Privacy policy

Who we are

NasalFlow is a brand of Eastern Ridge Ltd (company number 12260340), 124 City Road, London, EC1V 2NX, United Kingdom. We are the data controller for the personal information described in this policy, and we are registered with the Information Commissioner's Office (ICO) under registration number ZA922272.

For any privacy question or request, email contact@nasalflow.co.uk.

What we collect and why

When you place an order

Checkout is handled by our payment processor, Stripe. We receive your name, email address, delivery address, the products and delivery option you chose, and payment status. Stripe processes your card details; we never see or store your full card number.

We use this information to take payment, send and deliver your order, send receipts and handle cancellations, returns and refunds. Our lawful basis is that it's necessary to perform our contract with you. We also keep order records to meet our tax and accounting obligations, which is a legal obligation.

When you contact us

If you use our contact form or email us, we collect your name, email address, any order number you give us and the content of your message. We use it to reply and help with your enquiry. Our lawful basis is our legitimate interest in answering customer questions, or performing our contract with you if your enquiry is about an order.

When you visit our website

Our hosting provider automatically records technical information such as your IP address, browser type and the pages you request, in server logs. We use this to keep the website secure and working properly, which is in our legitimate interests.

We only use website analytics (Google Analytics) if you accept analytics cookies in our cookie banner. Our lawful basis is your consent. See Cookies below.

We don't use your information for marketing emails, we don't sell it, and we don't use it to make automated decisions about you.

Who we share it with

We only share your information with organisations that help us run our business, and only as much as they need:

• Stripe, to process payments and prevent fraud.
• Our website and email hosting provider (Hostinger), which stores our website and email.
• Delivery and fulfilment partners, such as Royal Mail or other couriers, and Amazon's Multi-Channel Fulfilment service if we use it to send your order. They receive your name and delivery address.
• Google, if you consent to analytics cookies.
• Our professional advisers, such as our accountant, where needed.
• Authorities such as HMRC or the police, where the law requires it.

International transfers

Some of these providers, such as Stripe and Google, may process information outside the UK, including in the United States. Where this happens, the transfer is protected by UK adequacy regulations or by approved safeguards such as the UK International Data Transfer Agreement or Addendum.

How long we keep it

• Order records: 6 years from the end of the financial year in which you ordered, as required for tax and accounting purposes.
• Enquiries: up to 2 years after we last hear from you, unless they relate to an order, in which case we keep them with the order record.
• Server logs: for the period set by our hosting provider, typically a few weeks.
• Analytics data: if you consent, up to 14 months.

Cookies

Our website uses only what is strictly necessary for it to work, plus Google Analytics cookies if you accept them. Google Analytics tells us, in aggregate, how many people visit, which pages they view, how they found us and whether they click through to buy. We have switched off Google's advertising features, so this information isn't used to target ads at you.

Analytics cookies (named _ga and _ga_ followed by an ID) are only set if you click "Accept" in our cookie banner. They last up to 2 years, and the data is kept for up to 14 months. You can change your choice at any time using "Cookie settings" at the bottom of every page.

When you go to checkout, Stripe's payment page sets its own cookies to process your payment securely and prevent fraud. These are covered by Stripe's privacy policy. If you follow a link to Amazon, Amazon's own privacy and cookie policies apply.

Your rights

Under UK data protection law, you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use your information;
• object to us using your information on the basis of legitimate interests;
• ask us to transfer your information to another organisation;
• withdraw your consent at any time, where we rely on consent.

Some of these rights have limits. For example, we must keep order records for tax purposes even if you ask us to delete them. To make a request, email contact@nasalflow.co.uk. It's free, and we'll respond within one month.

Complaints

If you're unhappy with how we've handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Keeping your information safe

Our website uses a secure (HTTPS) connection, payments are handled by Stripe, and we limit access to your information to those who need it. No method of sending information over the internet is completely secure, but we take reasonable steps to protect it.

Children

Our website and products are not aimed at children, and you must be 18 or over to place an order. We don't knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. The latest version will always be on this page.