NERVILLA — PRIVACY POLICY

Last Updated: May 2026

Your Privacy, Protected

At Nervilla, your trust is everything. We treat your personal information with the same care we put into every product we ship — securely, transparently, and only for purposes you understand and agree to.

This Privacy Policy explains exactly what information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over your data. We've written it to be as clear and readable as possible — privacy shouldn't require a law degree to understand.

Nervilla is operated by a company registered in the United Kingdom and serves customers throughout New Zealand. We act as the data controller for personal information collected through nervilla.com.

This policy is governed by:

The Privacy Act 2020 (New Zealand) and its Information Privacy Principles
The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, where applicable to our UK-based operations

For any privacy enquiry, contact us at contact@nervilla.com. We respond within 1 business day.

At a Glance

What	Summary
Who we are	Nervilla, a UK-registered company serving New Zealand customers
What we collect	Contact details, order info, payment confirmation, technical/usage data
Why we collect it	To process orders, support you, prevent fraud, and improve our service
Who we share it with	Trusted service providers only — never sold to third parties
Your rights	Access, correction, deletion, marketing opt-out, complaint
How to reach us	contact@nervilla.com — within 1 business day

1. Who We Are

Nervilla ("we", "us", "our") is a brand operated by a company registered in the United Kingdom, with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

We operate nervilla.com and all related Services, including order processing, customer support, and marketing communications. We are the data controller responsible for the personal information you provide to us.

2. Personal Information We Collect

"Personal information" means any information that identifies you or can reasonably be linked to you as an individual under the Privacy Act 2020 (New Zealand) and the UK GDPR.

We collect the following categories of personal information:

Information you provide directly

Contact details: name, email address, phone number, shipping address, billing address
Order information: products purchased, order history, delivery preferences
Account information: username, password, account preferences (where an account is created)
Communications: any messages, support requests, reviews, or feedback you send us

Information collected automatically

Technical data: IP address, browser type, device identifiers, operating system, network connection
Usage data: pages visited, products viewed, links clicked, time spent on site, referral source
Cookies and tracking: see Section 12 below

Information from third parties

Payment confirmation: verification of successful payment from our payment processors — we do not store full card details on our systems
Marketing performance data: anonymised or aggregated advertising metrics from Meta, Google, and similar platforms (subject to their own privacy policies)
Service provider data: information shared by Shopify, our e-commerce platform, in the course of operating the Services

We do not knowingly collect sensitive personal information beyond what is strictly necessary to provide our Services.

3. How We Collect Personal Information

We collect personal information from these sources:

Directly from you — when you create an account, place an order, contact our support team, submit a review, or otherwise interact with our Services
Automatically — through cookies, tracking pixels, and similar technologies when you browse our website
From service providers — including Shopify (our e-commerce platform), payment processors, and fulfilment partners
From third parties — including marketing partners, analytics providers, and advertising networks, where permitted by applicable law

4. How We Use Your Personal Information

We collect and use your personal information only for purposes directly related to our functions and activities, or where you have given us consent, in line with the Privacy Act 2020 (NZ) and the UK GDPR.

We use your personal information to:

Order fulfilment and customer service

Process and fulfil your orders
Arrange shipping, delivery, returns, and exchanges
Send order confirmations, shipping updates, and delivery notifications
Provide customer support and resolve any issues

Account management

Create and maintain your account
Authenticate your identity and protect your account
Manage your communication preferences

Marketing and communications

Send promotional emails, product recommendations, and updates with your consent or where otherwise permitted by law
You may opt out at any time using the unsubscribe link in any marketing email or by emailing contact@nervilla.com

Personalisation

Tailor your shopping experience
Recommend products based on browsing and purchase history

Security and fraud prevention

Detect, investigate, and prevent fraudulent, unlawful, or harmful activity
Protect the integrity of our Services and the safety of our customers

Legal compliance

Comply with applicable legal obligations
Respond to lawful requests from regulatory or law enforcement authorities
Enforce our Terms of Service and other policies

Service improvement

Analyse how our Services are used
Improve our website, products, and customer experience

Lawful basis (UK GDPR, where applicable)

We rely on the following lawful bases under the UK GDPR:

Contract: to fulfil your order and provide our Services
Consent: for marketing communications and non-essential cookies
Legitimate interests: for fraud prevention, service improvement, and security
Legal obligation: for tax, accounting, and regulatory compliance

5. How We Disclose Your Personal Information

We do not sell or rent your personal information to third parties. We disclose your personal information only in the following circumstances:

Service providers

We share information with trusted third-party vendors who perform functions on our behalf, including:

Payment processing (PayPal, Shopify Payments, and similar)
Order fulfilment and shipping (our fulfilment partners and carriers, including NZ Post)
E-commerce platform (Shopify Inc.)
Email and marketing automation (our communications platform providers)
Analytics and advertising (Meta, Google, and similar — where permitted)
Customer service tools (helpdesk and chat platforms)
Cloud storage and IT infrastructure

These parties are contractually required to handle your information securely and only for the purposes we specify.

Shopify

Our Services are hosted on the Shopify platform. Shopify processes personal information as part of providing the technical infrastructure for our store. For full details, see Shopify's Privacy Policy at www.shopify.com/legal/privacy.

Marketing and advertising partners

Where you have consented or where permitted by applicable law, we may share certain information with advertising and analytics partners to deliver relevant advertising and measure campaign performance. You may opt out of targeted advertising at any time by contacting us.

Corporate transactions

In connection with a merger, acquisition, restructuring, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change in accordance with applicable law.

Legal and regulatory obligations

Where required to comply with a legal obligation, court order, or lawful request from a government or regulatory authority — or to protect the rights, property, or safety of Nervilla, our customers, or others.

With your consent

In any other circumstance where you have given us your express consent.

6. International Transfers of Personal Information

Nervilla is operated by a UK-registered company. Your personal information may be transferred to, stored in, or processed in countries outside New Zealand — including the United Kingdom, the European Economic Area, and other jurisdictions where Shopify's infrastructure and our service providers operate.

Under the Privacy Act 2020 (NZ), we take reasonable steps to ensure that any overseas recipients of your personal information protect it in a manner consistent with the principles of the Act.

Where personal information is transferred internationally, we apply appropriate safeguards, including:

Standard Contractual Clauses (where applicable under UK GDPR)
Adequacy decisions by the UK government or relevant authority
Contractual data protection commitments with all service providers

7. Your Rights

You have the following rights over your personal information.

Under the Privacy Act 2020 (New Zealand)

Right of access — you may request access to the personal information we hold about you. We will respond within 20 working days as required by law.
Right to correction — you may request that we correct any personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading.
Right to complain — you may make a complaint to the Office of the Privacy Commissioner if you believe we have breached the Privacy Act 2020.

Additional rights under UK GDPR (where applicable)

Right to erasure ("right to be forgotten") — you may request deletion of your personal information in certain circumstances
Right to restrict processing — you may request that we limit how we use your information
Right to data portability — you may request a copy of your information in a structured, machine-readable format
Right to object — you may object to processing based on legitimate interests or for direct marketing
Right to withdraw consent — where we rely on consent, you may withdraw it at any time

Marketing opt-out

You may unsubscribe from marketing communications at any time by:

Clicking the unsubscribe link in any marketing email
Emailing contact@nervilla.com

How to exercise your rights

Contact us at contact@nervilla.com. We will verify your identity before processing your request and respond within the timeframes required by applicable law. We will never penalise you for exercising your privacy rights.

8. Children's Privacy

Our Services are not directed at children under the age of 18. We do not knowingly collect personal information from minors.

If you believe a minor has provided us with their personal information without appropriate consent, please contact us at contact@nervilla.com and we will promptly delete it.

9. Security of Your Personal Information

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These include:

Industry-standard encryption for data transmission (SSL/TLS)
Secure payment processing through PCI-compliant providers
Access controls limiting employee access to personal information on a need-to-know basis
Regular security reviews of our systems and service providers

However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security and recommend that you do not transmit sensitive information through unsecured channels.

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify you and the relevant authorities as required by law.

10. Retention of Personal Information

We retain your personal information only for as long as necessary to fulfil the purposes set out in this Privacy Policy, unless a longer retention period is required by applicable law (including tax, accounting, and consumer protection obligations).

Typical retention periods:

Type of information	Retention period
Order and transaction records	7 years (for tax and accounting compliance)
Customer support communications	3 years from last contact
Marketing data	Until you unsubscribe, plus a short retention period
Account information	While your account is active, plus 2 years
Cookies and tracking	See Section 12

When personal information is no longer required, we securely delete or anonymise it.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to:

Operate and secure our Services
Remember your preferences and cart contents
Analyse how our Services are used
Deliver relevant advertising (with your consent)

You can manage your cookie preferences through:

The cookie banner displayed on your first visit
Your browser settings (most browsers allow you to refuse, accept, or delete cookies)
The opt-out tools provided by individual advertising networks

For full details, see our Cookie Policy on the website.

12. Third-Party Links

Our Services may contain links to third-party websites or platforms. We are not responsible for the privacy practices or content of those websites.

We recommend reviewing the privacy policies of any third-party site you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs.

When we make material changes, we will:

Update the "Last Updated" date at the top of this page
Notify you by email or prominent notice on our website where required by law

Your continued use of our Services following any update constitutes your acceptance of the revised policy.

14. Contact Us and Complaints

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or wish to make a complaint about how we have handled your personal information, please contact us:

Email: contact@nervilla.com Response Time: Within 1 business day Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

If you are not satisfied with our response, you may escalate your concern to the relevant supervisory authority:

New Zealand: Office of the Privacy Commissioner — www.privacy.org.nz
United Kingdom: Information Commissioner's Office (ICO) — www.ico.org.uk

This Privacy Policy was last updated in May 2026 and applies to all customers accessing our Services from the date of publication.