PRIVACY POLICY

Last updated: 18 August 2026

At Norelle, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, store and protect your personal information when you visit our website, create an account, make a purchase, contact us or otherwise interact with our online store.

This Privacy Policy applies to personal data processed through the Norelle website and related services.

For the purposes of applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Norelle is responsible for the personal data described in this Privacy Policy where it acts as the data controller.

1. PERSONAL DATA WE COLLECT

Depending on how you interact with Norelle, we may collect the following categories of personal data:

Information you provide directly

This may include:

• Your first and last name;

• Billing and delivery address;

• Email address;

• Telephone number;

• Account information;

• Order and purchase information;

• Product preferences;

• Information you provide when contacting customer support;

• Information relating to returns, refunds and complaints;

• Marketing preferences; and

• Any other information you voluntarily provide to us.

Payment information

When you make a purchase, payment information is processed in connection with your transaction.

Payments may be processed by Shopify and/or third-party payment providers. Depending on the payment method selected, those providers may collect and process payment card or account information in accordance with their own privacy policies and security standards.

Norelle does not necessarily receive or store your complete payment card details.

Information collected automatically

When you visit our website, certain information may be collected automatically, including:

• IP address;

• Browser type;

• Device type;

• Operating system;

• Pages viewed;

• Products viewed;

• Date and time of visits;

• Referring website or source;

• Shopping activity;

• Interactions with our website; and

• Cookie and similar technology information.

2. HOW WE USE YOUR PERSONAL DATA

We may process your personal data to:

• Process and fulfil your orders;

• Process payments;

• Arrange delivery;

• Send order and shipping confirmations;

• Manage your customer account;

• Provide customer support;

• Handle returns, refunds and complaints;

• Detect and prevent fraud or misuse;

• Maintain the security of our website;

• Comply with legal, accounting and regulatory obligations;

• Improve our website, products and services;

• Understand how customers use our website;

• Measure the effectiveness of our marketing;

• Personalise your shopping experience;

• Send marketing communications where permitted; and

• Display or measure relevant advertising where permitted by applicable law.

3. LEGAL BASES FOR PROCESSING

Under UK data protection law, we must have a lawful basis for processing your personal data.

Depending on the circumstances, we may rely on:

Performance of a contract — where processing is necessary to process your order, take payment, arrange delivery, manage returns or provide services you have requested.

Legal obligation — where we need to process information to comply with applicable laws, tax requirements, accounting obligations or lawful requests.

Legitimate interests — where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include fraud prevention, website security, customer service and certain business analytics.

Consent — where you have given us permission to process your information for a particular purpose, such as certain marketing communications or non-essential cookies.

Where processing is based on consent, you may withdraw your consent at any time.

4. ORDERS AND TRANSACTIONS

When you place an order with Norelle, we use the information necessary to:

• Confirm and process your purchase;

• Verify and process payment;

• Prepare and fulfil your order;

• Deliver your products;

• Communicate with you regarding your order;

• Handle returns and refunds;

• Provide after-sales support; and

• Prevent fraudulent transactions.

Providing certain information is necessary for us to fulfil your order. If you do not provide the required information, we may be unable to complete your purchase.

5. SHOPIFY

Our online store is hosted using Shopify.

Shopify may process certain personal information in connection with providing the ecommerce infrastructure and services used to operate our store.

Your information may therefore be processed by Shopify in accordance with its own privacy practices and applicable data protection requirements.

6. MARKETING COMMUNICATIONS

Where permitted by law, and depending on your preferences, Norelle may send you information about:

• New collections;

• New products;

• Promotions;

• Special offers;

• Discounts;

• Events; and

• Other Norelle news.

Where your consent is required, we will only send such communications after obtaining the appropriate consent.

You may unsubscribe from marketing emails at any time by using the unsubscribe link contained in our emails or by contacting us.

Unsubscribing from marketing communications will not prevent us from sending transactional or service-related messages, such as order confirmations, delivery updates or important information concerning your purchase.

7. COOKIES AND ONLINE TRACKING

Our website may use cookies and similar technologies.

Cookies are small files or pieces of information stored on your device that help websites operate and recognise certain information about your visit.

We may use cookies for purposes such as:

• Providing essential website functionality;

• Remembering your preferences;

• Maintaining your shopping basket;

• Understanding website usage;

• Analysing website performance;

• Measuring advertising effectiveness;

• Preventing fraud;

• Improving our services; and

• Providing personalised advertising where permitted.

Where required by applicable law, non-essential cookies and similar tracking technologies will only be used after obtaining your consent.

You can manage your cookie preferences through the cookie controls available on our website where provided.

8. ADVERTISING AND ANALYTICS

Subject to your consent where required, we may use advertising, analytics and measurement services provided by third parties.

These services may use cookies, pixels and similar technologies to understand how visitors interact with our website, measure advertising campaigns and provide more relevant advertising.

Depending on the tools used by Norelle, information may be processed by advertising and analytics providers such as Meta, Google or other service providers.

You can manage applicable tracking preferences through our cookie consent tools.

9. HOW WE SHARE PERSONAL DATA

We may share personal data with trusted third parties where necessary to operate our business and provide our services.

These may include:

• Shopify and ecommerce service providers;

• Payment processors;

• Banks and payment networks;

• Delivery and logistics companies;

• Warehousing and fulfilment providers;

• Customer service providers;

• Email and communication providers;

• IT and hosting providers;

• Analytics providers;

• Advertising and marketing platforms;

• Fraud prevention and security providers;

• Professional advisers such as accountants or legal advisers; and

• Government authorities or regulators where required by law.

We only share information where necessary and subject to appropriate legal and contractual safeguards where applicable.

Norelle does not sell your personal data.

10. INTERNATIONAL DATA TRANSFERS

Some of our service providers may process personal data outside the United Kingdom.

Where personal data is transferred internationally, we take appropriate steps where required to ensure that the information receives an adequate level of protection in accordance with UK data protection law.

Depending on the destination and service provider, these safeguards may include UK adequacy regulations, approved contractual safeguards or other lawful transfer mechanisms.

11. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to fulfil contractual, legal, accounting and regulatory obligations.

The appropriate retention period may depend on:

• The type of information;

• Why it was collected;

• Whether you maintain an account with us;

• Legal and regulatory requirements;

• Fraud prevention requirements; and

• Whether information may be required to establish, exercise or defend legal claims.

When personal information is no longer required, we may securely delete or anonymise it.

12. SECURITY

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include access controls, secure technologies and other organisational and technical safeguards.

However, no internet transmission or electronic storage system can guarantee absolute security.

You are responsible for keeping any account credentials and passwords confidential.

13. YOUR PRIVACY RIGHTS

Under UK data protection law, you may have rights in relation to your personal data, including the right to:

• Request access to your personal data;

• Request correction of inaccurate or incomplete information;

• Request deletion of your personal data in certain circumstances;

• Request restriction of processing;

• Object to certain processing;

• Request data portability where applicable;

• Withdraw consent where processing is based on consent; and

• Object to direct marketing.

Some of these rights are subject to legal conditions and exceptions.

We may need to verify your identity before processing certain privacy requests.

To exercise your rights, please contact us using the details provided below.

You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator, if you believe your personal data has been processed in breach of applicable data protection law.

14. CHILDREN'S PRIVACY

Our online store is not intended for children.

We do not knowingly collect personal data from children in circumstances where doing so would be contrary to applicable data protection law.

If we become aware that personal information has been collected improperly from a child, we will take appropriate steps to delete or otherwise handle that information in accordance with applicable law.

15. THIRD-PARTY LINKS

Our website may contain links to websites, services or platforms operated by third parties.

Once you leave our website or interact directly with a third-party service, that third party's privacy policy and terms may apply.

Norelle is not responsible for the privacy practices of independent third-party websites or services.

We encourage you to review their privacy policies before providing personal information.

16. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to our business, services, technologies, legal requirements or privacy practices.

When we make changes, we will publish the updated version on this page and update the "Last updated" date where appropriate.

We encourage you to review this Privacy Policy periodically.

17. CONTACT US

If you have questions about this Privacy Policy, wish to exercise your privacy rights or have concerns about how your personal data is handled, please contact:

Norelle

Email: [PRIVACY EMAIL]

Business address: [BUSINESS ADDRESS]

For privacy-related requests, please include sufficient information for us to identify your request and respond appropriately.