Last updated: 20 October 2026
Norley ("we", "us", or "our") respects your privacy and is committed to protecting your personal data in strict compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations (PECR).
1. Data Controller & Contact Details
For the purposes of the UK GDPR and the Data Protection Act 2018, Norley is the Data Controller responsible for your personal data collected through our website.
- Trading Name: Norley
- Administrative Correspondence Address: Eaton Place, London, England, SW1X 8BP, United Kingdom
- Data Protection & Customer Care Email: corporationdvl@gmail.com
2. Personal Data We Collect
When you browse our store, place an order, or contact our Customer Care team, we collect only the personal data necessary to provide our services:
- Identity & Contact Data: First name, surname, email address, UK billing address, UK delivery address (including postcode), and telephone number (for courier delivery updates).
- Transaction & Payment Data: Details of products purchased, order totals in GBP (£), and payment confirmation identifiers processed securely via our encrypted payment gateways (PayPal Business, Apple Pay, Google Pay, or card processors). We never store or have access to your raw credit/debit card numbers.
- Technical & Usage Data: IP address, browser type, time zone setting, device type, and cookie preferences.
3. Lawful Bases for Processing Your Personal Data (Article 6 UK GDPR)
| Purpose of Processing | Category of Data | Lawful Basis (Article 6 UK GDPR) |
|---|---|---|
| Processing your order, payment, dispatch, and tracked UK delivery | Identity, Contact & Transaction Data | Performance of a Contract (Art. 6(1)(b)) |
| Handling customer support enquiries, returns (RMA), and statutory warranties | Identity, Contact & Transaction Data | Performance of a Contract & Legal Obligation (Art. 6(1)(b) & (c)) |
| Fraud prevention, network security, and store analytics | Technical, Usage & Transaction Data | Legitimate Interests (Art. 6(1)(f)) |
| Sending promotional newsletters, voucher codes, and non-essential marketing cookies | Contact & Technical Data | Explicit Consent (Art. 6(1)(a) & PECR Reg. 6/22) |
| Maintaining accounting, tax, and regulatory compliance records | Transaction & Identity Data | Legal Obligation (Art. 6(1)(c)) |
4. How We Share Your Data & International Transfers
We never sell your personal data to third parties. We share your data strictly on a need-to-know basis with trusted service providers who enable our operations:
- E-Commerce Platform: Our store is hosted by Shopify Inc., which processes data under UK adequacy regulations (Canada) and approved safeguards.
- Logistics, Couriers & Fulfilment Partners: We share your name, UK delivery address, postcode, and contact number with our fulfilment centres and last-mile couriers (such as Royal Mail and Evri) solely to deliver your parcel.
- International Data Transfers: Where personal data is accessed or processed outside the United Kingdom (including by our e-commerce infrastructure, remote administrative management in Brazil, or international fulfilment partners), we ensure appropriate safeguards are in place in accordance with Chapter V of the UK GDPR, including the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO).
5. Cookies & Marketing Communications (PECR Compliance)
- Cookie Control: Essential cookies are required for your shopping basket and checkout to function. Non-essential analytics and advertising cookies are only activated if you provide explicit consent via our cookie banner.
- Email Marketing Opt-Out: We only send promotional emails if you have opted in. You may withdraw your consent at any time by clicking the "Unsubscribe" link at the bottom of any promotional email or by emailing corporationdvl@gmail.com.
6. Data Retention
We retain order and transaction records for up to 6 years to comply with UK tax, accounting, and contractual limitation laws, after which they are securely anonymised or deleted.
7. Your Statutory Rights Under UK GDPR & How to Complain to the ICO
Under the UK GDPR, you have the right to:
- Request access to the personal data we hold about you (Subject Access Request);
- Request rectification of inaccurate or incomplete personal data;
- Request erasure ("right to be forgotten") of your personal data where there is no compelling legal reason for continued retention;
- Request restriction of processing or object to processing based on legitimate interests;
- Request data portability; and
- Withdraw consent at any time where processing relies on consent.
To exercise any of these rights, please email us at corporationdvl@gmail.com. We will respond within 30 calendar days.
Supervisory Authority (ICO): If you are unhappy with how we have handled your personal data, you have the statutory right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at https://ico.org.uk/make-a-complaint/ or by calling the ICO helpline on 0303 123 1113.