Privacy & Data Protection

GDPR Privacy Policy

How we collect, use, and protect your personal data

Last Updated: 25 July, 2026

Who We Are

This policy explains how nque (operated by nque Ltd) collects, uses, and protects your personal data when you use our website or make a purchase, in accordance with UK GDPR, the EU GDPR, and the Data Protection Act 2018.

What Data We Collect

Account information

  • Name
  • Email address
  • Password (encrypted, never visible to us)

Order information

  • Shipping address
  • Order history
  • Items purchased and order value

Payment information

  • Processed entirely by Stripe — we never see or store your full card details
  • We retain only order totals and Stripe transaction references

Technical & usage data

  • Country-level visit and product-view statistics (no cookies, see our Cookie Policy)
  • IP-derived country (not stored against your identity)

Communications

  • Emails you send us for support, returns, or order queries

How We Use Your Data

GDPR requires a valid legal basis for every use of your data — here's ours for each.

Processing and fulfilling your ordersPerformance of a contract
Payment processing (via Stripe)Performance of a contract
Sending order confirmations and shipping updatesPerformance of a contract
Responding to customer service enquiriesPerformance of a contract
Preventing fraud and abuseLegitimate interest
Understanding site traffic and popular productsLegitimate interest
Complying with tax and accounting obligationsLegal obligation
Marketing emails (only if you opt in)Consent

Who We Share Data With

We never sell your data. We share it only with the service providers needed to run our store:

Firebase / Google CloudDatabase, authentication, and file storage
StripePayment processing, including Klarna instalment payments
VercelWebsite hosting and cookieless analytics
ResendSending transactional emails (order confirmations, status updates)
Shipping carriersGenerating shipping labels and delivering your order

International Data Transfers

Some of our service providers (Firebase/Google Cloud, Stripe, Vercel, Resend) are based in or transfer data to the United States. Where this happens, we rely on their published Standard Contractual Clauses and equivalent safeguards to protect your data to UK/EU GDPR standards.

How Long We Keep Your Data

  • Account data is kept until you delete your account.
  • Order and transaction records are retained for 6 years from the end of the financial year they relate to, in line with the Companies Act 2006 and HMRC recordkeeping requirements, even after account deletion — but are no longer linked to a live account.
  • Country-level visit and product-view statistics are aggregate counters, not tied to individual identities.

Your Rights

  • Access the personal data we hold about you
  • Correct inaccurate or incomplete data
  • Request erasure of your data ("right to be forgotten")
  • Restrict or object to certain processing
  • Receive your data in a portable format
  • Withdraw consent at any time, where processing relies on consent
  • Lodge a complaint with the ICO (or your local data protection authority)

You can permanently delete your account and personal data at any time from your account settings.

Security

Data is encrypted in transit. Payment details never touch our servers — Stripe is PCI DSS compliant and handles this directly.

Cookies

See our Cookie Policy for full details on what's used and why.

Children's Privacy

Our store is not directed at children, and we don't knowingly collect data from anyone under 16.

Questions About Your Data?

Contact us for anything relating to your personal data, or to exercise any of the rights above.

support@nque.io

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator.