Who we are
Next Day is an online shop run by NEXTDAYUK LTD, a company registered in England and Wales (company number 17097970). Our registered office is 18 New Hall, Liverpool, Merseyside, L10 1LD.
We are the “data controller” for the personal information you give us or that we collect when you use www.nextday.com. That means we decide how and why it is used, and we are responsible for looking after it.
This policy explains what information we collect, what we do with it, who we share it with and what rights you have. It applies to everyone who visits the site, creates an account, places an order or signs up to our emails. Our Cookie Policy covers cookies separately.
If you have any questions, email privacy@nextday.com.
What information we collect
We only collect what we need to run the shop and deliver your orders.
Information you give us
- Your details — name, email address, phone number, billing address and delivery address.
- Your account — if you create one, your login email, password (stored encrypted, so we never see it), saved addresses and order history.
- Your orders — what you bought, when, how much you paid and any delivery instructions.
- Your messages — anything you send us by email, contact form or social media, including questions, complaints and returns requests.
- Marketing preferences — whether you have signed up to our emails or asked us to stop.
Payment details. We never see or store your full card number. Payments are handled by Stripe, who collect your card details directly on a secure form. We only receive confirmation that the payment went through, the last four digits of your card and the card type.
Information we collect automatically
- Device and browsing data — your IP address, browser type, device type, the pages you visit, how long you stay and the site you came from. Some of this is collected by cookies; see our Cookie Policy for details and how to switch them off.
- Order and delivery updates — tracking events from our couriers so we can show you where your parcel is.
Information from other people. Stripe tells us whether a payment succeeded or was flagged as suspicious. Couriers tell us whether a parcel was delivered.
How we use your information
UK data protection law says we need a valid reason (a “legal basis”) for everything we do with your information. The table shows what we do and why we are allowed to.
| What we do | What we use | Legal basis |
|---|---|---|
| Process and deliver your order | Name, addresses, phone, email, order details | Contract — we cannot fulfil your order without it |
| Take payment and prevent fraud | Payment confirmation from Stripe, IP address, order history | Contract, and our legitimate interest in not being defrauded |
| Send order confirmations, dispatch and delivery updates | Email, phone, tracking data | Contract |
| Run your account | Login details, saved addresses, order history | Contract |
| Answer your questions, complaints and returns | Your messages, order details | Contract, and our legitimate interest in good customer service |
| Send you marketing emails | Email, order history (to show relevant products) | Consent if you signed up; our legitimate interest if you are an existing customer (see Marketing below) |
| Understand how the site is used and improve it | Browsing data, analytics cookies | Consent for the cookies; our legitimate interest in running a site that works well |
| Show you our adverts on other sites | Advertising cookies | Consent |
| Keep records for tax and accounting | Order and payment records | Legal obligation — HMRC requires us to keep them |
| Deal with legal claims, disputes and chargebacks | Order, payment and message history | Our legitimate interest in defending our rights |
“Legitimate interest” means we have a genuine business reason that does not override your rights. You can object to any use based on legitimate interest; see Your rights below.
We do not make automated decisions about you that have a legal or similarly serious effect, and we do not sell your information to anyone.
Where your information is stored
Our website and database are hosted by Laravel Cloud on servers in the UK. Some of the companies we work with, including Stripe, Google and our email provider, are based in or use servers in the United States.
Whenever your information leaves the UK, we make sure it is protected to the same standard. We rely on one of the following:
- the company is certified under the UK Extension to the EU-US Data Privacy Framework, which the UK government has approved; or
- a contract containing the UK International Data Transfer Agreement or Addendum, which legally binds the company to protect your data.
You can ask us for more detail about these safeguards using the contact details at the end.
How long we keep your information
We keep your information only as long as we need it for the reason we collected it, or as long as the law requires.
| Information | How long | Why |
|---|---|---|
| Order and payment records | 6 years after the end of the tax year of the order | HMRC requires it, and it covers the time limit for legal claims |
| Account details | Until you close your account, or after 3 years with no orders or logins | So your details are there when you come back |
| Customer service messages | 2 years after the issue is resolved | In case the same issue comes up again |
| Marketing list | Until you unsubscribe, then your email stays on a suppression list so we do not accidentally email you again | To respect your opt-out |
| Browsing and analytics data | As set out in the Cookie Policy (up to 2 years) | Set by the cookie providers |
When we no longer need information, we delete it or anonymise it so it can no longer be linked to you. If you ask us to delete your account, we remove it straight away but keep the order records above for as long as the law requires.
Marketing
We send emails about new products, offers and news. You will only get them in one of two situations:
- You signed up. You ticked a box at checkout or entered your email on our newsletter form. This is your consent, and you can withdraw it at any time.
- You are a customer. If you have bought from us, we may email you about similar products. The law allows this (it is called a “soft opt-in”) as long as we gave you a clear chance to say no when you bought, and in every email after that.
Every marketing email has an unsubscribe link at the bottom. You can also opt out by emailing privacy@nextday.com or, if you have an account, in your account settings. We will stop within a few days. Unsubscribing does not stop order confirmations or delivery updates, which we have to send.
We do not send marketing by text message or post, and we do not pass your details to other companies for their marketing.
Your rights
UK GDPR gives you rights over your information. You can:
- See it — ask for a copy of the information we hold about you.
- Correct it — ask us to fix anything that is wrong or out of date. If you have an account, you can do most of this yourself.
- Delete it — ask us to erase your information. We will, unless the law requires us to keep it (for example order records for HMRC).
- Pause it — ask us to stop using your information while we sort out a dispute about it.
- Object — tell us to stop using your information where we rely on legitimate interest, and to stop marketing to you at any time.
- Take it with you — ask for your information in a format you can give to another company.
- Withdraw consent — where we rely on your consent (marketing sign-ups, optional cookies), you can withdraw it at any time. This does not affect anything done before you withdrew it.
To use any of these rights, email privacy@nextday.com. We may ask you to confirm who you are first. We will reply within one month, or tell you if we need longer for a complicated request. There is no charge unless a request is clearly unfounded or excessive.
Complaints. If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
Security
We protect your information with encryption (the site runs over HTTPS), password hashing, access controls so only staff who need it can see it, and regular software updates. No system is completely secure, so if we ever discover a breach that puts you at risk we will tell you and the ICO as the law requires.
Children
Our shop is for adults. We do not knowingly collect information from anyone under 18. If you think a child has given us their details, email us and we will delete them.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If we make a significant change, we will let you know by email or a notice on the site.
Contact us
- Email: privacy@nextday.com
- Post: NEXTDAYUK LTD, 18 New Hall, Liverpool, Merseyside, L10 1LD
