Privacy policy

<p>Last updated: 13 October 2026</p>

<p>This policy explains what personal information Neck Nest collects when you visit this store, place an order or contact us, what we do with it, who we share it with, and what rights you have.</p>

<p>For the purposes of the UK GDPR and the Data Protection Act 2018, the data controller is:</p>

<p>Neck Nest<br>
1 Chaddesley Terrace<br>
Swansea<br>
SA1 6HB<br>
United Kingdom<br>
Email: <a href="mailto:support@necknest.us">support@necknest.us</a></p>

<p>This store is hosted by Shopify Inc., which processes information about your use of the store in order to provide it to us, and which also acts as a controller in its own right for some of that processing. Shopify's own consumer privacy policy is at shopify.com/legal/privacy/app-users.</p>

<h2>WHAT WE COLLECT</h2>

<p><strong>You give us directly:</strong></p>

<p>- Your name, email address, delivery address, billing address and phone number when you order - The contents of any message you send us, including through our contact form - Your email address if you subscribe to marketing emails - Account details, if you create an account</p>

<p><strong>Collected automatically when you browse:</strong></p>

<p>- Your IP address, approximate location derived from it, device type, browser, operating system and language - Pages you viewed, what you searched for, what you added to your cart, and how you arrived at the store - Cookie and similar identifiers, subject to your consent where consent is required</p>

<p><strong>From our payment and delivery partners:</strong></p>

<p>- Confirmation that a payment succeeded or failed, the payment method type, and the last four digits and expiry of your card - Delivery and tracking status from the carrier - Fraud and risk signals used to screen orders</p>

<p>We never receive or store your full card number, and we never ask for it by email.</p>

<h2>WHAT WE DO NOT COLLECT</h2>

<p>We do not knowingly collect health information. Our products are comfort products, not medical devices, and we do not ask about your medical history. If you choose to tell us about a health condition in a support message, we use it only to answer you and we do not add it to any marketing profile.</p>

<p>We do not collect data from children. This store is not directed at children, and we do not knowingly collect information about anyone under 16. If you believe a child has given us their information, email us and we will delete it.</p>

<h2>WHY WE USE IT, AND OUR LAWFUL BASIS</h2>

<p>| What we do | Why | Lawful basis | |---|---|---| | Take and fulfil your order, arrange delivery, send order and delivery emails | To perform our contract with you | Contract | | Handle returns, refunds and warranty claims | To perform our contract and meet our legal obligations | Contract and legal obligation | | Answer your questions and provide support | To respond to you | Contract, or legitimate interests where you are not yet a customer | | Screen orders and payments for fraud | To protect the business and our customers | Legitimate interests, and legal obligation | | Keep accounting and tax records | Required by UK tax law | Legal obligation | | Send marketing emails | To tell you about products and offers | Consent, or the soft opt-in for existing customers of similar products | | Measure how the store is used and improve it | To run a functioning store | Consent for non-essential cookies, otherwise legitimate interests | | Show you advertising on other sites, including retargeting | To find and retain customers | Consent |</p>

<p>Where we rely on legitimate interests, we have considered your interests and rights and concluded that our processing does not override them. You can object at any time using the contact details above.</p>

<h2>MARKETING</h2>

<p>If you subscribe, or if you buy from us and we tell you at the time, we may email you about our products.</p>

<p>You can unsubscribe from any marketing email using the link in it, or by emailing us. We will stop, and we will keep a record of your objection so that we do not email you again by mistake.</p>

<p>Unsubscribing from marketing does not stop transactional emails about an order you have placed, such as a dispatch confirmation. Those are part of fulfilling your order.</p>

<h2>COOKIES AND TRACKING</h2>

<p>Essential cookies keep your cart and your session working and cannot be turned off without breaking the store.</p>

<p>Analytics and advertising cookies are only set where you consent through our cookie banner. You can change or withdraw your choice at any time through the cookie preferences link in the store footer.</p>

<p>If you visit with a Global Privacy Control signal enabled, we treat that as an opt-out of the sale or sharing of your personal information for that browser and device. We do not act on other "Do Not Track" signals, which have no agreed meaning.</p>

<p>Depending on where you live, you may have a right to tell us not to share information about you for targeted advertising. You can exercise that at https://necknest.us/pages/data-sharing-opt-out.</p>

<h2>WHO WE SHARE IT WITH</h2>

<p>We share personal information with service providers who need it to do a job for us, and we require them to protect it and use it only on our instructions:</p>

<p>- <strong>Shopify</strong>, for store hosting, checkout, order management and analytics - <strong>Payment providers</strong>, including Shopify Payments and any other method shown at checkout, for taking payment and screening fraud - <strong>Our supplier and fulfilment partner</strong>, who receives your name, delivery address and phone number in order to pack and dispatch your order - <strong>Carriers</strong>, who receive what they need to deliver your parcel and may pass your address and contact details to a customs authority as part of the import process - <strong>Email and marketing providers</strong>, for sending order and marketing emails - <strong>Analytics and advertising providers</strong>, where you have consented</p>

<p>We may also disclose information where we are required to by law, in response to a valid legal request, to establish or defend legal claims, or in connection with a sale or restructuring of the business.</p>

<p>We do not sell your personal information for money.</p>

<h2>INTERNATIONAL TRANSFERS</h2>

<p>Your information will be transferred outside the United Kingdom.</p>

<p>Our products are dispatched by a supplier based overseas, and our hosting, payment and email providers operate internationally. This means your delivery details and some account and usage data are processed in countries that may not have UK-equivalent data protection laws.</p>

<p>Where we transfer personal information out of the United Kingdom, we rely on UK adequacy regulations where they apply, or on the International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, together with any additional safeguards needed.</p>

<p>You can ask us for more detail on the transfers that affect your order.</p>

<h2>HOW LONG WE KEEP IT</h2>

<p>- Order, invoice and tax records: six years from the end of the financial year, as required by UK tax law - Customer account and contact records: for as long as you have an account, then up to two years of inactivity - Support correspondence: two years from the last message, or longer where a dispute or claim is open - Marketing subscription records: until you unsubscribe, and then a minimal record of your objection indefinitely so that we honour it - Analytics and advertising data: as set by the retention period of the relevant provider, generally no more than 26 months</p>

<p>When we no longer need information, we delete it or anonymise it.</p>

<h2>SECURITY</h2>

<p>Payments are processed over an encrypted connection by PCI DSS compliant providers, and we do not hold card numbers. Access to customer data is limited to those who need it.</p>

<p>No system is perfectly secure, and we cannot guarantee the security of information while it is in transit to us. Please do not send sensitive information by email. If there is a breach that is likely to risk your rights, we will tell you and the Information Commissioner's Office as the law requires.</p>

<h2>YOUR RIGHTS</h2>

<p>Subject to the conditions and exemptions in data protection law, you have the right to:</p>

<p>- Be told what personal information we hold about you and get a copy of it - Have inaccurate information corrected - Have information deleted, where we no longer have a reason to keep it - Restrict how we use it while a concern is resolved - Object to processing based on legitimate interests, and to direct marketing at any time, without needing a reason - Receive information you gave us in a portable, machine-readable form, and have it transferred to another provider where technically feasible - Withdraw consent at any time, where we rely on consent. Withdrawal does not affect processing already carried out - Not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you. We do not make such decisions; our fraud screening flags orders for a human to review</p>

<p>To exercise any of these, email <a href="mailto:support@necknest.us">support@necknest.us</a>. We will respond within one month. We may need to verify your identity first, and we may extend the deadline by two months for complex requests, in which case we will tell you why.</p>

<p>We will not treat you any differently for exercising these rights.</p>

<p>If you are in the European Economic Area, equivalent rights apply to you under the EU GDPR.</p>

<p>If you are in California, Colorado, Connecticut, Virginia or another US state with a comprehensive privacy law, you have rights to know, delete, correct and opt out of targeted advertising and the sale or sharing of your information, and a right to appeal a refused request. Use the contact details above, or the opt-out link in the cookies section.</p>

<p>If you are in Australia, Canada or New Zealand, your national privacy legislation gives you rights of access and correction, which you can exercise the same way.</p>

<h2>COMPLAINTS</h2>

<p>If you are unhappy with how we have handled your personal information, please contact us first so we can try to put it right.</p>

<p>You also have the right to complain to a data protection authority. In the United Kingdom that is the Information Commissioner's Office, ico.org.uk, telephone 0303 123 1113. In the European Economic Area you may complain to your national supervisory authority.</p>

<h2>CHANGES</h2>

<p>We may update this policy to reflect changes in how we operate or in the law. We will post the updated version here and change the "last updated" date. Where a change materially affects you, we will tell you.</p>

<h2>CONTACT</h2>

<p>Neck Nest<br>
1 Chaddesley Terrace<br>
Swansea<br>
SA1 6HB<br>
United Kingdom</p>

<p>Email: <a href="mailto:support@necknest.us">support@necknest.us</a></p>