Privacy Policy
Last updated: 30/08/26
This Privacy Policy explains how No Nasties collects, uses, shares and protects your personal information.
We have tried to write it like normal people. Unfortunately, privacy law still requires quite a lot of words.
1. WHO WE ARE
No Nasties is the trading name of:
Legal name: [FULL LEGAL NAME]
Business structure: [LIMITED COMPANY / SOLE TRADER / PARTNERSHIP]
Company number: [COMPANY NUMBER, IF APPLICABLE]
Registered address: [REGISTERED OR PRINCIPAL BUSINESS ADDRESS]
Email: [PRIVACY EMAIL ADDRESS]
For data protection purposes, we are the controller of the personal information described in this policy. That means we decide why and how that information is used.
In this policy, “No Nasties”, “we”, “us” and “our” refer to the business identified above.
2. THE INFORMATION WE COLLECT
Depending on how you interact with us, we may collect the following information.
Information you give us
This may include:
your name;
your email address;
your telephone number;
your billing and delivery addresses;
your order details;
information you provide when contacting us;
newsletter preferences and consent;
survey, review or feedback responses; and
anything else you choose to include in a message to us.
Please do not send us sensitive personal information unless we have specifically asked for it and explained why it is needed.
Payment information
Payments are handled by [PAYMENT PROCESSOR].
We may receive limited information about your payment, such as whether it was successful, the payment method used and a transaction reference. We do not ordinarily receive or store your complete payment-card details.
Information collected automatically
When you visit our website, we may collect:
your IP address;
browser and device information;
approximate location derived from your IP address;
pages viewed and actions taken;
dates, times and duration of visits;
referring website information;
shopping-basket activity; and
cookie identifiers and similar technical information.
Some of this information is collected through cookies and similar technologies. More on those later. They always get their own section.
3. WHERE WE GET YOUR INFORMATION
We normally collect information:
directly from you;
when you place or attempt to place an order;
when you join our newsletter;
when you contact us;
through your use of our website;
from payment, delivery and ecommerce providers involved in your order; and
from analytics, advertising or social-media providers where you have allowed the relevant cookies or integrations.
If somebody orders something for you, we may receive your name, delivery address and contact details from that person.
4. HOW AND WHY WE USE YOUR INFORMATION
We only use personal information when we have a lawful reason to do so.
To process and deliver orders
We use relevant identity, contact, transaction and delivery information to:
accept and manage orders;
take payment;
deliver products;
send order and delivery updates;
deal with cancellations, returns and refunds; and
provide customer support.
Our lawful basis is normally that processing is necessary to perform our contract with you or to take steps at your request before entering into a contract.
If you do not provide the information required at checkout, we may be unable to process or deliver your order. Mayonnaise has many talents. Guessing postal addresses is not one of them.
To provide customer service
We use your information to answer questions, investigate problems, handle complaints and respond to requests.
Our lawful basis may be:
performance of our contract with you;
compliance with a legal obligation; or
our legitimate interest in providing effective customer service and protecting our business.
To operate and improve our website
We may use technical, usage and correspondence information to:
maintain and secure the website;
identify technical problems;
understand how visitors use it;
improve its performance, content and design;
prevent fraud or misuse; and
develop our products and services.
Our lawful basis is normally our legitimate interest in operating, securing and improving our business.
Where cookies or similar technologies require consent, we rely on your consent instead.
To send the newsletter
If you actively sign up, we use your name, email address and marketing preferences to send the No Nasties newsletter.
One email a week is the current plan. Mostly us complaining about seed oils. Occasionally there may even be mayonnaise.
Our lawful basis is your consent.
You can unsubscribe at any time by:
selecting the unsubscribe link in any newsletter; or
emailing [PRIVACY EMAIL ADDRESS].
Withdrawing consent does not make earlier processing unlawful. It simply means we must stop using your information for that purpose.
To meet our legal obligations
We may use and retain information when necessary to:
maintain tax and accounting records;
comply with food-safety or product-traceability requirements;
respond to regulators, courts or public authorities;
establish or defend legal claims; and
comply with other legal obligations applying to our business.
Our lawful basis is compliance with a legal obligation or, where appropriate, our legitimate interest in protecting our legal rights.
To prevent fraud and protect the business
We may use information to detect suspicious activity, protect accounts, investigate fraud, enforce our terms and protect our customers, systems and business.
Our lawful basis is our legitimate interest in protecting our business and customers.
5. LEGITIMATE INTERESTS
Where we rely on legitimate interests, we consider:
what benefit the processing provides;
whether the processing is necessary;
the potential effect on your privacy; and
whether your rights and interests override ours.
You may object to processing based on legitimate interests. See the section about your rights below.
6. NEWSLETTERS AND MARKETING
We do not sell your personal information to other companies for their marketing.
If you join our newsletter, we may send you:
company and product updates;
launch information;
offers;
editorial content;
surveys or feedback requests; and
occasional observations about the state of modern food.
You can withdraw your consent at any time. Every marketing email should include an unsubscribe option.
We may retain a minimal suppression record after you unsubscribe. This helps us make sure we do not accidentally add you straight back to the list.
Service messages about an existing order are not marketing. We may still send those when necessary to fulfil your order or deal with a problem.
7. COOKIES
Cookies are small files or identifiers placed on or accessed through your device.
We may use:
Strictly necessary cookies
These are required for functions such as:
website security;
remembering what is in your bag;
processing checkout;
maintaining a session; and
remembering your privacy choices.
These cookies do not normally require consent because the website cannot provide the requested service properly without them.
Analytics cookies
These help us understand how visitors use the website and how it could be improved.
Where required by law, we only use these after you have given consent.
Advertising or social-media cookies
These may be used to measure advertising, personalise content or connect the website with social-media services.
Where required by law, we only use these after you have given consent.
You should be able to accept or reject non-essential cookies and change your preferences later.
Further details about the cookies currently used should be included in our [COOKIE POLICY / COOKIE SETTINGS TOOL].
8. WHO WE SHARE INFORMATION WITH
We may share personal information with trusted organisations that help us operate the business, including:
our website, ecommerce and customer-management provider, currently HighLevel/LeadConnector;
[PAYMENT PROCESSOR];
[COURIER OR DELIVERY PROVIDERS];
[FULFILMENT OR WAREHOUSE PROVIDER];
[MANUFACTURING OR PRODUCT-TRACEABILITY PARTNERS, WHERE RELEVANT];
email and newsletter providers;
website hosting and technical-support providers;
analytics providers where the relevant cookies have been accepted;
accountants, lawyers, insurers and professional advisers;
fraud-prevention and security providers;
regulators, courts, law-enforcement bodies or public authorities where legally required; and
a purchaser, investor or adviser if all or part of the business is sold, reorganised or financed.
These organisations may only use the information for the relevant service, their own lawful purposes or where the law otherwise allows them to do so.
We do not sell lists of customer email addresses. That would be nasty.
9. INTERNATIONAL TRANSFERS
Some service providers may store or access personal information outside the United Kingdom.
When a restricted international transfer takes place, we take steps intended to ensure that an appropriate level of protection applies. Depending on the destination and provider, this may include:
UK adequacy regulations;
the UK International Data Transfer Agreement;
the UK International Data Transfer Addendum;
another legally recognised safeguard; or
a permitted legal exception where appropriate.
You can contact us at [PRIVACY EMAIL ADDRESS] for more information about the safeguards applying to relevant transfers.
10. HOW LONG WE KEEP INFORMATION
We do not keep personal information indefinitely just because digital storage is cheap.
Retention periods depend on:
why we collected the information;
whether it is still needed;
legal, accounting and food-traceability requirements;
the risk of keeping it;
possible disputes or legal claims; and
whether you have asked us to delete it.
We expect to use the following general periods:
Order and transaction records: normally up to six years after the relevant transaction or financial period;
Customer-service correspondence: normally up to [TWO YEARS] after the matter is closed, unless it relates to a dispute, safety issue or legal claim;
Newsletter information: until you unsubscribe or we close the newsletter, followed by a limited suppression record where needed;
Product-safety and traceability records: for the period required by applicable law and our food-safety procedures;
Cookie and analytics information: according to the lifespan stated in our cookie settings or by the relevant service provider;
Unfinished forms or abandoned enquiries: [INSERT ACTUAL RETENTION PERIOD].
We may retain information for longer where required by law, a regulator, an insurer or a continuing legal claim.
11. HOW WE PROTECT INFORMATION
We use reasonable organisational and technical measures intended to protect personal information against:
unauthorised access;
loss;
misuse;
alteration;
disclosure; and
destruction.
These measures may include access controls, secure service providers, staff restrictions, backups, authentication and encrypted connections.
No internet service can promise absolute security. However, “the internet is difficult” is not a security policy, so we take reasonable precautions and review them as the business develops.
12. YOUR RIGHTS
Depending on the circumstances and the lawful basis used, you may have the right to:
access personal information we hold about you;
correct inaccurate or incomplete information;
request deletion of your information;
restrict how your information is used;
object to certain uses of your information;
receive or transfer certain information in a portable format;
withdraw consent where processing is based on consent; and
complain about how your information has been handled.
These rights are not absolute. In some cases, the law allows or requires us to continue retaining or using information.
Your right to object
You have the right to object at any time to the use of your personal information for direct marketing.
You may also object to processing based on our legitimate interests. We will stop that processing unless we have a compelling lawful reason to continue or the information is needed for a legal claim.
To exercise a right, email [PRIVACY EMAIL ADDRESS].
We may need to ask for enough information to confirm your identity. This is to prevent somebody else from requesting or deleting your information while pretending to be you.
We normally respond within one month, although the law allows additional time for particularly complicated or numerous requests.
13. AUTOMATED DECISIONS
We do not currently make decisions about you based solely on automated processing where those decisions produce legal or similarly significant effects.
We may use automated tools for routine activities such as fraud screening, checkout security or email delivery. Where appropriate, a human can review relevant decisions.
If this changes, we will update this policy and provide any additional information required by law.
14. CHILDREN
Our website and products are not directed specifically at children, and we do not knowingly collect personal information directly from children for newsletter marketing.
If you believe a child has provided us with personal information improperly, contact [PRIVACY EMAIL ADDRESS].
15. THIRD-PARTY LINKS
Our website may contain links to websites or services operated by other organisations.
We do not control their privacy practices. Their own privacy policies apply when you use those services.
16. CHANGES TO THIS POLICY
We may update this Privacy Policy when:
our website or services change;
we use a new supplier;
our data practices change; or
the law or regulatory guidance changes.
The latest version will appear on this page with an updated date.
If a change significantly affects how we use information already collected, we will provide further notice where required.
17. COMPLAINTS
Please contact us first if you have concerns about how we use your personal information. We would rather fix a problem than exchange increasingly formal emails about it.
You also have the right to complain to the UK Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
18. CONTACT US
Questions, requests or complaints about privacy can be sent to:
No Nasties / [FULL LEGAL NAME]
[REGISTERED OR PRINCIPAL BUSINESS ADDRESS]
[PRIVACY EMAIL ADDRESS]
No smoke signals. The data trail is terrible.