Politique de confidentialité

Last updated: August 2026

At PrimeNest ("we", "us", "our"), we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, store and protect your personal data when you visit our online shop at primenestuk.myshopify.com (the "Website"), place an order with us or otherwise contact us. It also explains your rights and how to exercise them.

This policy is written to meet the requirements of the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR"). Because PrimeNest is established in France, the EU General Data Protection Regulation ("EU GDPR") and French data protection law also apply to our processing. Please read this policy carefully. If you do not agree with it, please do not use the Website.

1. Who We Are – The Data Controller

The data controller responsible for your personal data is:

  • Business name: PrimeNest
  • Address: 23 Rue René Descartes, 67000 Strasbourg, France
  • Email: barankesen579@gmail.com
  • Phone: 0584643908
  • Website: primenestuk.myshopify.com

As a "data controller", we decide why and how your personal data is processed. We have not appointed a Data Protection Officer, as we are not legally required to do so. All privacy enquiries are handled directly using the contact details above.

UK representative

Because PrimeNest is established outside the United Kingdom and offers goods to customers in the UK, we may be required under Article 27 of the UK GDPR to appoint a representative in the UK. Where applicable, our UK representative is: [UK representative name, postal address and email]. You may contact our UK representative, in addition to or instead of us, on any matter relating to the processing of your personal data.

2. The Personal Data We Collect

"Personal data" means any information that identifies you or from which you can be identified. We collect the following categories of personal data.

2.1 Data you provide to us

  • Identity and contact data: full name, billing address, delivery address, email address and phone number.
  • Order data: the products you purchase, order numbers, order value, delivery preferences, order history, and details of any cancellations, returns, refunds or exchanges.
  • Payment data: payment method, the last four digits of your card, card type, billing address and transaction status. Full card details are entered directly into, and processed by, our payment service providers. PrimeNest does not see or store your complete credit or debit card number or security code.
  • Account data: if you create a customer account, your login email, encrypted password, saved addresses and account preferences.
  • Communication data: the content of emails, contact form messages, phone calls, reviews and other correspondence you send us, including information about your query or complaint.
  • Marketing preferences: whether you have subscribed to our newsletter or marketing emails, and your communication preferences.

2.2 Data we collect automatically (server logs and device data)

When you visit the Website, our hosting platform automatically records certain technical information in server logs, including:

  • IP address and approximate location derived from it (country or city level);
  • browser type and version, operating system and device type;
  • referring website or source, pages viewed, links clicked and search terms used on the Website;
  • date, time and duration of your visit and the actions you take (for example, adding items to your basket or starting checkout);
  • error reports and performance data.

2.3 Data collected through cookies, pixels and similar technologies

We and our service providers use cookies, pixels, tags and similar technologies to collect information about how you interact with the Website. Non-essential technologies are only used if you give your consent. See Section 8 (Cookies and Consent) for full details.

2.4 Data from third parties

  • Payment providers: confirmation of payment, fraud-screening results and, where relevant, chargeback information.
  • Delivery partners: delivery status, tracking events and proof of delivery.
  • Platform and fraud-prevention tools: fraud risk indicators associated with an order.
  • Advertising and analytics partners: aggregated or pseudonymised information about the performance of our adverts, where you have consented to such cookies.

2.5 Special category data

We do not intentionally collect special category data (such as information about health, ethnicity, religion or political opinions) or data relating to criminal convictions. Please do not include such information in messages to us.

3. How We Use Your Personal Data and Our Lawful Bases

Under the UK GDPR, we must have a lawful basis for each purpose for which we use your personal data. We rely on the following lawful bases:

  • Performance of a contract (Article 6(1)(b)): where processing is necessary to perform our contract of sale with you or to take steps at your request before entering into a contract.
  • Legal obligation (Article 6(1)(c)): where we must process data to comply with the law, such as tax, accounting and consumer protection rules.
  • Legitimate interests (Article 6(1)(f)): where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests.
  • Consent (Article 6(1)(a)): where you have given clear consent, for example to non-essential cookies or to marketing emails. You can withdraw your consent at any time.

3.1 Purposes and corresponding lawful bases

  • Processing and fulfilling your order (accepting your order, taking payment, packing and dispatching goods, sending order confirmations and delivery updates) – contract.
  • Delivering your products (sharing your name, address and contact details with our delivery partners) – contract.
  • Handling cancellations, returns, refunds and faulty-goods claims, including your statutory rights under the Consumer Contracts Regulations 2013 and the Consumer Rights Act 2015 – contract and legal obligation.
  • Managing your customer account – contract.
  • Customer service (answering questions, resolving complaints) – contract and legitimate interests (providing good service).
  • Keeping tax, accounting and transaction records – legal obligation.
  • Preventing and detecting fraud, payment misuse and security incidents – legitimate interests (protecting our business and customers) and, where applicable, legal obligation.
  • Operating, securing and maintaining the Website (server logs, essential cookies, error diagnosis) – legitimate interests (running a secure, functional online shop).
  • Analysing Website usage and improving our products and services through analytics cookies – consent.
  • Sending marketing emails and newsletters – consent, or, for existing customers who bought similar products from us and did not opt out, legitimate interests under the "soft opt-in" in regulation 22 of PECR. Every marketing email contains an unsubscribe link.
  • Personalised and retargeting advertising through advertising cookies and pixels – consent.
  • Establishing, exercising or defending legal claims – legitimate interests.
  • Complying with requests from courts, regulators, tax authorities and law enforcement – legal obligation.

Where we rely on legitimate interests, you have the right to object (see Section 10). Where processing is necessary to perform our contract with you or to meet a legal obligation, we may be unable to process your order if you do not provide the required data.

3.2 Automated decision-making

Our e-commerce platform and payment providers use automated fraud-screening tools that assess orders for risk indicators (for example, mismatched billing and delivery details). An order flagged as high risk is reviewed by a member of our team before any decision to cancel is taken. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. If you believe your order has been affected by an automated decision, you may contact us to request human review, express your point of view and contest the decision.

3.3 We do not sell your personal data

We do not sell or rent your personal data to third parties.

4. Order, Cancellation and Returns Data

We use the personal data connected with your order to deliver your goods and to administer your rights after purchase. Our standard delivery time is 4-6 working days, and we share the data needed for delivery with our delivery partners for this purpose.

4.1 Statutory right to cancel (14 days)

Under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, you have a statutory right to cancel your order within 14 days of the day on which you, or a person you nominate, receive the goods, without giving any reason. When you exercise this right, we process your name, contact details, order data and payment data to record your cancellation, receive the returned goods and issue your refund. Our lawful bases are contract and legal obligation.

4.2 Voluntary extended return window (30 days)

In addition to, and separately from, your statutory 14-day right to cancel, PrimeNest offers a voluntary, contractual 30-day return window from delivery as a goodwill policy. This extended window is not a statutory right and does not reduce or replace any of your legal rights. We process the same categories of data described above to handle returns made under this voluntary policy, on the basis of contract.

4.3 Faulty goods

Your rights in respect of faulty, misdescribed or unfit goods under the Consumer Rights Act 2015 are unaffected. We process the data you provide (including photographs or descriptions of the fault) to assess and resolve such claims, on the basis of contract and legal obligation.

5. Who We Share Your Personal Data With

We share personal data only where necessary for the purposes described in this policy. Our service providers act as data processors on our behalf under written contracts that require them to process your data only on our instructions, keep it confidential and protect it with appropriate security measures. Some recipients (such as payment providers and carriers) may act as independent controllers for certain processing, in which case their own privacy notices also apply.

5.1 Hosting and e-commerce platform

Our online shop is built and hosted on Shopify. Shopify provides the Website infrastructure, checkout, order management, customer accounts, server hosting and certain fraud-prevention and analytics functions. For merchants based in Europe, the contracting Shopify entity is Shopify International Limited (Ireland). Shopify stores and processes data on servers that may be located in the European Economic Area, Canada, the United States and other countries. More information is available in Shopify's own privacy policy at shopify.com/legal/privacy.

5.2 Payment service providers

Payments are processed by trusted third-party payment service providers (such as card payment processors, digital wallet providers and, where offered, "buy now, pay later" providers). These providers receive the payment, billing and order information necessary to process your payment, prevent fraud and comply with financial regulations. They are certified to the Payment Card Industry Data Security Standard (PCI DSS).

5.3 Delivery and logistics partners

We share your name, delivery address, phone number and email address with courier, postal and fulfilment partners so that they can deliver your order and send you tracking notifications.

5.4 Email and marketing service providers

We use email service providers to send transactional emails (such as order confirmations and delivery updates) and, where permitted, marketing emails. These providers process your name, email address, order information and engagement data (such as whether an email was opened) on our behalf.

5.5 Analytics and advertising partners

Where you have consented, we use analytics and advertising services (such as web analytics tools and social media or search advertising platforms) that collect data through cookies and pixels to help us understand how the Website is used and to measure and improve our advertising.

5.6 Customer service and app providers

We may use customer support tools, review platforms and Shopify apps that process limited personal data to help us respond to enquiries, collect product reviews or provide Website features.

5.7 Professional advisers and authorities

We may share data with accountants, legal advisers and insurers where necessary, and with courts, tax authorities (including HMRC and the French tax authorities), regulators or law enforcement where we are legally required to do so or to establish, exercise or defend legal claims.

5.8 Business transfers

If our business is sold, merged or restructured, personal data may be transferred to the new owner or successor, who will be bound to use it in accordance with this policy.

6. International Data Transfers

PrimeNest is based in France, within the European Economic Area. The UK recognises the EEA as providing an adequate level of data protection, so transfers of your data from the UK to us are permitted under the UK's adequacy regulations.

Some of our service providers, including Shopify and its sub-processors, may process data in countries outside the UK and EEA, such as Canada and the United States. Where personal data is transferred to a country that does not benefit from an adequacy decision or adequacy regulations, we ensure that appropriate safeguards are in place, which may include:

  • transfers to countries recognised as adequate by the UK Government and the European Commission (for example, Canada for commercial organisations);
  • transfers to US organisations certified under the UK Extension to the EU-US Data Privacy Framework ("UK-US Data Bridge");
  • the UK International Data Transfer Agreement (IDTA) or the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses;
  • the European Commission's Standard Contractual Clauses for transfers from the EEA;
  • supplementary technical and organisational measures, such as encryption, where appropriate.

You may request further information about the safeguards we use, or a copy of the relevant documents, by contacting us using the details in Section 14.

7. How Long We Keep Your Personal Data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting or reporting requirements. Our standard retention periods are:

  • Order, invoice and transaction records: for the period required by applicable tax and accounting law, generally between 6 and 10 years from the end of the financial year in which the transaction took place.
  • Cancellation, return, refund and complaint records: up to 6 years after the matter is closed, in line with the limitation period for contractual claims.
  • Customer account data: for as long as your account remains active. If you ask us to delete your account, we will do so, except for data we must keep for the reasons above.
  • Customer service correspondence: up to 3 years from our last contact, unless needed for an ongoing claim.
  • Marketing data: until you unsubscribe or withdraw consent; we then keep your email address on a suppression list so that we do not contact you again.
  • Abandoned checkout data: up to 12 months.
  • Server logs and security data: typically up to 90 days, unless needed to investigate a security incident or fraud.
  • Cookies: for the lifetime of each cookie as shown in our cookie banner or settings, usually no longer than 13 months.

When data is no longer needed, we securely delete or anonymise it.

8. Cookies and Consent

8.1 What cookies are

Cookies are small text files placed on your device when you visit a website. Similar technologies include pixels, web beacons, local storage and software development kits. In this policy, we refer to all of these as "cookies".

8.2 Types of cookies we use

  • Strictly necessary cookies: required for the Website to function, for example to keep items in your basket, process checkout, keep you logged in, maintain security and remember your cookie choices. These do not require consent under PECR. Examples include Shopify cookies such as cart, secure_customer_sig, localization and _tracking_consent.
  • Preference (functional) cookies: remember choices such as your language, region or currency. Used only with your consent.
  • Analytics (performance) cookies: help us understand how visitors use the Website, which pages are popular and where problems occur, so that we can improve it. Examples include Shopify analytics cookies (such as _shopify_y and _shopify_s) and third-party web analytics tools. Used only with your consent.
  • Marketing (advertising) cookies and tracking pixels: used by us and our advertising partners to show you relevant adverts on other websites and social media, measure campaign performance and limit how often you see an advert. Used only with your consent.

8.3 How we obtain your consent

When you first visit the Website, a cookie banner asks you to accept, reject or customise non-essential cookies. Rejecting non-essential cookies is as easy as accepting them. Non-essential cookies are not placed on your device unless and until you give consent. You can change or withdraw your consent at any time through the cookie settings link on the Website, and withdrawal does not affect the lawfulness of processing carried out before you withdrew.

8.4 Managing cookies in your browser

You can also block or delete cookies through your browser settings. If you block strictly necessary cookies, parts of the Website (such as the basket and checkout) may not work properly. For more information, visit the ICO's guidance on cookies at ico.org.uk.

9. Marketing Communications

We will send you marketing emails only where you have opted in, or where you are an existing customer who has purchased similar products from us and did not opt out when given the opportunity (the "soft opt-in"). We will never share your email address with third parties for their own marketing purposes.

You can stop receiving marketing communications at any time by clicking the "unsubscribe" link in any marketing email or by contacting us. Unsubscribing from marketing will not stop transactional messages that are necessary to fulfil your order, such as order confirmations and delivery updates.

10. Your Data Protection Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

  • Right to be informed: to receive clear information about how we use your personal data, as set out in this policy.
  • Right of access: to request a copy of the personal data we hold about you and information about how we process it (a "subject access request").
  • Right to rectification: to have inaccurate personal data corrected and incomplete data completed.
  • Right to erasure: to request deletion of your personal data in certain circumstances, for example where it is no longer necessary or you have withdrawn consent. This right does not apply where we must keep data to comply with a legal obligation or to defend legal claims.
  • Right to restriction of processing: to ask us to limit how we use your data, for example while we verify its accuracy.
  • Right to data portability: to receive personal data you provided to us in a structured, commonly used, machine-readable format, and to ask us to transmit it to another controller, where processing is based on consent or contract and carried out by automated means.
  • Right to object: to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and an absolute right to object to direct marketing.
  • Rights related to automated decision-making: not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to obtain human intervention.
  • Right to withdraw consent: where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

10.1 How to exercise your rights

To exercise any of these rights, please contact us at barankesen579@gmail.com, by phone on 0584643908 or by post to PrimeNest, 23 Rue René Descartes, 67000 Strasbourg, France. Please state which right you wish to exercise and provide enough information for us to identify you and locate your data (for example, your name, email address and an order number).

  • We may need to verify your identity before responding, to protect your data from unauthorised disclosure.
  • We will respond without undue delay and in any event within one month of receiving your request. If your request is complex or you have made several requests, we may extend this by a further two months, in which case we will tell you within the first month and explain why.
  • Exercising your rights is normally free of charge. We may charge a reasonable fee, or refuse to act, only where a request is manifestly unfounded or excessive, as permitted by law.

11. Your Right to Complain to the ICO

If you have concerns about how we handle your personal data, we would appreciate the opportunity to address them first, so please contact us. However, you have the right to lodge a complaint at any time with the UK's data protection regulator, the Information Commissioner's Office (ICO):

  • Website: ico.org.uk/make-a-complaint
  • Helpline: 0303 123 1113
  • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

As PrimeNest is established in France, you may also complain to the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), at cnil.fr, or to the data protection authority in the EEA country where you live or work.

12. How We Protect Your Personal Data

We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access. These measures include:

  • encryption of data in transit across the Website using TLS/SSL (indicated by "https" and the padlock symbol in your browser);
  • PCI DSS-compliant payment processing, so that full card details are never stored by us;
  • hosting on Shopify's secure infrastructure, which includes firewalls, monitoring and regular security testing;
  • access controls, strong passwords and two-factor authentication for accounts that can access customer data;
  • limiting access to personal data to people who need it to perform their duties and who are bound by confidentiality;
  • contractual data protection obligations on all our service providers;
  • procedures for detecting, handling and, where required, reporting personal data breaches to the ICO and affected individuals.

While we work hard to protect your data, no method of transmission over the internet or electronic storage is completely secure. Please keep your account password confidential and contact us immediately if you suspect any unauthorised use of your account.

13. Other Matters

13.1 Children's privacy

The Website is not intended for individuals under the age of 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

13.2 Third-party websites

The Website may contain links to third-party websites, plug-ins and applications, such as social media platforms. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.

13.3 Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our service providers or the law. The updated version will be posted on this page with a revised "Last updated" date. Where changes are significant, we will take reasonable steps to notify you, for example by email or a notice on the Website. We encourage you to review this policy regularly.

14. Contact Us About Privacy

If you have any questions about this Privacy Policy, wish to exercise your data protection rights or want to make a complaint about our handling of your personal data, please contact us:

  • Business name: PrimeNest
  • Email: barankesen579@gmail.com
  • Phone: 0584643908
  • Postal address: 23 Rue René Descartes, 67000 Strasbourg, France
  • UK representative (where applicable): [UK representative name, postal address and email]

Please mark your message "Privacy Request" so that we can deal with it promptly.

Note to merchant: please replace any [placeholder] in this policy with your accurate details before publishing this page.