Privacy Policy

Nov'Max Keratin Ltd (“Nov'Max”, “we”, “us”, “our”) is committed to protecting your personal data. This policy explains what we collect, why we collect it, how we use it, and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1.What personal data we collect

We only collect the information we need to fulfil your order and provide customer support. We never sell your data.

Data	When we collect it	Why
Name	Checkout	To address you and process your order
Email address	Checkout	Order confirmation & delivery updates
Phone number	Checkout	Delivery courier contact
Postal address	Checkout	Dispatch your order
Salon / business name	Checkout (optional)	Trade customer record
Order notes	Checkout (optional)	Special delivery instructions
Payment details	Stripe checkout	Processed by Stripe — we never see or store your card details

2.How we use your data — and the legal basis

Under UK GDPR, we must have a lawful basis for processing personal data. We rely on:

• Contract performance (Article 6(1)(b)) — we need your details to fulfil the order you placed with us.
• Legal obligation (Article 6(1)(c)) — we retain order records to meet HMRC tax requirements.
• Legitimate interests (Article 6(1)(f)) — to communicate about your order, prevent fraud, and improve our service. Our interests do not override your rights.

We do not send marketing emails unless you explicitly opt in.

3.Who we share your data with

We share the minimum data needed with these third parties, all of whom are GDPR-compliant:

• Stripe Payments UK Ltd — processes your payment. Stripe's privacy policy.
• Royal Mail — delivers your order (name, address, phone).
• Our hosting provider — UK-based servers that run this website.
• HMRC — when legally required for tax purposes.

We do not transfer personal data outside the UK or EEA except via Stripe, which is covered by Standard Contractual Clauses.

4.How long we keep your data

• Order records: 7 years (HMRC requirement under Companies Act 2006).
• Email correspondence: up to 3 years after our last contact.
• Server logs: 90 days.

After these periods your data is securely deleted or anonymised.

5.Cookies

We use only essential cookies needed for the website and checkout to function. We do not use third-party tracking, advertising, or analytics cookies on this site.

• Cart cookie — remembers items you've added to your basket. Expires when you close your browser or complete checkout.
• Stripe cookies — set during checkout for fraud prevention. Required for payment.

6.Your rights under UK GDPR

You have the following rights regarding your personal data. To exercise any of them, email orders@novmaxkeratin.com. We will respond within one calendar month.

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — ask us to delete your data, subject to our legal retention obligations.
• Restriction — ask us to stop processing your data while a query is resolved.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — for any processing based on consent.

7.How we keep your data secure

• All connections to this website are encrypted with TLS / SSL.
• Payment details never touch our servers — they go directly to Stripe, a PCI DSS Level 1 certified provider.
• Access to order records is restricted to authorised personnel only.
• We review our security practices regularly.

8.Data breaches

In the unlikely event of a personal data breach that risks your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and inform you directly if required by law.

9.How to make a complaint

If you are unhappy with how we handle your data, please contact us first at orders@novmaxkeratin.com so we can try to resolve it.

You also have the right to lodge a complaint with the UK supervisory authority:

10.Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page will always reflect the most recent revision. Material changes will be communicated by email where appropriate.

Questions? Email orders@novmaxkeratin.com