Privacy policy

Privacy Policy

Last updated: 18 August 2026

1. Who we are

Something & Nothing is operated by Modern Contradiction Limited ("Something & Nothing", "we", "us" or "our"). We are the controller of the personal data described in this policy.

Our UK details are:

Registered office: 1 Brassey Road, Old Potts Way, Shrewsbury, Shropshire, England, SY3 7FA

Company number: 10928856

UK VAT number: GB290269586

Email: george@somethingnothing.co

For our activities in the European Union, our Netherlands establishment and EU contact point is:

Modern Contradiction Limited

Herengracht 449A, 1017 BR Amsterdam, Netherlands

KVK number: 80341349

Establishment number: 000046702288

Netherlands VAT/EORI number: NL861637793B01

Email: george@somethingnothing.co

This policy applies when you visit or buy from somethingandnothing.co, create an account, start or manage a subscription, contact us, sign up for marketing or otherwise interact with our UK/EU online store.

2. Personal data we collect

Depending on how you interact with us, we may collect:

Identity and contact data: name, email address, billing and delivery addresses, account details and any contact information you provide.

Order and subscription data: products ordered, order value, delivery method, order history, subscription plan, frequency, status, cancellations, discounts, refunds and related communications.

Payment and transaction data: payment method, payment status, billing details, transaction identifiers and limited card information supplied by payment providers. We do not normally receive or store your full payment-card number.

Customer-service data: messages, attachments, photographs of damaged or incorrect goods, complaint details and our responses.

Device and usage data: IP address, browser and device type, operating system, time zone, pages and products viewed, links clicked, referring pages, session information, cookie identifiers and interaction data.

Marketing and preference data: newsletter subscription, consent records, marketing preferences, campaign engagement and cookie choices.

Fraud and security data: risk indicators, IP address, payment and order signals, suspected misuse and the outcome of automated or manual checks.

Trade-enquiry data: business contact details and information supplied when you contact us about wholesale or trade purchasing.

Please do not send us special-category personal data or unnecessary identity documents unless we specifically ask for them and explain why they are needed.

3. How we collect personal data

We collect data:

directly from you when you order, create an account, subscribe, contact us, make a return request or join our mailing list;

automatically through Shopify, cookies, pixels, tags, local storage and similar technologies, subject to your consent choices where required;

from service providers involved in payments, fraud prevention, subscriptions, fulfilment, delivery, customer support, analytics and advertising;

from platforms through which you choose to interact with us, such as Google or Meta services; and

from publicly available sources or business contacts where relevant to a trade enquiry.

4. Why we use personal data and our lawful bases

We use personal data only where we have a lawful basis. The principal purposes and bases are:

Purpose	Data normally used	Lawful basis
Process and fulfil orders, take payment, send confirmations, arrange delivery and handle returns or refunds	Identity, contact, order, payment and transaction data	Performance of our contract with you
Create and administer customer accounts	Identity, contact, account and order data	Performance of our contract with you
Create and administer recurring subscriptions, including renewals, skips, pauses and cancellations	Identity, contact, order, subscription and payment data	Performance of our contract with you
Answer questions, resolve complaints and provide customer support	Identity, contact, order and customer-service data	Performance of our contract; and our legitimate interest in providing effective support and protecting our business
Detect, prevent and investigate fraud, abuse, security incidents and unlawful activity	Transaction, device, usage, fraud and security data	Our legitimate interests in preventing fraud and securing our services; and, where applicable, compliance with legal obligations
Keep accounting, tax, regulatory and corporate records	Identity, order, transaction and payment data	Compliance with legal obligations
Operate, troubleshoot and protect the website and services	Device, usage, account and security data	Our legitimate interests in running a secure and reliable online business; consent where storage or access technologies require it
Measure site use and improve our store, products and communications	Device, usage, order and campaign data	Your consent for non-essential cookies and similar technologies; in limited cases, our legitimate interests where the law permits processing without consent
Personalise advertising and measure advertising performance	Device, usage, marketing and order-event data	Your consent
Send email marketing	Identity, contact, marketing and preference data	Your consent, or the electronic-marketing "soft opt-in" where legally available and you were offered a clear opt-out
Manage trade enquiries and introduce appropriate trade channels	Business contact and enquiry data	Steps requested before entering a contract and our legitimate interests in developing our business
Establish, exercise or defend legal claims and manage corporate transactions	Relevant identity, contact, order, transaction, support and security data	Our legitimate interests in protecting our legal and commercial position; and legal obligations where applicable

 

Where we rely on legitimate interests, we consider the purpose, necessity and impact on your rights. You can object to processing based on legitimate interests as explained below.

5. When information is required

Information marked as required at checkout or during account or subscription setup is needed to enter into or perform a contract with you. If you do not provide it, we may be unable to accept an order, take payment, deliver products, administer a subscription or respond properly to a request. Other information is optional.

6. Cookies, analytics and advertising

We use essential technologies to operate the store and, if you consent, technologies for functionality, analytics and advertising. Our current services may include Shopify, Google and YouTube, Meta/Facebook, Littledata, Mailchimp, Intercom, Cloudflare and Pandectes.

Our Cookie Policy explains the categories, purposes and typical lifetimes of these technologies. You can accept, reject or change non-essential cookie choices through the cookie settings control on the website. Withdrawing consent does not affect processing that took place before withdrawal.

Shopify Network Intelligence is enabled for the store. Shopify may use data from participating merchants to provide security, measurement, personalisation and advertising-related services as described in Shopify's own privacy materials. Where this activity depends on non-essential storage, tracking or advertising, it must follow your consent choice.

7. Email marketing

If you sign up for email marketing, we use Mailchimp to send and measure our emails. You can unsubscribe at any time using the link in any marketing email or by contacting george@somethingnothing.co. We may keep a minimal suppression record so that we can honour your request. Unsubscribing from marketing does not stop service messages about an order, account, subscription or legal change.

We do not currently use SMS marketing.

8. Who we share personal data with

We may share relevant data with:

Shopify, which hosts the store and provides checkout, payments, fraud tools, customer accounts and ecommerce infrastructure;

payment providers and wallets, including Shopify Payments and providers supporting Visa, Mastercard, American Express, Shop Pay, Apple Pay and Google Pay;

Recharge, to operate subscriptions and recurring payments;

Mailchimp, for email marketing and associated measurement;

Intercom, for customer service and messaging;

analytics and advertising providers, where enabled and permitted by your choices, including Google, YouTube, Meta/Facebook and Littledata;

Pandectes, to manage and record cookie and privacy choices;

Cloudflare and other security, hosting and technical providers, to deliver and protect the website;

fulfilment, warehouse and delivery providers, including fulfilmentcrowd GmbH for EU fulfilment and returns, DPD where used in the UK, and other carriers selected for the destination;

business systems and professional advisers, such as accounting, inventory, workflow, data integration, legal, insurance and audit providers, where they need the data to provide services;

regulators, courts, law-enforcement bodies and public authorities, where disclosure is required or legally permitted; and

a buyer, investor or adviser in connection with a proposed or completed sale, restructuring or financing of all or part of our business, subject to appropriate confidentiality and data-protection measures.

Some providers act as our processors and may use data only on our instructions. Others, such as payment providers, carriers or advertising platforms, may also act as separate controllers for their own activities. Their privacy notices explain those activities.

We do not sell personal data in the ordinary meaning of selling it for money.

9. International transfers

We operate in the UK and EU, and some providers or their support teams may process data in other countries, including the United States and Canada. Where personal data is transferred outside the UK or European Economic Area, we use a lawful transfer mechanism as required. This may include an adequacy regulation or decision, the European Commission's standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, together with supplementary safeguards where appropriate.

You can ask for more information about the relevant safeguards by emailing george@somethingnothing.co. We may redact confidential commercial information from copies we provide.

10. Automated fraud checks

Shopify and payment providers may assess an order using automated risk signals such as payment details, order history, delivery and billing information, device data and IP address. A high-risk result may cause an order to be paused, refused or cancelled, and we may also carry out a manual review.

If you believe an order was incorrectly affected, email george@somethingnothing.co and ask for a human review. We will consider the information available and explain the outcome where the law requires us to do so.

11. How long we keep personal data

We keep data only for as long as reasonably necessary for the purposes described above, including legal, accounting and dispute requirements. Our usual periods are:

order, invoice, payment and tax records: 7 years after the relevant transaction or financial period;

customer-service and complaint records: 3 years after the matter is closed, longer where a dispute or legal claim requires it;

inactive customer accounts: normally 2 years after the last activity, unless order records must be retained separately;

email-marketing records: until you unsubscribe or after 24 months of inactivity, subject to periodic review;

minimal marketing suppression records: for as long as needed to respect the opt-out;

records evidencing consent: normally 6 years after the relevant consent or withdrawal record;

analytics data under our control: normally up to 14 months, unless a shorter setting applies; and

fraud, security and legal-claim records: for as long as reasonably necessary in view of the risk, limitation period or legal duty.

Service providers may keep data for different periods where they are independently required or permitted to do so. We delete or anonymise data when it is no longer needed.

12. Your data-protection rights

Depending on the law and circumstances, you may have the right to:

obtain access to your personal data and a copy of it;

correct inaccurate or incomplete data;

ask us to delete data;

restrict how we use data;

receive certain data in a portable format or ask us to transmit it to another organisation;

object to processing based on legitimate interests;

withdraw consent at any time, without affecting earlier lawful processing; and

ask for human intervention where a solely automated decision has legal or similarly significant effects.

You have an absolute right to object at any time to the use of your personal data for direct marketing. Use the unsubscribe link in an email or contact george@somethingnothing.co.

These rights are not absolute. We may need to verify your identity and may retain information where the law requires it or an exemption applies. We normally respond within one month, although the law allows an extension for complex or numerous requests.

13. Complaints

Please contact us first at george@somethingnothing.co so that we can try to resolve your concern.

UK customers may complain to the Information Commissioner's Office (ICO) at ico.org.uk. EU customers may complain to the supervisory authority in the EU country where they live or work, or where the alleged infringement occurred. You may also contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

14. Security

We use appropriate organisational and technical measures intended to protect personal data. No online service is completely secure, and we cannot guarantee absolute security. You are responsible for keeping account credentials confidential and notifying us if you suspect unauthorised access.

15. Children

The store is not directed to children under 16, and we do not knowingly collect personal data from children under 16 for marketing or account purposes. If you believe a child has provided personal data to us, contact us so that we can investigate and take appropriate action.

16. Changes to this policy

We may update this policy when our services, providers or legal obligations change. We will post the updated version and change the date above. If a change materially affects how we use personal data, we will provide additional notice where required.

17. Contact us

For privacy questions or rights requests, email george@somethingnothing.co or write to:

 

1 Brassey Road
Old Potts Way
Shrewsbury
Shropshire
England
SY3 7FA

EU correspondence may also be sent to:

Modern Contradiction Limited
Herengracht 449A
1017 BR Amsterdam
Netherlands