Privacy policy

Privacy Policy

Last updated: 25th July 2026

Nueve Code ("Nuco", "we", "us", "our") operates this store and website, including all related information, content, features, tools, products and services, to provide you, the customer, with a curated shopping experience (the "Services"). Our store is powered by Shopify, which enables us to provide the Services to you.

For the purposes of UK data protection law — the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025 — Nueve Code is the data controller of your personal information. Our contact details are set out at the end of this policy.

This Privacy Policy explains how we collect, use, and disclose your personal information when you visit, use, or make a purchase using the Services, or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this policy carefully. By using the Services, you acknowledge that you have read and understood it.

Personal Information We Collect

When we use the term "personal information", we mean information that identifies or can reasonably be linked to you. It does not include information collected anonymously or that has been de-identified so it cannot be linked to you. Depending on how you interact with the Services, we may collect or process:

Contact details — your name, billing and shipping address, phone number, and email address.
Financial information — payment card details, financial account information, transaction details, form of payment, and payment confirmations. (Note: card payments are processed by Shopify Payments and our payment providers; we do not store full card numbers ourselves.)
Account information — your username, password, preferences and settings.
Transaction information — items you view, add to your cart or wishlist, purchase, return, exchange or cancel, and your past order history.
Communications — the information you include when you contact us, for example a customer support enquiry.
Device information — information about your device, browser and network connection, your IP address, and other unique identifiers.
Usage information — how and when you interact with and navigate the Services.

We may also draw inferences from the above (for example, product recommendations based on your browsing).

Where We Collect Your Information From

Directly from you — when you create an account, place an order, contact us, or otherwise provide your information.
Automatically — from your device and through cookies and similar technologies when you use the Services (see Cookies below).
From our service providers — including Shopify and others who process personal information on our behalf.
From our partners or other third parties — for example advertising and analytics partners.

How We Use Your Information and Our Lawful Bases

Under the UK GDPR we must have a lawful basis for each way we use your personal information. Our purposes and the bases we rely on are:

Purpose	What this involves	Lawful basis
Providing the Services	Processing payments, fulfilling and shipping orders, handling returns and exchanges, managing your account, remembering your preferences.	Performance of a contract with you (or steps prior to entering one).
Customer support and communications	Responding to your enquiries and maintaining our relationship with you.	Legitimate interests (running our business and supporting customers); or contract where support relates to an order.
Improving and tailoring the Services	Understanding how the Services are used, product recommendations, and improving our store.	Legitimate interests (improving our products and service).
Marketing and advertising	Sending you marketing emails, and showing you personalised advertising based on your activity.	Consent (for email/SMS marketing and for non-essential advertising cookies); legitimate interests for postal marketing and certain existing-customer emails, where permitted.
Security and fraud prevention	Authenticating your account, securing payments, and detecting or investigating fraudulent, unsafe or unlawful activity.	Legitimate interests (protecting our business and customers); legal obligation where applicable.
Legal compliance	Meeting our legal and regulatory obligations and responding to lawful requests.	Legal obligation; or legitimate interests in establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we have balanced our interests against your rights and are satisfied our use does not unfairly override them. You can ask us for more detail, or object, at any time (see Your Rights).

Where we rely on consent (such as marketing or non-essential cookies), you can withdraw it at any time — this won't affect the lawfulness of processing carried out before withdrawal.

Cookies and Similar Technologies

We use cookies and similar technologies to operate the store, remember your cart and preferences, understand how the Services are used, and — with your consent — to deliver personalised advertising.

Under PECR, we only place non-essential cookies (such as analytics and advertising cookies) with your consent, which you give through our cookie banner. Strictly necessary cookies (needed to run the site, secure it and process your order) do not require consent. You can change or withdraw your cookie choices at any time via our cookie settings, and you can also control cookies through your browser settings. For full details of the cookies we use, please see our Cookie Policy / cookie settings.

How We Disclose Your Information

We may disclose your personal information to third parties for legitimate purposes, including:

Shopify and other service providers who perform services on our behalf — for example hosting, payment processing, analytics, customer support, cloud storage, fulfilment and shipping.
Business and marketing partners to provide marketing and advertising services, where you have consented. For example, we use Shopify to support personalised advertising with third-party services based on your activity across different merchants and websites. You can opt out of this at any time (see Marketing and Your Choices).
Where you direct or consent — such as arranging delivery, or using social media widgets or login integrations.
In connection with a business transaction such as a merger, acquisition or insolvency.
For legal reasons — to comply with legal obligations, respond to lawful requests from authorities, enforce our terms, or protect our rights, users or others.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them. Information you submit may be transmitted to and shared with Shopify and third parties that may be located outside the UK. To help protect, grow and improve our business, we use certain Shopify enhanced features that incorporate data from your interactions with our store, other merchants and Shopify. For some of these features Shopify acts as a controller and is responsible for that processing, including for responding to related rights requests. To learn more, see the Shopify Consumer Privacy Policy and the Shopify Privacy Portal at https://privacy.shopify.com/en.

Marketing and Your Choices

We may send you marketing emails where you have signed up or where the law otherwise permits. You can opt out at any time using the unsubscribe link in any marketing email. If you opt out, we may still send you non-promotional messages about your account or orders.

You can also opt out of personalised advertising based on your activity across different merchants and websites. If you visit our website with the Global Privacy Control (GPC) signal enabled, we will treat this as an opt-out request for that browser and device. You can learn more about GPC at https://globalprivacycontrol.org/.

International Transfers

We may transfer, store and process your personal information outside the UK, including where our service providers (such as Shopify) operate. Where we transfer personal information out of the UK, we rely on an adequacy regulation (for transfers to countries the UK considers adequate) or on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards we use.

How Long We Keep Your Information

We keep your personal information only for as long as necessary for the purposes set out in this policy. How long that is depends on the type of information and why we hold it — for example, we keep order and transaction records for as long as needed to fulfil your order and to meet legal, tax and accounting obligations (typically six years for financial records), and we keep account information while your account remains active. When we no longer need your information, we securely delete or anonymise it.

Security

We take reasonable technical and organisational measures to protect your personal information. However, no method of transmission or storage is completely secure, and any information you send to us may not be secure while in transit. Please do not use unsecure channels to send us sensitive information, and keep your account credentials safe.

Your Rights

Under UK data protection law you have the following rights in relation to your personal information. These rights are not absolute and may not apply in every situation:

Right to be informed — about how we use your information (this policy).
Right of access — to request a copy of the personal information we hold about you.
Right to rectification — to have inaccurate information corrected.
Right to erasure — to ask us to delete your information in certain circumstances.
Right to restrict processing — to ask us to limit how we use your information.
Right to object — to processing based on our legitimate interests, and to direct marketing at any time.
Right to data portability — to receive certain information in a portable format and, where feasible, have it transferred to another provider.
Right to withdraw consent — where we rely on consent, at any time.
Rights relating to automated decision-making — you will not be subject to decisions producing legal or similarly significant effects based solely on automated processing without appropriate safeguards.

You will not receive discriminatory treatment for exercising any of these rights. We may need to verify your identity before responding, and you may authorise an agent to make a request on your behalf (with proof of authorisation). We will respond within the timeframes required by law.

Complaints and How to Contact Us

If you have any questions, wish to exercise your rights, or want to make a complaint about how we handle your personal information, please contact us using the details below. Under the Data (Use and Access) Act 2025 you have the right to complain to us directly, and we will acknowledge your complaint and respond within the statutory timeframe.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

Website: https://ico.org.uk/make-a-complaint/
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We'd appreciate the chance to resolve your concerns before you approach the ICO.

Children's Data

The Services are not intended for children. We do not knowingly collect personal information from children under the age of 13 without appropriate parental consent, and we design our Services with children's higher protection in mind. If you believe a child has provided us with their personal information, please contact us and we will delete it. As of the date of this policy, we do not knowingly sell or share the personal information of anyone under 16.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for operational, legal or regulatory reasons. We will post the revised policy here, update the "Last updated" date, and provide notice where required by law.