Privacy policy
Privacy Policy
Last updated: 30 July 2026
NestedCare ("we", "us", "our") runs nestedcare.eu. This policy explains what personal data we collect, why we collect it, who we share it with, and what rights you have over it.
We are the data controller for the personal data described here. Our store is hosted on Shopify, which processes data on our behalf and, in some cases, as a controller in its own right.
If you use our site or buy from us, this policy applies to you. Please read it.
1. What we collect
You give us directly:
- Name, email address, phone number, billing and delivery address
- Order details and delivery instructions
- Any message you send us (customer support, product questions, review content)
- Account details if you create an account (username, password, saved preferences)
Collected automatically when you visit:
- IP address, device type, browser, operating system
- Pages viewed, products viewed, items added to cart, time on site, referring website
- Cookie identifiers and similar technologies (see Section 6)
We do not store your card details. Payments are processed by Shopify Payments and, where relevant, PayPal. They receive your card information directly. We only see the last four digits, the card type, and whether the payment succeeded.
2. Why we use it, and our legal basis
Under the GDPR we must have a lawful basis for every use of your data. Ours are:
| What we do | Why | Lawful basis |
|---|---|---|
| Process and deliver your order, handle returns and refunds | To fulfil our contract with you | Contract (Art. 6(1)(b)) |
| Send order confirmations, dispatch and delivery updates | Same | Contract |
| Answer your emails and support requests | To respond to you | Contract / Legitimate interests |
| Keep accounting and tax records | Required by Irish law | Legal obligation (Art. 6(1)(c)) |
| Detect and prevent fraud and abuse | To protect our business and customers | Legitimate interests (Art. 6(1)(f)) |
| Understand how the site is used and improve it | To run a functioning shop | Legitimate interests / Consent (for analytics cookies) |
| Send marketing emails | To tell you about products | Consent (Art. 6(1)(a)) — withdraw any time |
| Show you ads on Facebook, Instagram and Google | To reach relevant customers | Consent (via our cookie banner) |
You can withdraw consent at any time. It won't affect anything we did lawfully before you withdrew it.
3. Who we share it with
We share personal data only with providers who need it to help us operate. Each is bound by contract to protect it and to use it only on our instructions.
- Shopify — store hosting, checkout, payment processing, order management
- Our fulfilment and shipping partners — we pass your name, address and phone number so your order can be shipped. Some of our suppliers and warehouses are located outside the EU, including in China and the United Kingdom.
- Delivery carriers — An Post, DPD, Royal Mail and similar, depending on destination
- Judge.me — product review collection and display
- Meta (Facebook/Instagram) and Google — advertising and measurement, where you have consented to marketing cookies
- Our email platform — to send order and marketing emails
- Professional advisers, and public authorities where we are legally required to disclose
We do not sell your personal data.
We may also disclose data in connection with a sale, merger or restructuring of our business, or where we are legally obliged to (for example, a court order or a request from An Garda Síochána or Revenue).
4. International transfers
Some of the providers above are outside the European Economic Area — including in the United States, the United Kingdom and China.
Where we transfer your data outside the EEA, we rely on:
- an adequacy decision by the European Commission (this covers the UK), or
- the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.
You can ask us for a copy of the safeguards we use by emailing the address in Section 9.
5. How long we keep it
| Data | Retention |
|---|---|
| Order and transaction records | 6 years after the order, to meet Irish tax and accounting requirements |
| Customer account data | Until you ask us to delete it, or after 3 years of inactivity |
| Marketing contact data | Until you unsubscribe, then we keep a record of your opt-out so we don't contact you again |
| Support emails | 2 years from the last message |
| Website analytics | Up to 26 months |
When a retention period ends we delete the data or anonymise it so it can no longer identify you.
6. Cookies
We use cookies and similar technologies. Some are essential — they make the cart, checkout and login work, and we can't switch those off. Others are optional:
- Analytics cookies tell us how people move through the site so we can fix what's broken.
- Marketing cookies let us show you relevant ads on Facebook, Instagram and Google, and measure whether those ads work.
Optional cookies are only set if you accept them in our cookie banner. You can change your choice at any time through the cookie settings link in our site footer, or by clearing cookies in your browser.
7. Your rights
If you are in the EU, EEA or UK, you have the right to:
- Access — get a copy of the personal data we hold about you
- Rectification — have inaccurate data corrected
- Erasure — have your data deleted, where we have no overriding reason to keep it
- Restriction — have us pause processing while a dispute is resolved
- Portability — receive your data in a machine-readable format, or have it sent to another provider
- Objection — object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent — for anything we do on the basis of consent
To exercise any of these, email us at the address in Section 9. We will respond within one month. We may need to verify your identity first.
Complaints. If you think we've handled your data wrongly, please contact us and give us a chance to fix it. You also have the right to complain to the Irish Data Protection Commission:
Data Protection Commission 6 Pembroke Row, Dublin 2, D02 X963 www.dataprotection.ie
If you're in another EU country or the UK, you can complain to your own national supervisory authority instead.
8. Security, children, and other sites
Security. We use HTTPS across the site, and our payment processing is PCI-DSS compliant through Shopify. No system is perfectly secure, so please don't send us sensitive information by email.
Children. Our store is not intended for children. We don't knowingly collect data from anyone under 16. If you believe a child has given us their data, contact us and we'll delete it.
Other websites. Our site may link to third-party sites. We're not responsible for their privacy practices — check their policies before sharing anything.
9. Contact us
NestedCare Email: support@nestedcare.eu Phone: +353 89 969 8544 Address: [Your registered business address], Co. Waterford, Ireland
10. Changes
We may update this policy. When we do, we'll change the "Last updated" date above and, where the change is significant, tell you by email or a notice on the site.