Privacy policy

Last updated: 2026-06-27

This Privacy Policy explains how NORTHWELL GROUP LTD ("we", "us", "our"), trading as Naldony (the "Store"), collects, uses, shares and protects your personal data when you visit www.naldony.com or buy from us. We act as the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

  • Legal name: NORTHWELL GROUP LTD
  • Trading as: Naldony
  • Companies House number: 17075470
  • Registered office: 128 City Road, London, EC1V 2NX, United Kingdom
  • Email: support@naldony.com
  • Phone: +44 20 8040 3375
  • Supervisory authority: Information Commissioner's Office (ICO) — ico.org.uk

2. What personal data we collect

When you place an order, create an account or contact us, we collect:

  • Identity data: first name, last name
  • Contact data: billing address, delivery address, email address, telephone number
  • Order data: items purchased, order value, order history
  • Payment data: card type, last four digits, billing address (full card details are processed directly by Shopify Payments / Stripe and never stored on our servers)
  • Communications data: the content of emails, messages and call records with our support team
  • Technical data: IP address, browser type and version, time zone, operating system, device identifiers
  • Usage data: pages visited, products viewed, time spent on the Store, referring URL, search terms
  • Marketing data: marketing preferences (where you have given consent)

We do not intentionally collect special category data (health, religion, biometric, etc.) and do not collect SMS marketing data — we do not run SMS marketing.

3. Why we collect it and the legal basis

Purpose Legal basis (UK GDPR Art. 6)
Process and deliver your order, manage returns and refunds Contract (Art. 6(1)(b))
Provide customer support and respond to enquiries Contract / legitimate interests
Comply with tax, accounting and consumer-protection law Legal obligation (Art. 6(1)(c))
Detect and prevent fraud, payment chargebacks and abuse Legitimate interests (Art. 6(1)(f))
Send marketing emails about new candles and offers Consent (Art. 6(1)(a)) — withdrawable at any time
Analyse Store traffic to improve product range and UX Consent for analytics cookies / legitimate interests

4. How long we keep your data

  • Order and invoice records: 6 years (UK tax law — HMRC requirement)
  • Customer account data: until you ask us to delete it, or 3 years of inactivity (whichever is sooner)
  • Marketing consent records: until you unsubscribe or withdraw consent
  • Support correspondence: 3 years from last contact
  • Server logs and analytics: up to 26 months (Google Analytics default)

5. Who we share your data with (processors and recipients)

We share your data only with the providers we need to run the Store. Each is bound by a written data-processing agreement under UK GDPR Art. 28:

  • Shopify International Limited (Ireland) — e-commerce platform that hosts the Store, processes orders and stores customer accounts
  • Shopify Payments / Stripe Payments UK Ltd — payment processor (PCI DSS Level 1 certified)
  • Klarna Bank AB (UK Branch) — buy-now-pay-later provider (only when you choose Klarna at checkout)
  • Royal Mail Group plc, DPD UK, Evri (Hermes UK), UPS UK — delivery carriers (we share name, delivery address and phone)
  • Google LLC — Google Analytics 4 and Google Ads conversion tracking (only with your cookie consent)
  • Vitals (Shopify App) — product reviews and visitor session recording
  • Simprosys Infomedia — Google Shopping product feed sync
  • 123Track Order (Shopify App) — order tracking page
  • Shopify Email — transactional and (where you have consented) marketing emails
  • Accountants and tax advisors — to meet HMRC and Companies House obligations
  • Public authorities — where we are legally required to disclose (court order, regulatory request)

Naldony does not sell, rent, trade or otherwise commercialise your personal data or contact information to third parties. We share data only with the providers listed above, strictly as needed to fulfil your order, support you, run the Store, and comply with the law.

6. International data transfers

Some of our providers (e.g. Shopify, Google) may transfer your data outside the United Kingdom. Where this happens, transfers rely on one of:

  • the UK's adequacy regulations for the recipient country, or
  • the UK International Data Transfer Agreement (IDTA), or
  • the EU Standard Contractual Clauses with the UK Addendum.

We apply additional technical and organisational measures (encryption in transit, access controls) to maintain a level of protection equivalent to UK GDPR.

7. Your rights under UK GDPR

You have the right to:

  • Access the personal data we hold about you (Subject Access Request)
  • Rectify inaccurate or incomplete data
  • Erase your data ("right to be forgotten"), subject to legal retention obligations
  • Restrict processing in certain circumstances
  • Object to processing based on legitimate interests, including direct marketing
  • Data portability — receive your data in a structured, machine-readable format
  • Withdraw consent at any time, where processing is based on consent (does not affect lawfulness of prior processing)
  • Lodge a complaint with the ICO at ico.org.uk/make-a-complaint or 0303 123 1113

To exercise any of these rights, email support@naldony.com. We respond within 1 business day and complete substantive requests within 1 month.

8. Cookies

We use the built-in Shopify cookie consent banner to obtain your consent for non-essential cookies (analytics, marketing). Strictly necessary cookies (cart, checkout, security) do not require consent and cannot be disabled.

You can change your cookie preferences at any time via the cookie banner or your browser settings.

9. Security

We protect your data with industry-standard measures: TLS/SSL encryption in transit, encrypted storage at rest (Shopify's infrastructure), Two-Factor Authentication on staff accounts, restricted access on a need-to-know basis, and PCI DSS Level 1 compliance for card payments.

10. Children's data

The Store is not intended for children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have, please email us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time (for legal compliance or service changes). The "Last updated" date at the top reflects the latest version. Material changes will be notified via email to registered customers.

12. Contact

For any privacy question, complaint or rights request:

You may also contact the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.