Privacy policy
NaldoBox ("we", "us") respects your privacy. This policy explains what personal data we collect, why we use it, how long we keep it and the rights you have under the UK GDPR and the Data Protection Act 2018. If Brazil's data protection law (LGPD) applies to you, you have the same rights.
Last updated: 20 October 2026.
Who we are
The data controller is NaldoBox. You can contact us about your data at contact@naldobox.com.
London
What we collect, why and for how long
| What | Why | Legal basis | How long we keep it |
|---|---|---|---|
| Your name, e-mail address, phone number, delivery address and the items you buy | To take payment, deliver your order, keep you updated by e-mail and handle returns. Couriers may contact you by phone about your delivery. | Contract | 6 years after your order, to meet UK tax and accounting rules. After that, we anonymise the order. |
| The details you enter at checkout if you don't complete your payment | To keep a record of checkouts that weren't completed and to help you if you contact us about them. We won't send you offers unless you subscribe. | Legitimate interests | 30 days |
| Your IP address and browser type when you place an order | To prevent fraud and keep the shop secure. | Legitimate interests | 90 days after your order is completed, cancelled or refunded, and no more than 6 months after you place it |
| Your e-mail address, if you subscribe to our offers | To send you news and offers by e-mail. | Consent, confirmed by e-mail | Until you unsubscribe. If you haven't bought from us, we delete your details 30 days after you unsubscribe. |
| Product reviews: the name you choose to show, your rating and your comments | To publish genuine reviews from customers who bought the product. | Legitimate interests | As long as the review is published. You can ask us to remove it, or just your name, at any time |
| Messages you send us | To answer your questions and solve problems with your order. | Contract or legitimate interests | As long as we need to deal with your request, and no more than 2 years |
Card details are entered directly into Stripe's secure payment form. We never see or store your full card number.
Who we share it with
- Stripe, our payment provider, which also checks payments for fraud. For some of this data Stripe is an independent controller: see Stripe's privacy policy.
- Our suppliers and their couriers, including sellers on marketplaces such as AliExpress and Alibaba. They receive only what they need to ship your order: your name, delivery address and phone number.
- Our service providers: the company that hosts this website and its database, and the company that sends our e-mails. They only act on our instructions.
- Public authorities, when the law requires it.
We never sell your personal data.
Transfers outside the UK
Our suppliers are mainly based in China, and our business and service providers may be located outside the UK. Sharing your delivery details with suppliers abroad is necessary to deliver the order you asked for. For other transfers, we use the safeguards recognised by UK law, such as the International Data Transfer Addendum, where our providers offer them.
Marketing e-mails
We only send news and offers if you ask for them, by subscribing on our website or ticking the box at checkout. We then e-mail you a link, and you're only subscribed after you click it to confirm. The link is valid for 7 days; if you don't confirm, you won't be subscribed. We keep a record of when and how you subscribed.
You can unsubscribe at any time using the link in our e-mails or on our unsubscribe page. Order e-mails, such as confirmations and delivery updates, are part of your purchase and will still be sent.
Cookies and browser storage
We don't use analytics or advertising cookies. We only store what the shop needs to work, or what you choose:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| lang | Cookie | Remembers the language you chose | 1 year |
| theme | Cookie | Remembers light or dark mode, if you choose one | 1 year |
| cart:v1 | Browser storage | Keeps the items in your bag | Until you order or empty your bag |
| checkout-draft | Browser storage | Saves the details you typed at checkout so you don't lose them | Until you pay; after 24 hours it's ignored and deleted |
| checkout-session | Browser storage (this tab only) | Links this tab to your order while you pay | Until you close the tab |
| __stripe_mid, __stripe_sid | Cookies set by Stripe | Fraud prevention during payment | 1 year and 30 minutes |
If we ever add analytics or advertising cookies, we'll ask for your consent first.
Automated decisions
We don't make decisions about you based only on automated processing, and we don't build marketing profiles. Stripe automatically screens payments for fraud and may block a payment it considers risky. If that happens, contact us and we'll help.
Your rights
You can ask us to:
- tell you what data we hold about you and send you a copy, including in a portable format;
- correct data that's wrong or incomplete;
- delete your data;
- restrict or object to how we use it;
- withdraw your consent at any time, without affecting what we did before.
Some data, such as order records, must be kept for tax reasons even if you ask us to delete it. In that case, we remove everything else and keep only what the law requires. Deleted data also disappears from our backups within 30 days. Stripe and our suppliers keep their own records under their own privacy policies.
To make a request, e-mail contact@naldobox.com. We'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk. If the LGPD applies to you, you can also complain to Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.
Changes to this policy
If we change this policy, we'll publish the new version on this page and update the date at the top.