Privacy policy

Last updated: June 2025

At Niwini, we approach everything we do with the same care and intentionality that goes into our minimal design plush toys and wooden toys — thoughtfully, transparently, and with respect for the people who trust us. This Privacy Policy explains in detail how Niwini Ltd collects, uses, stores, shares, and protects your personal information when you visit https://niwini.com/ or make a purchase from us.

Please read this policy carefully. By using our website or purchasing our products — from our Minimal Design Plush Bunny to our Wooden Rainbow Stacking Bowls — you agree to the practices described here. If you do not agree, please refrain from using our website.

Legal Business Name: NIWINI LTD (Company Number: 1735813)
Registered Address: 20 Wenlock Road, London, United Kingdom, N1 7GU
Email: Support@niwini.com
Phone: +447473939685
Business Hours: Monday–Friday, 8:00 AM – 4:00 PM GMT

1. Who We Are and Our Role as Data Controller

Niwini Ltd is the data controller responsible for your personal information. We are registered in England and Wales (Company Number: 1735813) and are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we serve customers in the European Union, we also comply with the EU GDPR. Where we serve customers in California, we comply with the California Consumer Privacy Act (CCPA) as amended by the CPRA.

2. What Personal Data We Collect

We collect the following categories of personal information when you interact with our website and purchase our products:

2.1 Information You Provide Directly

  • Full name — collected when you place an order or create an account.
  • Email address — used for order confirmations, shipping updates, and marketing (where you have consented).
  • Shipping and billing address — necessary to fulfil and deliver your order of our wooden toys, stacking bowls, plush bunnies, and other Niwini products.
  • Payment details — we do not store your full card details. Payment information is processed securely by our third-party payment processors (see Section 5). We may retain partial payment identifiers (e.g., last four digits of a card) for record-keeping purposes.
  • Phone number — if provided, used for delivery coordination or customer service.
  • Messages and enquiries — any communication you send to our support team via email or contact forms.

2.2 Information Collected Automatically

  • Cookies and tracking technologies — including session cookies, persistent cookies, and pixel tags. See Section 6 for full details.
  • Analytics data — page views, time on site, referring URLs, browser type, device type, and IP address, collected to help us understand how visitors interact with our website.
  • Behavioural data — products viewed, items added to cart, wishlist activity, and purchase history.
  • Log data — server logs that record your IP address, access times, and pages visited.

3. How and Why We Use Your Personal Data

We collect and process your personal data for the following specific purposes, each supported by a lawful basis under UK GDPR:

3.1 Order Fulfilment and Customer Service

Purpose: To process your order, arrange shipping of your Niwini products, send order confirmations, handle returns, and respond to customer service enquiries.
Lawful basis: Performance of a contract (Article 6(1)(b) UK GDPR).

3.2 Payment Processing

Purpose: To securely process payments for your purchases via third-party payment processors.
Lawful basis: Performance of a contract and compliance with legal obligations.

3.3 Marketing and Email Communications

Purpose: To send you newsletters, new product announcements (such as new additions to our wooden toy or plush toy collections), promotions, and personalised recommendations.
Lawful basis: Consent (Article 6(1)(a) UK GDPR). You may withdraw consent at any time by clicking the unsubscribe link in any marketing email or contacting us directly.
Tools used: Mailchimp and Klaviyo (see Section 5).

3.4 Website Analytics and Improvement

Purpose: To understand how customers navigate our website, which products attract interest (such as our Rainbow Stacking Bowls or Minimal Design Plush Bunny), and how we can improve our user experience.
Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR), balanced against your privacy rights.

3.5 Advertising and Remarketing

Purpose: To display relevant advertisements for our products on third-party platforms, including Google and Meta/Facebook.
Lawful basis: Consent, obtained via our cookie consent mechanism upon your first visit.

3.6 Legal Compliance and Fraud Prevention

Purpose: To comply with applicable laws (including tax, accounting, and consumer protection obligations), detect and prevent fraud, and enforce our terms and conditions.
Lawful basis: Legal obligation (Article 6(1)(c) UK GDPR) and legitimate interests.

3.7 Business Operations and Record Keeping

Purpose: To maintain accurate business records, conduct internal audits, and manage our operations as a registered UK company.
Lawful basis: Legal obligation and legitimate interests.

4. Legal Bases for Processing (UK & EU GDPR Summary)

We rely on the following lawful bases to process your personal data:

  • Contract: Processing necessary to fulfil your order or respond to a pre-contractual request.
  • Consent: Where you have freely given, specific, informed, and unambiguous consent — particularly for marketing emails and non-essential cookies.
  • Legitimate Interests: Where our business interests (such as improving our website and preventing fraud) do not override your fundamental rights.
  • Legal Obligation: Where we are required by law to process certain data (e.g., tax records, financial reporting).

5. Third-Party Services We Share Data With

We work with carefully selected third-party service providers who assist us in operating our business. We only share the minimum data necessary and require all third parties to handle your information securely and in accordance with applicable law.

5.1 Payment Processors

  • Stripe — processes card payments securely. Stripe is PCI-DSS compliant. Privacy policy: stripe.com/gb/privacy
  • PayPal — processes PayPal payments. Privacy policy: paypal.com
  • Shopify Payments — our e-commerce platform's integrated payment solution. Privacy policy: shopify.com/legal/privacy

5.2 E-Commerce Platform

  • Shopify — our website is hosted and operated on Shopify's platform. Shopify processes order data, customer account data, and site activity on our behalf as a data processor.

5.3 Analytics Providers

  • Google Analytics — we use Google Analytics to understand site traffic and user behaviour. Data may be transferred to Google's servers in the United States. Google Analytics anonymises IP addresses where required. You can opt out via Google's opt-out tool.

5.4 Advertising and Remarketing

  • Meta/Facebook Pixel — we use the Meta Pixel to track conversions, build custom audiences, and run targeted advertising campaigns for our minimal design plush toys and wooden toys on Facebook and Instagram. Data is transferred to Meta Platforms Inc. in the United States.
  • Google Ads — for search and display advertising across the Google network.

5.5 Email Marketing Platforms

  • Mailchimp (Intuit) — used for sending marketing newsletters and promotional emails. Your name and email address are stored on Mailchimp's servers. Privacy policy: mailchimp.com/legal/privacy
  • Klaviyo — used for automated email marketing flows, including abandoned cart reminders and post-purchase sequences related to our product collections. Privacy policy: klaviyo.com/legal/privacy-notice

5.6 Shipping and Logistics Carriers

  • Your name, delivery address, and order details are shared with shipping carriers in order to fulfil and deliver your Niwini order. Carriers we may use include Royal Mail, USPS, FedEx, DHL, UPS, and other regional carriers depending on your delivery location.

5.7 Other Disclosures

We may also share your personal data:

  • With law enforcement, regulators, or courts where we are legally required to do so.
  • With professional advisers (e.g., lawyers, accountants) under confidentiality obligations.
  • In the event of a merger, acquisition, or sale of our business, where customer data may be transferred to a new entity (you will be notified).

6. Cookies and Tracking Technologies

Cookies are small text files placed on your device when you visit our website. We use cookies and similar tracking technologies to enhance your browsing experience, analyse traffic, and deliver targeted advertising.

6.1 Types of Cookies We Use

  • Strictly Necessary Cookies: Essential for the website to function — for example, maintaining your shopping cart, enabling secure checkout, and managing your login session. These cannot be disabled.
  • Performance and Analytics Cookies: Set by Google Analytics to collect anonymised data about how visitors use our site, which pages are most visited, and how customers discover our wooden toys and plush toy ranges.
  • Functional Cookies: Used to remember your preferences, such as your currency (GBP) and language settings.
  • Targeting and Advertising Cookies: Placed by Meta (Facebook Pixel), Google Ads, and similar platforms to enable us to show you relevant Niwini advertisements after you leave our website. These may track your browsing activity across other websites.
  • Marketing/Email Cookies: Set by Klaviyo and Mailchimp to track email engagement and link behaviour.

6.2 Managing Cookies

When you first visit our website, you will be presented with a cookie consent banner. You may accept all cookies, reject non-essential cookies, or customise your preferences. You can update your cookie preferences at any time via the cookie settings link in our website footer.

You may also manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For more information about managing cookies, visit allaboutcookies.org.

7. International Data Transfers

As a UK-based business selling worldwide, some of our third-party service providers (including Google, Meta, Mailchimp, and Klaviyo) are based in the United States or other countries outside the UK and European Economic Area (EEA). When your personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, such as:

  • UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses (SCCs);
  • Transfers to countries with an adequacy decision from the UK Information Commissioner's Office (ICO) or European Commission;
  • Reliance on providers certified under applicable data transfer frameworks.

If you have questions about specific transfer mechanisms, please contact us at Support@niwini.com.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our specific retention periods are as follows:

  • Order and transaction records: Retained for 7 years from the date of the order in accordance with UK tax and accounting regulations (HMRC requirements).
  • Customer account data: Retained for the duration of your account and for 2 years following account closure or last activity, unless you request earlier deletion.
  • Marketing consent and email data: Retained until you withdraw consent (unsubscribe) or request deletion, plus a short period for record-keeping purposes.
  • Analytics data: Typically retained for 26 months by Google Analytics (anonymised). Internally aggregated analytics data may be retained indefinitely.
  • Cookie data: Session cookies are deleted when you close your browser. Persistent cookies expire according to the timeframes set by each individual cookie (typically between 30 days and 2 years).
  • Fraud prevention and legal compliance records: Retained for as long as necessary to investigate, detect, or prevent fraudulent activity, or as required by applicable law.
  • Support and communications: Customer service correspondence is retained for up to 3 years from the date of the last interaction.

When personal data is no longer required, it is securely deleted or anonymised so that it can no longer be linked to you.

9. Data Security

We take the security of your personal information very seriously and have implemented a range of technical and organisational measures to protect it:

  • SSL/TLS Encryption: All data transmitted between your browser and our website is encrypted using industry-standard SSL/TLS (Secure Sockets Layer / Transport Layer Security) protocols. This ensures that any information you enter — including your name, address, and payment details — is protected from interception during transmission.
  • Payment Security: We do not store your full payment card details on our servers. All card transactions are processed by PCI DSS-compliant payment processors — Stripe, PayPal, and Shopify Payments — which operate to the highest standards of financial data security. Only tokenised, non-sensitive references are retained where necessary for order management.
  • Access Controls: Access to personal data within our organisation is restricted on a strict need-to-know basis. Only authorised personnel who require access to fulfil their job responsibilities are permitted to view customer data, and all such individuals are subject to confidentiality obligations.
  • Secure Data Storage: Personal data is stored on secure servers provided by Shopify and our third-party service providers, all of which operate robust physical and digital security measures, including firewalls, intrusion detection systems, and regular security audits.
  • Data Minimisation: We collect only the personal data that is strictly necessary for the purposes described in this policy. We do not retain data beyond the periods outlined in Section 7.
  • Regular Security Reviews: We regularly review our data handling and security practices to identify potential vulnerabilities and to ensure our measures remain effective and up to date with current best practices.
  • Third-Party Security Standards: We require all third-party service providers who handle personal data on our behalf to implement equivalent security measures and to process data only in accordance with our documented instructions.
  • Incident Response: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware, in accordance with our obligations under UK GDPR. Where the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay.
  • Pseudonymisation and Anonymisation: Where appropriate, we apply pseudonymisation or anonymisation techniques to reduce the risk associated with processing personal data — particularly in analytics and testing environments.
  • Employee Awareness: All members of our team who handle personal data receive appropriate training and guidance on data protection obligations, ensuring that our commitment to your privacy is upheld at every level of the business.

While we implement all reasonable measures to protect your personal information