • Process and manage orders; confirm payments; prevent fraud.
  • Prepare, ship and deliver products.
  • Manage returns, refunds, cancellations, incidents and complaints.
  • Respond to customer support enquiries.
  • Send order confirmations, shipping updates and service communications.
  • Improve the site and analyse its performance.
  • Personalise content and advertising where permitted.
  • Send promotional communications where there is a valid legal basis or consent.
  • Detect, prevent and investigate fraud, abuse or policy violations.
  • Comply with legal, tax, accounting and consumer protection obligations.
  • Establish, exercise or defend legal claims.

We do not use your data for automated decision-making producing legal or similarly significant effects, other than automated fraud-scoring applied by our payment providers before an order is accepted. You may contact us to request human review of any order declined on that basis.

Purpose Legal basis (GDPR Art. 6)
Processing orders, payments, shipping, returns Performance of a contract — Art. 6(1)(b)
Invoicing, tax and accounting records Legal obligation — Art. 6(1)(c)
Fraud prevention, site security, dispute defence Legitimate interest — Art. 6(1)(f)
Analytics and service improvement Consent (non-essential cookies) or legitimate interest
Email marketing to customers about similar products Legitimate interest / soft opt-in, with opt-out in every message
Advertising cookies, pixels, personalised ads Consent — Art. 6(1)(a)

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interest, you may object; you can request our balancing assessment at nornelle.shop@gmail.com.

7. Shopify and Service Providers

Our store runs on Shopify. When you use our website or place an order, personal information may be processed by Shopify and by other providers needed to operate the store:

  • Shopify and its related services
  • Payment processors
  • Shipping and logistics companies
  • Order management and fulfilment providers
  • Fraud prevention tools
  • Customer support services
  • Email, marketing and communication providers
  • Analytics and measurement tools
  • Hosting, security and technical support providers
  • Authorities, courts or third parties where legally required

These providers act on our instructions under a data processing agreement, or as independent controllers where they determine their own purposes (for example, payment providers and advertising platforms).

8. Payments and Transaction Security

Payments on nornelle.com are processed by secure third-party payment providers. We do not store full card details.

We may process payment confirmation, method, status, amount, currency, date, billing address and data needed to prevent fraud or resolve incidents.

We may hold, review, cancel or request additional verification for orders showing risk signals, inconsistent information, suspected fraud or previous chargebacks.

9. Marketing and Advertising

We may send commercial communications about products, promotions and news where there is a valid legal basis or your consent.

We may use advertising and analytics tools (for example, Meta, TikTok, Google) to display personalised ads and measure campaign effectiveness.

You can unsubscribe at any time using the link in our emails or by writing to nornelle.shop@gmail.com. Even if you unsubscribe, we will still send communications necessary for your orders, payments, shipping, returns, security and legal changes.

10. Cookies and Similar Technologies

We use cookies, pixels, identifiers and similar tools to operate the store, remember preferences, analyse usage, prevent fraud and display relevant advertising.

Some cookies are strictly necessary (cart, checkout, security, session). Others are used for analytics, personalisation and advertising.

Non-essential cookies are only set after you give consent through our cookie banner. You can accept all, reject all, or configure your preferences, and you can change or withdraw your choice at any time through the cookie settings link in our footer. Rejecting is as easy as accepting.

We may disclose personal information to comply with laws, respond to valid requests from authorities or courts, protect our rights and security, investigate fraud or abuse, respond to claims, chargebacks or legal proceedings, and cooperate with payment providers and platforms.

12. International Data Transfers

Because we work with Shopify, payment providers, marketing tools, analytics platforms and logistics companies, your personal information may be processed outside your country of residence, including in the United States.

Where personal data is transferred outside the EEA, we rely on one of the following safeguards under Chapter V GDPR: an adequacy decision of the European Commission (including the EU–US Data Privacy Framework where the recipient is certified), Standard Contractual Clauses approved by the Commission, or another legally recognised mechanism. You may request a copy of the relevant safeguards at nornelle.shop@gmail.com.

13. Data Retention

We keep personal information only for as long as necessary:

Data Retention period
Order and invoicing records 6 years, per tax and accounting law ([6 años en España, art. 30 C. de Comercio])
Customer support correspondence 1 year after the case is closed
Marketing data Until you unsubscribe, plus a suppression record to honour your opt-out
Cookies and analytics data 2 months
Fraud and chargeback records 3 years

When data is no longer needed we delete it, anonymise it, or restrict it where retention is needed to comply with legal obligations or defend claims.

14. Information Security

We take reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, disclosure, alteration or destruction.

No transmission or storage system is completely secure. You are responsible for keeping your credentials, devices and email accounts confidential.

If you suspect your information, account or order has been compromised, contact nornelle.shop@gmail.com as soon as possible. Where a personal data breach is likely to result in a high risk to your rights, we will notify you and the competent authority as required by law.

15. Your Rights (EEA, United Kingdom, Switzerland)

You have the right to:

  • Access your personal data and obtain a copy;
  • Rectify inaccurate or incomplete data;
  • Erase your data ("right to be forgotten");
  • Restrict processing;
  • Object to processing based on legitimate interest, and to direct marketing at any time;
  • Data portability;
  • Withdraw consent at any time;
  • Lodge a complaint with a supervisory authority.

To exercise these rights, write to nornelle.shop@gmail.com. We may ask for information to verify your identity. We will respond within one month, extendable by two further months for complex requests, and free of charge unless requests are manifestly unfounded or excessive.

Supervisory authority in Spain: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es. If you reside in another Member State, you may complain to your local authority. We would appreciate the chance to resolve the issue first.

16. Your Rights (United States)

Depending on your state of residence (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Florida, Iowa, Nebraska, New Hampshire, New Jersey and others), you may have the right to:

  • Know / access what personal information we collect, use and disclose;
  • Delete personal information we hold about you;
  • Correct inaccurate personal information;
  • Portability — obtain a copy in a portable format;
  • Opt out of the sale or sharing of personal information, of targeted advertising, and of profiling with legal or similarly significant effects;
  • Limit the use of sensitive personal information;
  • Non-discrimination for exercising your rights;
  • Appeal a decision we make about your request.

Do Not Sell or Share My Personal Information

We do not sell personal information for money. However, we use advertising and analytics technologies (such as the Meta, TikTok and Google pixels) that may constitute a "sale" or "sharing" of personal information for cross-context behavioural advertising under the CCPA/CPRA and similar state laws.

You can opt out by:

  1. Using the "Do Not Sell or Share My Personal Information" link in the footer of nornelle.com;
  2. Adjusting your cookie preferences; or
  3. Emailing nornelle.shop@gmail.com with the subject "Do Not Sell or Share".

We honour Global Privacy Control (GPC) signals sent by your browser as a valid opt-out request for the browser and device from which the signal is received.

How to exercise your rights

Email nornelle.shop@gmail.com. We will verify your identity before responding and will reply within 45 days, extendable once by a further 45 days where reasonably necessary.

You may use an authorised agent; we may require proof of authorisation and verification of your identity.

Appeals

If we decline your request, you may appeal by replying to our decision or writing to nornelle.shop@gmail.com with the subject "Privacy Appeal". We will respond within 60 days. If the appeal is denied, you may contact your state Attorney General.

17. Minors

This website is not intended for minors who cannot legally make online purchases.

We do not knowingly collect personal data from children below the age of valid consent for information society services in their Member State (14 in Spain; between 13 and 16 elsewhere) without parental authorisation.

We do not knowingly collect personal information from children under 13, in accordance with COPPA. We do not sell or share the personal information of consumers we know to be under 16.

If you are a parent or guardian and believe a minor has provided us with personal information, contact nornelle.shop@gmail.com. We will take reasonable steps to delete it unless we are legally required to retain it.

Our website may link to third-party websites, platforms, applications or services. We do not control and are not responsible for their privacy practices. Review their policies before providing personal information. Inclusion of a link does not imply approval or control by us.

19. Complaints

For any complaint about the processing of your personal data, contact nornelle.shop@gmail.com. We aim to respond clearly and within the timeframes above. You retain the right to complain to your competent data protection authority or state Attorney General.

20. Changes to This Privacy Policy

We may update this Privacy Policy to reflect legal, technical or operational changes. The updated version will be published on this page with a new "Last updated" date. Where changes are material and required to be notified, we will inform you by email or a prominent notice on the website.

21. Contact

Álvaro Carcedo Martínez. Email: nornelle.shop@gmail.com