Privacy Policy

This Privacy Policy explains how FLOWRA LTD, trading as NERRA (“NERRA”, “we”, “us” or “our”), collects, uses, discloses, stores and protects personal information when you visit our website, purchase our products, create an account, subscribe to marketing, contact us or otherwise interact with our services.

NERRA operates the website nerraactive.com. Our online store is hosted by Shopify, which provides the ecommerce platform that enables us to offer our products and services.

Who We Are

For the purposes of applicable data protection laws, the data controller is:

FLOWRA LTD, trading as NERRA
Company number: 17017647
Registered in England and Wales
Registered office: 128 City Road, London, United Kingdom, EC1V 2NX
Email: hello@nerraactive.com
Website: nerraactive.com

FLOWRA LTD is currently registered as an active private limited company in England and Wales at the address above.

Personal Information We Collect

“Personal information” means information that identifies you or can reasonably be linked to you.

Depending on how you use our website and services, we may collect or process the following categories of information.

Contact and identity information

This may include:

  • Your name;
  • Email address;
  • Telephone number;
  • Billing address;
  • Shipping address; and
  • Other contact details you provide.

Order and transaction information

This may include:

  • Products you view, add to your cart or purchase;
  • Order number and order history;
  • Returns, refunds, cancellations and customer service matters;
  • Delivery and fulfilment information;
  • Discount or promotional information; and
  • Transaction status and payment confirmation.

Payment information

Payments are handled by third-party payment providers.

We may receive limited payment-related information, such as:

  • Payment method;
  • Billing details;
  • Payment status;
  • Transaction reference; and
  • Fraud-screening results.

We do not directly receive or store your complete payment card number or card security code.

Account information

If customer accounts are available and you create one, we may process:

  • Login credentials;
  • Account preferences;
  • Saved addresses;
  • Order history; and
  • Account settings.

Communications

We process information you provide when you:

  • Contact customer support;
  • Make a return or refund request;
  • Send an enquiry;
  • Submit a review or other content;
  • Communicate with us through email or social media; or
  • Exercise a privacy right.

Device and technical information

This may include:

  • IP address;
  • Browser and device type;
  • Operating system;
  • Device identifiers;
  • Network information;
  • Cookie identifiers;
  • General location inferred from an IP address; and
  • Technical information about how your device connects to our services.

Website and usage information

This may include:

  • Pages and products viewed;
  • Search activity;
  • Cart and checkout activity;
  • Links clicked;
  • Visit dates and times;
  • Referring websites;
  • Interaction with emails and advertisements; and
  • Website performance information.

Marketing preferences

This may include:

  • Whether you have subscribed to marketing;
  • Your communication preferences;
  • Whether you have unsubscribed;
  • Cookie consent choices; and
  • Advertising opt-out choices.

Where We Obtain Personal Information

We may obtain personal information:

  • Directly from you;
  • Automatically through our website, cookies, pixels and similar technologies;
  • From Shopify and the ecommerce services it provides;
  • From payment providers;
  • From delivery and fulfilment providers;
  • From customer service providers;
  • From analytics and advertising platforms;
  • From fraud-prevention and security providers; and
  • From other service providers where permitted by law.

If we obtain information from another source, we use and disclose it only as permitted by applicable law and as explained in this policy.

Information You Need to Provide

Certain information is necessary for us to enter into or perform a contract with you.

For example, we generally need your name, delivery address, contact information and payment confirmation to process and deliver an order.

You are not required to provide personal information merely to browse most parts of the website. However, if required information is not provided, we may be unable to:

  • Process an order;
  • Deliver a purchase;
  • Create or maintain an account;
  • Complete a return or refund;
  • Respond fully to a request; or
  • Provide a requested service.

How We Use Personal Information

We may use personal information for the following purposes.

Providing our products and services

We use personal information to:

  • Process orders and payments;
  • Fulfil and deliver purchases;
  • Send order confirmations and delivery updates;
  • Manage returns, refunds and cancellations;
  • Provide customer support;
  • Maintain customer accounts;
  • Remember preferences;
  • Detect and correct order or delivery issues; and
  • Provide the features and services you request.

Improving our website and services

We may use information to:

  • Understand how customers use the website;
  • Improve navigation, content and product presentation;
  • Analyse website performance;
  • Test and improve features;
  • Understand customer preferences;
  • Develop products and services; and
  • Diagnose technical problems.

Marketing and advertising

Where permitted by law, we may use personal information to:

  • Send marketing emails;
  • Measure marketing performance;
  • Create advertising audiences;
  • Display advertisements on third-party platforms;
  • Understand interactions with advertisements; and
  • Personalise marketing communications.

Depending on which services are active, these platforms may include Shopify Email, Google, Meta and TikTok.

Where consent is required, we will obtain consent before sending electronic marketing or using non-essential tracking technologies.

You may unsubscribe from marketing emails at any time by using the unsubscribe link in an email or contacting hello@nerraactive.com.

Security and fraud prevention

We may use information to:

  • Authenticate transactions;
  • Detect and prevent fraud;
  • Investigate suspicious activity;
  • Protect accounts and payment processes;
  • Maintain website security;
  • Prevent misuse of our services; and
  • Protect our customers, business and legal rights.

Communicating with you

We use information to:

  • Respond to questions;
  • Provide customer service;
  • Resolve complaints;
  • Process privacy requests;
  • Communicate about orders; and
  • Send important service or policy notices.

Legal and business administration

We may process information to:

  • Comply with tax and accounting requirements;
  • Comply with consumer protection and data protection laws;
  • Respond to lawful requests;
  • Establish, exercise or defend legal claims;
  • Enforce our terms and policies;
  • Maintain business records; and
  • Support a merger, restructuring, financing or sale of all or part of the business.

Lawful Bases for Processing

Where applicable law requires us to identify a lawful basis, we rely on one or more of the following.

Contract

We process information where necessary to enter into or perform a contract with you, including to:

  • Process an order;
  • Take payment;
  • Arrange delivery;
  • Manage a return or refund; and
  • Provide requested customer service.

Legal obligation

We process information where necessary to comply with legal obligations, including tax, accounting, regulatory and consumer-protection requirements.

Legitimate interests

We may process information where necessary for legitimate business interests, provided those interests are not overridden by your rights and freedoms.

These interests may include:

  • Operating and improving our store;
  • Preventing fraud;
  • Maintaining security;
  • Understanding website performance;
  • Managing customer relationships;
  • Protecting legal rights; and
  • Conducting appropriate business analytics.

Consent

We rely on consent where required, including for:

  • Certain marketing communications;
  • Non-essential analytics cookies;
  • Advertising cookies and pixels; and
  • Other optional processing activities.

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Cookies and Similar Technologies

Our website uses cookies, pixels, tags, local storage and similar technologies.

These technologies may be used to:

  • Operate the website;
  • Keep products in your cart;
  • Maintain security;
  • Remember language and regional preferences;
  • Analyse website usage;
  • Measure advertising performance; and
  • Support relevant marketing.

Strictly necessary technologies

These are required for functions such as:

  • Cart and checkout;
  • Payment processing;
  • Account login;
  • Website security;
  • Fraud prevention; and
  • Network and load management.

Consent is not normally required where a technology is strictly necessary to provide a service you have requested.

Analytics technologies

Where enabled, analytics technologies help us understand how visitors use our website and how the website performs.

These may include Google Analytics or Shopify analytics.

Advertising technologies

Where enabled, advertising technologies may be used to:

  • Measure advertisements;
  • Understand conversions;
  • Build advertising audiences; and
  • Show more relevant advertisements.

These may include Google Ads, Meta Pixel or TikTok Pixel.

Where required by law, we will not activate non-essential analytics or advertising technologies until you have provided valid consent. Valid Cookie consent must involve an active and informed choice; simply continuing to browse is not sufficient.

You can manage your choices through the Cookie Preferences link available on our website. You may also change browser settings, although blocking certain essential technologies may affect website functionality.

More information about specific cookies may be available through our Cookie Preferences tool or Cookie Policy.

How We Disclose Personal Information

We may disclose personal information where reasonably necessary to operate our business, provide services, fulfil orders or comply with legal obligations.

Recipients may include:

  • Shopify;
  • Payment providers, including PayPal, Shopify Payments and Shop Pay where enabled;
  • Banks and payment networks;
  • Delivery, logistics and fulfilment providers;
  • Email and customer communication providers;
  • Analytics providers;
  • Advertising and marketing platforms;
  • Fraud-prevention and security providers;
  • IT, hosting and technology providers;
  • Customer service and business operations providers;
  • Accountants, legal advisers, insurers and tax advisers;
  • Regulators, courts, law enforcement and public authorities; and
  • A purchaser, investor, successor or adviser in connection with a proposed or completed business transaction.

We require service providers to process information only for agreed purposes and subject to appropriate contractual and security obligations where required.

Sale, Sharing and Targeted Advertising

We do not sell personal information for money as part of our ordinary business operations.

However, some privacy laws use broad definitions of “sale”, “sharing” or “targeted advertising”. Under those definitions, the use of advertising cookies, pixels or audience-matching services may be treated as a sale, sharing or targeted advertising.

Where applicable, you may opt out through:

  • Our Cookie Preferences tool;
  • A “Your Privacy Choices” or similar link where available;
  • Your browser or device settings; or
  • A legally recognised opt-out signal, where we are required to honour it.

Where legally applicable, we treat a recognised Global Privacy Control signal as an opt-out request for the browser and device sending that signal.

Our Relationship with Shopify

Our store is hosted by Shopify.

Shopify processes personal information to provide, secure, maintain and improve its ecommerce platform and related services.

Information submitted through our store may be disclosed to Shopify and its service providers and may be processed in countries other than the country where you live.

Depending on the particular Shopify feature, Shopify may act as our processor, as an independent controller or in another role recognised by applicable law.

For more information about Shopify’s own processing, please review Shopify’s Consumer Privacy Policy and Privacy Portal.

Automated Decision-Making and Profiling

We may use automated tools to assist with:

  • Fraud detection;
  • Payment risk screening;
  • Website analytics;
  • Advertising measurement; and
  • Marketing audience selection.

These tools may analyse transaction, device, usage or advertising information.

We do not currently make decisions based solely on automated processing that produce legal effects, or similarly significant effects, for customers.

A payment or order may be delayed or reviewed where automated fraud-screening tools identify a risk. Where appropriate, such matters may be subject to human review.

International Transfers

Some service providers may process personal information outside the United Kingdom or European Economic Area.

Where an international transfer is subject to UK data protection law, we take steps to ensure that it is covered by an appropriate legal mechanism, which may include:

  • UK adequacy regulations;
  • The UK International Data Transfer Agreement;
  • The UK Addendum to the European Commission’s Standard Contractual Clauses;
  • Other appropriate contractual safeguards; or
  • A legally permitted exception.

International transfer rules can apply whenever personal information is sent or made accessible to a separate organisation outside the UK.

Where required, we also assess the relevant transfer and security risks.

How Long We Retain Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:

  • Perform contracts;
  • Provide customer service;
  • Maintain transaction records;
  • Meet tax and accounting obligations;
  • Prevent fraud;
  • Resolve disputes;
  • Enforce agreements; and
  • Establish or defend legal claims.

Retention periods depend on factors including:

  • The type and sensitivity of the information;
  • The reason it was collected;
  • Legal, accounting and regulatory requirements;
  • The length of the customer relationship;
  • Applicable limitation periods;
  • Fraud and security risks; and
  • Whether an unresolved complaint or dispute exists.

For example:

  • Order and transaction records may be retained for the period required by tax, accounting and legal obligations;
  • Customer service records may be retained while needed to manage an order, complaint or dispute;
  • Marketing subscription records are retained until you unsubscribe or withdraw consent, although limited suppression information may be retained to respect your opt-out;
  • Cookie and analytics information is retained according to the settings and retention periods of the relevant tools; and
  • Fraud-prevention records may be retained where reasonably necessary to protect customers and the business.

When information is no longer required, we will delete it, anonymise it or securely restrict its use, unless continued retention is required by law.

The ICO expects privacy information to explain either the relevant retention periods or the criteria used to determine those periods.

Security

We use reasonable technical and organisational safeguards designed to protect personal information against:

  • Unauthorised access;
  • Loss;
  • Misuse;
  • Alteration;
  • Destruction; and
  • Unlawful disclosure.

These measures may include access controls, secure connections, service-provider controls, account protections and monitoring.

No method of transmission or electronic storage is completely secure. We therefore cannot guarantee absolute security.

Your Privacy Rights

Depending on where you live and the law that applies, you may have some or all of the following rights:

  • The right to be informed;
  • The right to access personal information;
  • The right to correct inaccurate or incomplete information;
  • The right to request deletion;
  • The right to restrict processing;
  • The right to object to certain processing;
  • The right to data portability;
  • The right to withdraw consent;
  • Rights relating to automated decision-making;
  • The right to opt out of certain sale, sharing or targeted advertising; and
  • The right to lodge a complaint with a supervisory authority.

These rights are not absolute. Exceptions may apply depending on the processing purpose and applicable law.

To exercise a right, email:

hello@nerraactive.com

Please describe your request and provide enough information for us to identify the relevant account or transaction.

We may ask for reasonable information to verify your identity. Where permitted, an authorised representative may submit a request on your behalf, subject to verification of their authority.

The ICO recognises rights including access, rectification, erasure, restriction, objection and withdrawal of consent, subject to applicable conditions and exemptions.

Marketing Choices

You can unsubscribe from promotional emails at any time by:

Even after you unsubscribe, we may still send necessary non-marketing communications, such as:

  • Order confirmations;
  • Shipping updates;
  • Refund notifications;
  • Security messages; and
  • Responses to customer service enquiries.

Complaints

Please contact us first if you have a concern about how we handle personal information:

hello@nerraactive.com

We will review the concern and try to resolve it.

If you are in the United Kingdom and remain dissatisfied, you may complain to the:

Information Commissioner’s Office

The right to complain to the ICO should be explained in a UK privacy notice.

If you are located elsewhere, you may also have the right to complain to your local data-protection or privacy authority.

Third-Party Websites

Our website may contain links to websites or services operated by third parties.

We do not control those third parties and are not responsible for their privacy, security or content practices.

Please review the privacy notice of any third-party website before providing personal information.

Children’s Information

Our website and services are not directed at children under the age of 16.

We do not knowingly collect personal information directly from children under 16 without appropriate authorisation where required.

If you believe a child has provided personal information to us improperly, contact hello@nerraactive.com. We will investigate and take appropriate action, which may include deleting the information.

Online services that are likely to be accessed by children can be subject to additional UK requirements, even when they are not specifically designed for children.

Changes to This Policy

We may update this Privacy Policy to reflect changes in:

  • Our business practices;
  • Services and technologies;
  • Service providers;
  • Legal requirements; or
  • Regulatory guidance.

We will publish the updated policy on this page and revise the “Last updated” date.

Where required, we will provide additional notice before a material change takes effect.

Contact Us

For questions, complaints or requests relating to this Privacy Policy or personal information, contact:

FLOWRA LTD, trading as NERRA
Company number: 17017647
Registered office: 128 City Road, London, United Kingdom, EC1V 2NX
Email: hello@nerraactive.com
Website: nerraactive.com

For applicable data-protection purposes, FLOWRA LTD is the controller of the personal information described in this policy.