Privacy policy
We collect as little about you as we can get away with, we do not sell any of it, and everything below is written so you can actually tell what happens to your details. This policy covers the website at nelabags.com and anything you buy through it.
Who we are
Nela
Email: hello@nelabags.com
What we collect
When you place an order. Your name, email address, delivery and billing address, phone number if you give one, and the contents of your order. Payment card details are entered directly with our payment processor and are never stored on our systems or seen by us — we only receive confirmation that a payment succeeded, along with the card type and last four digits.
When you browse. Your IP address, browser and device type, operating system, time zone, referring page, and which pages you looked at. This arrives automatically through cookies and similar technologies.
When you contact us. Whatever you put in your message, plus your email address so we can reply.
When you subscribe. Your email address, and nothing else, unless you choose to give us more.
Why we have it
- To take your order, charge you the right amount, and get the parcel to the right door
- To email you about your order — confirmation, dispatch, tracking, and delivery
- To answer you when you write to us, and to handle returns and warranty claims
- To detect and prevent fraud and to keep the site working
- To understand which pages people actually use, so we can fix the ones they do not
- To send you marketing email, but only if you asked us to
The legal grounds are: performing our contract with you (orders, delivery, returns), our legitimate interests (security, fraud prevention, understanding how the site is used), your consent (marketing and non-essential cookies), and legal obligation (tax and accounting records).
Who else sees it
Only the companies that make an order possible, and only the part they need:
- Shopify — hosts the store and processes orders on our behalf
- Payment processors — handle the transaction and the fraud checks that go with it
- Carriers and fulfilment — receive your name and address so they can deliver
- Email and analytics providers — send our order emails and tell us how the site performs
Each of them is bound to use your data only for that purpose. We do not sell your personal information, and we do not rent or trade it. We will only hand data to a public authority where the law requires it.
Some of these providers operate outside your country. Where data moves internationally it is protected by standard contractual clauses or an equivalent safeguard.
Cookies
Cookies are small files a site stores in your browser. We use:
- Essential cookies — keep you signed in and keep your cart from emptying itself. The site cannot work without these.
- Analytics cookies — count visits and show us which pages are used.
- Marketing cookies — measure whether our advertising reaches the right people.
You can refuse or delete cookies in your browser settings at any time. If you block the essential ones, checkout will stop working.
How long we keep it
Order records are kept for as long as tax and accounting law requires, which is generally seven years. Marketing consent is kept until you withdraw it. Support emails are kept for two years so we can pick up a thread if you write again. Everything else is deleted once it has served the purpose it was collected for.
Your rights
Wherever you live, you can ask us to:
- Tell you what personal information we hold about you
- Correct anything that is wrong
- Delete it, where we are not legally required to keep it
- Send you a portable copy
- Stop or limit how we use it
- Stop sending you marketing — every marketing email has an unsubscribe link, and it works immediately
If you live in California, the CCPA and CPRA give you the right to know what we collect and why, to request deletion or correction, to opt out of the sale or sharing of personal information, and not to be treated differently for exercising any of those rights. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of, but the right stands.
If you live in the EU or UK, you have the rights above under the GDPR, and you may also complain to your national supervisory authority.
To exercise any of these, email hello@nelabags.com. We answer within 30 days and we may ask you to confirm your identity first, so that we are not handing your data to somebody else.
Keeping it safe
The site runs over an encrypted connection, payment details are handled by PCI-compliant processors, and access to order data is limited to the people who need it to do their job. No system is perfect, but if a breach ever affects your personal data we will tell you and the relevant authority within the time the law allows.
Children
This store is not intended for anyone under 16, and we do not knowingly collect information from children. If you believe a child has given us personal data, write to us and we will delete it.
Changes
If this policy changes, the revised version appears on this page with a new date at the top. Where a change is significant, we will tell subscribers by email rather than hoping they notice.
Contact
Questions about any of this go to hello@nelabags.com. A person answers, usually the same day.