Sign in
If you do not have an account, click Create AccountCreate Account
Privacy Policy
COOKIES
Our website uses cookies to distinguish you from other users of our website and to track your visits. They help us to offer you the best possible experience when you surf our website and to make improvements to our website. They also help us and our advertising networks to make advertising relevant to you and your interests.
You can set your browser to refuse all or some browser cookies, or to notify you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our website may become inaccessible or not function properly.
For detailed information about the cookies we and our third parties use and why we use them, please see our "Cookie Policy".
ONLINE ADVERTISEMENTS
We use online advertising to keep you informed about our activities and to help you find our products. Like many companies, we can target elmyse banners and ads to you when you use other websites and apps based on your Contact, Technical, Usage and Profile Data. To do this, we use various digital marketing networks and ad exchanges, as well as a range of advertising technologies such as web beacons, pixels, ad tags, cookies and mobile identifiers, as well as specific services offered by some websites and social networks, such as Facebook's Custom Audience Service.
OUR USE OF ANALYTICS AND TARGETING TOOLS
We use a range of analytics and advertising targeting tools to show you relevant website content on our website and online advertisements on other websites and apps (as described above), to provide you with relevant content in marketing communications (where applicable) and to measure the Effectiveness of the advertising provided. For example, we use tools such as Google Analytics to analyze Google's interest-based advertising data and/or third-party audience data (such as age, marital status, life event, gender and interests) to target and improve our marketing campaigns, marketing strategies and website content. We may also use tools provided by other third parties such as Facebook, Adroll, Rakuten Marketing, Dash Hudson, Responsys, Criteo and Bing to perform similar tasks using your Contact, Technical, Usage and Profile Data.
To opt-out of targeted advertising, you must disable your "cookies" in your browser settings (see Cookie Policy for details) or disable the relevant third-party ad settings. For example, you can opt out of Google's display advertising features through their ad settings. As an additional privacy measure, you can also use the Google Analytics opt-out browser add-on.
The Digital Advertising Alliance (which includes companies like Google, Responsys, and Facebook) provides a tool called WebChoices that can do a quick scan of your computer or mobile devices, find out which participating companies have customized ads enabled for your browser, and customize yours may vary according to browser settings.
If you would like more information about the data collected by these third parties or how the data is used, please contact us.
LINKS TO OTHER WEBSITES AND THIRD PARTY SERVICE PROVIDERS
Our website may contain links to and from the websites of our partner networks, advertisers and affiliates or to social media platforms. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we accept no responsibility or liability for these policies. Please review these policies before submitting any personal information to their websites.
HOW WE SHARE YOUR DATA
We may share and share your personal information with the parties listed below:
• where you have consented to us doing so. For example, where you have consented to receive marketing communications from third parties, or in relation to third party products and services (including co-branded or jointly promoted) products and services, we may share your information with the relevant third party for the purpose of sending such marketing communications to She;
• to other companies within the boohoo group that perform order fulfillment and provide support functions in the areas of human resources, finance, IT, facilities, customer service, legal, travel and health and safety.
• to business partners, suppliers, subcontractors and other third parties that we use in connection with our business for the purposes set out in the table above in the “How we use your information” section, such as: e.g.:
- Third-party service providers that we engage to provide IT systems and software and host our website;
- Third party payment processing services (including Worldpay, Adyen, Paypal and in certain regions Klarna, Clearpay, Zip and Laybuy) to process your payment to us. If you use Clearpay, this payment is subject to additional terms between you and Clearpay, which are available from Clearpay. For more information on how Clearpay handles your personal information, please see their privacy policy, available here. If you pay with Klarna, that payment is subject to additional terms between you and Klarna, available here. You can find more information about Klarna here. For more information about how Klarna handles your personal data, please see theirPrivacy Policy available here. If you pay with Laybuy, that payment is subject to additional terms between you and Laybuy, available here. More information about laybuy can be found here. For more information on how Laybuy handles your personal information, please see the Privacy Policy available here. If you use Zip, such payment is subject to additional terms between you and Zip, available here. For more information about how Zip handles your personal information, see their privacy policy, available here. Nasty Gal does not store your payment information. Your payment details will be shared with your chosen payment processing service provider, which is committed to complying with applicable regulations and data protection laws. For details on the processing of your personal data, please refer to the data protection declaration of the respective provider. These third-party payment providers process your data as a data controller;
- Third-party service providers that we use to deliver the goods you have ordered and to manage returns;
- Third-party service providers that we engage to send email and post on our behalf, including in relation to incomplete orders or abandoned shopping carts or marketing communications, to provide data sanitization services and marketing and advertising services;
- Third party suppliers we use to deliver and process your e-gift card orders and e-gift card payments (including Jigsaw Business Solutions Ltd and Stripe Payments UK Ltd)- Analytics and search engine providers who help us to improve and optimize our website;
- affiliate networks through which you came to our website;
• to third parties to whom we may sell, transfer or combine parts of our business or assets. Alternatively, we may seek to acquire or merge with other companies. If our business changes, the new owners may use your personal information in the same ways as described in this privacy statement.
• In order to protect our customers, other companies within the boohoo Group and the Website from fraud and theft, we may share your personal data with Ravelin and/or Risk Guardian and/or other fraud prevention and analysis service providers to conduct fraud prevention checks in our mission. If Ravelin is provided with personal data, Ravelin will also use this personal data to improve its service and machine learning to improve its automated processing. A copy of Ravelin's privacy policy is available at: https://www.ravelin.com/privacy-policy-new, which explains how Ravelin uses your personal data for these purposes; and we may also share personal information required for identity verification and personal information obtained from identity verification (including information about your age, name and location) along with account information with other companies within the boohoo group and with third party organizations (including law enforcement agencies) involved in fraud prevention and detection and credit risk reduction. Please note that other companies within the boohoo group and these third parties may keep records of the information we provide to them for this purpose;
• if we are under a duty to disclose or share your personal information in order to comply with any legal obligation; or
• to our professional advisors, including lawyers, bankers, and accountants.
YOUR RIGHTS
You have several rights under data protection laws. This includes, in certain circumstances, the right:
• Request access to your personal data
• Request correction of your personal data
• Request the deletion of your personal data
• Request restriction of processing of your personal data
• Request the transfer of your personal data
• Object to the processing of your personal data
• Request human intervention for automated decision making
Brief details of each of these rights are set out below. If you wish to exercise any of these rights, please email us at DPO@elmyse.com.
REQUEST ACCESS TO YOUR PERSONAL DATA
You have the right to receive a copy of the personal data we hold about you and certain information in relation to our processing of your personal data.
REQUEST CORRECTION OF YOUR PERSONAL DATA
You have the right to have your personal data rectified if it is inaccurate or incomplete. You can update your personal information at any time by logging into your account and updating your information directly or by emailing us at DPO@nastygal.com.
REQUEST DELETION OF YOUR PERSONAL DATA
This allows you to request that Nasty Gal erase your personal information where there is no good reason for us continuing to process it. However, please note that we may not always be able to comply with your erasure request for certain legal reasons, which may be disclosed to you at the time of your request.
REQUEST RESTRICTION OF THE PROCESSING OF YOUR PERSONAL DATA
You have the right to ask Nasty Gal to suspend the processing of your personal data in certain scenarios, for example when you want us to establish the data's accuracy or you have objected to our use of your data but we need to verify that this is the case case we have compelling legitimate grounds to use it. Where processing is restricted, we may retain sufficient information about you to ensure that the restriction is complied with in the future.
REQUEST THE TRANSFER OF YOUR PERSONAL DATA
You have the right to receive a digital copy of your personal data or to request the transfer of your personal data to another company. However, please note that this right only applies to automated data which you initially gave us consent to use or where we used the data to perform a contract with you.
OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA
You have the right to object to the processing of your personal data where we believe we have a legitimate interest in processing (as explained above). You also have the right to object to our processing of your personal data for direct marketing purposes. In some cases we can demonstrate that we have overriding legitimate grounds for processing your data which override your rights and freedoms.
This allows you to request that Nasty Gal erase your personal information where there is no good reason for us continuing to process it. However, please note that we may not always be able to comply with your erasure request for certain legal reasons, which may be disclosed to you at the time of your request.
REQUEST RESTRICTION OF THE PROCESSING OF YOUR PERSONAL DATA
You have the right to ask Nasty Gal to suspend the processing of your personal data in certain scenarios, for example when you want us to establish the data's accuracy or you have objected to our use of your data but we need to verify that this is the case case we have compelling legitimate grounds to use it. Where processing is restricted, we may retain sufficient information about you to ensure that the restriction is complied with in the future.
REQUEST THE TRANSFER OF YOUR PERSONAL DATA
You have the right to receive a digital copy of your personal data or to request the transfer of your personal data to another company. However, please note that this right only applies to automated data which you initially gave us consent to use or where we used the data to perform a contract with you.
OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA
You have the right to object to the processing of your personal data where we believe we have a legitimate interest in processing (as explained above). You also have the right to object to our processing of your personal data for direct marketing purposes. In some cases we can demonstrate that we have overriding legitimate grounds for processing your data which override your rights and freedoms.
REQUEST HUMAN INTERVENTION FOR AUTOMATED DECISION MAKING AND PROFILING
You have the right to request human intervention when we are performing automated decision-making when processing your personal data. This form of processing is permitted where it is necessary in the context of our contract with you, subject to appropriate safeguards in place or your express consent.
We will try to respond to all legitimate requests within one month. Occasionally it may take longer than a month if your request is particularly complex or you have made multiple requests. In this case we will notify you and keep you informed. We may need to request certain information from you so that we can confirm your identity and ensure your right to exercise any of the rights set out above. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
RIGHT TO MAKE A COMPLAINT
If you have any concerns or complaints about the way we process your data, please email us directly at DPO@elmyse.com. You also have the right to lodge a complaint with the ICO (the data protection authority in the UK). However, we would appreciate the opportunity to address your concerns before approaching the ICO, so please contact us in the first instance.
You have the right to request human intervention when we are performing automated decision-making when processing your personal data. This form of processing is permitted where it is necessary in the context of our contract with you, subject to appropriate safeguards in place or your express consent.
We will try to respond to all legitimate requests within one month. Occasionally it may take longer than a month if your request is particularly complex or you have made multiple requests. In this case we will notify you and keep you informed. We may need to request certain information from you so that we can confirm your identity and ensure your right to exercise any of the rights set out above. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
RIGHT TO MAKE A COMPLAINT
If you have any concerns or complaints about the way we process your data, please email us directly at DPO@elmyse.com. You also have the right to lodge a complaint with the ICO (the data protection authority in the UK). However, we would appreciate the opportunity to address your concerns before approaching the ICO, so please contact us in the first instance.
CHANGES TO THE PRIVACY NOTICE
From time to time we may change this privacy statement. If there are any significant changes, we will post updates to our website or applications, or notify you by email.
HOW TO CONTACT US
We welcome feedback and are happy to answer any questions you may have about your data.
Please send any questions, comments or requests for further information to our appointed representative and data protection officer, Keri Devine, who can be contacted at DPO@elmyse.com.
This privacy statement was last updated on 21 September 2021 (NG UK and Europe Version 1.13)
Registered company number: 10487954,
UK VAT number: 185 4874 61.
From time to time we may change this privacy statement. If there are any significant changes, we will post updates to our website or applications, or notify you by email.
HOW TO CONTACT US
We welcome feedback and are happy to answer any questions you may have about your data.
Please send any questions, comments or requests for further information to our appointed representative and data protection officer, Keri Devine, who can be contacted at DPO@elmyse.com.
This privacy statement was last updated on 21 September 2021 (NG UK and Europe Version 1.13)
Registered company number: 10487954,
UK VAT number: 185 4874 61.
Comment