Privacy policy

Last updated: 12 November 2026

Who is responsible for your data

The controller of your personal data is WADEE CLOTHING LIMITED, trading as NORVULANI, 104 Heol Emrys, Penlan, Swansea, SA5 7BH, United Kingdom. Email support@norvulani.com, phone +44 7907838451. This policy applies under the UK General Data Protection Regulation and the Data Protection Act 2018 and, for customers in the European Economic Area, under the EU General Data Protection Regulation (GDPR).

What we collect

• Order details: your name, delivery and billing address, email address, phone number, the items you order and your order history.
• Account details, if you create an account: your email address and password, which is stored in encrypted form.
• Payment details: handled by our payment providers. We receive confirmation of payment, the payment method type and, for cards, the last four digits and expiry date. We never see or store your full card number.
• Messages: what you send us by email, phone or through our forms, including withdrawal and return requests.
• Technical data: your IP address, browser type and the pages you request. Our server records these in standard logs for security. We also use your IP address to work out your country so we can show prices in your currency. This lookup happens on our own server using a country database, and the result is stored only in your shopping session.

Why we use it and our legal basis

Purpose	Legal basis
Taking, paying for, delivering and supporting your order, including returns and refunds	Performance of our contract with you
Running your customer account	Performance of a contract
Keeping order and accounting records	Legal obligation
Preventing fraud and keeping the website secure	Our legitimate interests in protecting our customers and our business
Showing prices in your local currency	Our legitimate interests in showing you relevant prices
Answering your questions and complaints	Our legitimate interests, or performance of a contract
Sending marketing emails, only if you have signed up	Your consent, which you can withdraw at any time using the unsubscribe link

You need to give us your name, address and email address to place an order; without them we cannot deliver it. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our payment providers screen payments automatically for fraud. If a payment is declined, you can contact us.

Who we share it with

• Hostinger, which hosts our website and its database.
• Our payment providers, Stripe for card payments and PayPal when you choose PayPal. They process payments and screen for fraud. PayPal also acts as an independent controller for your PayPal account.
• Our email service provider, which sends and stores our emails, including order confirmations.
• Delivery carriers and our fulfilment partners, who receive your name, address, phone number and order contents so they can pack and deliver your parcel. Carriers also use this data for customs clearance outside the UK.
• Professional advisers and authorities, such as our accountants, HMRC or a court, where needed for our legal obligations or to protect our rights.

Our service providers act on our instructions and must keep your data secure. We do not sell your personal data, and we do not share it for advertising.

International transfers

Some of our providers, and carriers delivering outside the UK, process data in other countries, including the United States. Where data leaves the UK or the EEA, we rely on adequacy decisions or regulations (for example the UK–US Data Bridge and the EU–US Data Privacy Framework for certified companies), or on standard contractual clauses with the UK International Data Transfer Addendum. You can ask us for more information about these safeguards.

How long we keep it

• Order, payment and refund records: 6 years after the end of the financial year in which the order was placed, to meet tax and accounting rules.
• Customer accounts: until you close your account, then deleted or anonymised, except for the order records above.
• Emails and withdrawal or return requests: up to 3 years after the matter is closed.
• Server logs: up to 90 days.
• Basket and session data: up to 2 days, or 7 days if you are logged in.

Your rights

You have the right to access your personal data and to have it corrected or erased. You can also ask us to restrict how we use it, object to processing based on our legitimate interests, receive it in a portable format, and withdraw consent at any time. Email support@norvulani.com and we will reply within one month.

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to a data protection authority:

• United Kingdom: the Information Commissioner’s Office (ICO), ico.org.uk, telephone 0303 123 1113.
• EU and EEA: the supervisory authority in the country where you live or work. In Germany this is the data protection authority of your federal state. In Denmark it is Datatilsynet, datatilsynet.dk.

Customers in the United States

We do not sell personal information and do not share it for cross-context behavioural advertising. Depending on the state where you live, you may have the right to know what personal information we hold about you, to correct it and to have it deleted. You can make a request by emailing support@norvulani.com. We will not treat you differently for using these rights.

Cookies

We use only the cookies needed for the shop to work, such as your basket and checkout. Our Cookie Policy lists them.

Children

Our shop is not aimed at children, and we do not knowingly collect data from anyone under 16.

Security

Our website uses an encrypted connection (HTTPS). Access to customer data is limited to the people who need it to handle your order.

Changes

We will update this policy if the way we use personal data changes, and show the date of the latest version at the top of this page.