Privacy policy

Last updated: 6 September 2026

This Privacy Policy explains how NUALA CORK collects, uses, shares and protects your personal information when you visit our website, buy from us, or communicate with us.

Please read it carefully. If you have questions about anything in it, contact us at info@nualacork.com.

1. Personal information we collect

Depending on how you interact with us, we may collect:

Contact details — your name, email address, phone number, billing address and shipping address.
Order and payment information — the items you buy, order value, transaction history, delivery details, payment method, and payment confirmation. We do not store full card numbers; card details are handled directly by our payment providers.
Account information — your username, password (stored in encrypted form), saved addresses and preferences, if you create an account.
Communications — the content of emails, contact form messages and social media messages you send us, including any photographs you send in support of a return or complaint.
Device and technical information — your IP address, browser type, device type, operating system, and unique identifiers set by cookies.
Usage information — the pages you view, products you look at or add to your basket, how you arrived at our site, and how you move through it.

2. Where we collect it from

Directly from you, when you place an order, create an account, sign up to our newsletter, or contact us.
Automatically, through cookies and similar technologies when you use the site (see Section 6).
From our service providers, such as Shopify, our payment processors and our shipping carriers, who pass us information relating to your order.

3. How we use your information, and our legal basis

Under the GDPR we must have a lawful basis for each use of your personal information. Ours are:

To fulfil your order — processing payment, preparing and shipping your goods, handling returns, refunds and exchanges, and keeping you updated on your order status. Legal basis: performance of a contract with you (Article 6(1)(b)).

To manage your account — creating and maintaining your account, saving your preferences and addresses. Legal basis: performance of a contract with you (Article 6(1)(b)).

To answer your questions and provide customer support. Legal basis: performance of a contract, or our legitimate interest in maintaining a good relationship with our customers (Articles 6(1)(b) and 6(1)(f)).

To send marketing emails and show you advertising — see Section 5. Legal basis: your consent (Article 6(1)(a)), or, where you are an existing customer and the products are similar to what you bought, our legitimate interest in marketing to our own customers (Article 6(1)(f)).

To prevent fraud and keep the site secure — verifying orders, detecting suspicious activity, protecting against unauthorised access. Legal basis: our legitimate interest in protecting our business and our customers, and compliance with legal obligations (Articles 6(1)(f) and 6(1)(c)).

To improve our shop — understanding which products and pages perform well, fixing problems, and developing our range. Legal basis: your consent, where this relies on non-essential cookies; otherwise our legitimate interest in improving what we offer (Articles 6(1)(a) and 6(1)(f)).

To keep accounting and tax records. Legal basis: compliance with a legal obligation (Article 6(1)(c)).

To establish, exercise or defend legal claims, and to respond to lawful requests from authorities. Legal basis: compliance with a legal obligation, and our legitimate interest in defending our rights (Articles 6(1)(c) and 6(1)(f)).

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms. You may object to this processing at any time — see Section 11.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

4. Marketing

We will only send you marketing emails if you have asked us to, or if you have bought from us and we are telling you about similar products. Every marketing email contains an unsubscribe link, and you can also unsubscribe at any time by emailing info@nualacork.com.

If you unsubscribe, we will keep a record of your email address on a suppression list so that we do not contact you again by mistake. We will still send you emails about orders you have placed — these are not marketing and you cannot opt out of them while an order is in progress.

Advertising on other platforms, including any personalised or retargeted advertising, relies on non-essential cookies and only takes place if you have consented through our cookie banner.

5. Cookies and similar technologies

Cookies are small files stored on your device. We use:

Strictly necessary cookies — required for the site to work, such as keeping items in your basket, keeping you logged in and processing payment securely. These do not require consent.
Analytics cookies — helping us understand how the site is used.
Marketing and advertising cookies — used to measure the performance of our advertising and to show you relevant ads elsewhere.

Analytics and marketing cookies are only set after you consent through the cookie banner shown when you first visit. You can change or withdraw your choices at any time through the cookie settings link in our site footer, and you can also block or delete cookies through your browser settings — though blocking necessary cookies will stop parts of the site from working.

Full details of the individual cookies we use, their purpose and their lifespan are set out in our [Cookie Policy / cookie settings panel].

6. Who we share your information with

We share personal information only where necessary, and only with:

Shopify, which hosts our store and processes information about your use of it (see Section 8).
Payment providers, who process your payment and carry out fraud checks.
Shipping and fulfilment partners, who need your name and address to deliver your order.
Email, analytics and advertising providers, who help us run our communications and measure our marketing.
Professional advisers, such as our accountants and, if needed, our lawyers.
Public authorities, where we are legally required to disclose information.
A buyer or successor, if our business is sold, merged or reorganised.

We do not sell your personal information.

Each of these providers acts on our instructions under a written contract, or as an independent controller under its own privacy policy where that is the case.

7. Our use of Shopify

Our store is hosted by Shopify, which collects and processes information about your visit in order to provide and improve the service. Some Shopify features use data from your interactions with our shop together with data from other merchants.

For those features, Shopify acts as a controller in its own right and is responsible for handling requests relating to that data. You can read the Shopify Consumer Privacy Policy and exercise your rights with Shopify at privacy.shopify.com.

8. International transfers

Some of our service providers are based outside the European Economic Area, which means your personal information may be transferred to and stored in countries with different data protection rules.

Where that happens, we rely on one of the safeguards permitted by Chapter V of the GDPR — normally an adequacy decision of the European Commission, or the European Commission's Standard Contractual Clauses combined with additional measures where required. You can request a copy of the safeguards we rely on by emailing us.

9. How long we keep your information

Order, invoice and payment records — for [6 years in Ireland / 10 years in Portugal — insert the period required where the company is registered], as required by tax and accounting law.
Account information — for as long as your account is open, and for 2 years after your last activity, after which we delete or anonymise it.
Customer support correspondence — 3 years from the date the matter is closed.
Marketing consent records and unsubscribe records — for as long as we operate the mailing list, so that we can honour your choices and demonstrate compliance.
Cookie and analytics data — for the lifespan of each cookie, which is up to 24 months.
Fraud and security logs — 12 months.

Where information is needed for an ongoing legal claim, we keep it until the claim is resolved.

10. Your rights

Under the GDPR you have the right to:

Access the personal information we hold about you, and receive a copy of it.
Rectification — have inaccurate or incomplete information corrected.
Erasure — ask us to delete your information, where we have no continuing legal reason to keep it.
Restriction — ask us to pause our use of your information in certain circumstances.
Portability — receive information you gave us in a structured, machine-readable format, and have it transferred to another provider where technically feasible.
Object — object to processing based on our legitimate interests, and object to direct marketing at any time, which we will always honour.
Withdraw consent — where we rely on consent, withdraw it at any time. This does not affect processing carried out before you withdrew it.

To exercise any of these rights, email info@nualacork.com. We will respond within one month. If your request is complex we may extend this by up to two further months, and we will tell you if that happens.

We may ask you to confirm your identity before we act on a request. We will not charge you or treat you differently for exercising your rights.

11. Children

Our shop is not intended for children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us their information, contact us and we will delete it.

12. Security

We use appropriate technical and organisational measures to protect your information, including encrypted connections (HTTPS), restricted access to customer data, and payment processing handled entirely by certified providers.

No system is completely secure, and information sent over the internet is never entirely risk-free. Please do not send us sensitive information, such as full card details, by email.

If a data breach occurs that is likely to result in a high risk to your rights, we will notify you and the relevant supervisory authority as required by law.

13. Links to other websites

Our site may link to websites we do not control, including social media platforms. We are not responsible for their content or their privacy practices. Please read their own privacy policies before giving them your information.

14. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or in the law. We will post the updated version here and change the "Last updated" date at the top. Where the changes are significant, we will tell you directly.

15. Contact and complaints

For any question about this policy, or to exercise your rights:

NUALA CORK Email: info@nualacork.com

If you are unhappy with how we have handled your personal information, please tell us first so we can try to put it right.