Privacy Policy

Last updated: 17 June 2026

This Privacy Policy explains how BigNomad Ltd ("BigNomad", "we", "us") collects, uses and protects personal data when you visit bignomad.com, place an order, book an appointment, or contact us. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

The data controller is BigNomad Ltd, a company registered in England and Wales (company number 14782301), with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are registered with the Information Commissioner's Office (ICO) under registration number ZB789456.

Our Data Protection Officer is Harriet J. Lockwood, contactable at [email protected].

2. The data we collect

Identity & contact data — name, email, telephone, delivery and billing address.
Order data — items purchased, order value, delivery details, payment confirmation reference (we do not store full card numbers).
Communication data — content of emails, enquiry forms and appointment requests.
Technical data — IP address (in truncated form), browser type, device, pages viewed and referring URL.
Marketing data — your preferences for receiving communications from us.

3. How we use your data and our lawful bases

Purpose	Lawful basis
To fulfil an order or repair	Performance of a contract
To respond to an enquiry or appointment request	Consent and our legitimate interest in responding to you
Accounting, tax and statutory record-keeping	Legal obligation (HMRC requirements)
Fraud prevention and security	Legitimate interest
Direct marketing emails (where you have opted in)	Consent
Site analytics	Consent (via the cookie banner)

4. Who we share data with

We share personal data only with processors acting on our instructions, under written contracts:

Payment providers — Stripe Payments UK Ltd for card processing.
Carriers — Royal Mail Group Ltd and DHL Parcel UK Ltd for deliveries.
Email infrastructure — Fastmail Pty Ltd / Mailgun Technologies Inc.
Hosting — our website is hosted on UK-based infrastructure.
Professional advisers — accountants and legal counsel where required.
Authorities — where we are required to disclose by law (for example, HMRC or law enforcement).

5. International transfers

Where a processor is located outside the UK, we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses, and apply additional safeguards where appropriate.

6. How long we keep data

Order and accounting records — 6 years (Companies Act 2006 / HMRC).
Enquiry correspondence — 24 months from last contact.
Marketing consent records — until withdrawn, plus 12 months.
Server logs — 30 days, with IP truncation after 14 days.

7. Your rights

You have the right to: access your data; ask us to correct or delete it; restrict or object to processing; withdraw consent at any time; receive a copy of your data in a portable format; and lodge a complaint with the Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113). To exercise any right, write to [email protected]. We will respond within one month.

8. Security

We use TLS encryption across the site, role-based access controls in our systems, and we keep no full payment card numbers on our servers.

9. Children

Our site is not directed at children under 16 and we do not knowingly collect their data.

10. Changes

We will post any changes to this policy on this page and update the date above. Material changes will be notified by email where you are subscribed.