Privacy notice
Who is responsible for your data
(trading as ), , is the controller of the personal data described here. Contact: . ICO registration number: .
What we collect
- Details you enter at checkout: name, email, phone (optional) and delivery address.
- Your order: products, quantities, amount and order reference.
- Your IP address, used briefly to limit repeated checkout attempts.
- If you join the referral scheme: your email address and your code.
- For every order: a keyed hash of your email address and delivery postcode (which we cannot turn back into the address), the order reference and amounts, and whether a referral code was used.
- Emails you send us.
Order data may imply health-related information about you. We keep it only as described below and never use it for marketing.
Where your order is kept
Your order details — your name, contact details (email and phone), delivery address and the items you ordered — are stored in the shop's database on Cloudflare, and a copy is emailed to the shop's own inbox.
Why we use it and our lawful basis
- To take payment, deliver your order and handle cancellations and returns — performing our contract with you.
- To keep tax and accounting records — legal obligation.
- To prevent fraud and abuse, including rate-limiting checkout — our legitimate interests.
- To run the referral scheme, apply discounts and credit, and prevent its abuse — performing our contract with you and our legitimate interests.
Who we share it with
- Niftipay, operated by Retailrus Ltd (Malta), and its card processor, to take your payment.
- Cloudflare, which hosts the shop and its database.
- Our email provider, to send order emails.
- Our delivery courier, to deliver your order.
A referral code's owner is told only that a reward was earned, never who ordered or what. The referral key email goes only to an address that asked for a code or a key.
We and some of these providers are outside the UK, so your data may be processed abroad.
Automated fraud screening by the payment provider
When you pay, the payment provider checks the last 4 digits and issuing range (BIN) of your card, your email address and your IP address against disputed payments on this and other merchants' accounts. Payments from VPN, TOR or proxy connections are blocked, and an IP address or email may be blocked automatically after repeated payment disputes. If you think you were blocked in error, contact us via the contact page.
How long we keep it
- Orders that were never paid: your name, contact details and delivery address are deleted from the database after 30 days.
- Paid orders: kept for 6 years for tax purposes; then your name, contact details and delivery address are deleted from the database.
- The copies of order details in the shop's email are deleted on the same schedule.
- Referral orders that were never paid: deleted 30 days after they were placed. Paid referral orders: 6 years.
- Your referral code and balance: until you ask us to delete them.
Cookies and storage
We count visits with Cloudflare Web Analytics, which sets no cookies and stores nothing on your device. For each page view Cloudflare receives the page address, the page you came from, your browser and device type, your approximate country and how fast the page loaded, and it shows us only totals, never who you are. We don't use tracking cookies.
Your cart is saved in your browser's local storage so it survives a page refresh, and the discount or credit line of an order you have just placed is kept in your browser's session storage until the order-complete page has shown it; both are strictly necessary for the shop to work. We also keep five small notes in your browser's local storage: the time you confirmed the entry check, so it is not shown again for a year; a summary of the order you have just placed, so the order-complete page can show it; the date and landing page of your first visit and of your latest visit from another website, a campaign tag or a share link, with the website, campaign tag or share-link code that brought you, so we can tell which links bring visitors; and the code of a share link you followed, kept until an order is complete so checkout can fill it in. The visit notes reach us only with an order, as part of that order's record. Clearing this site's data in your browser deletes all five. Fonts are served from this site, not from third parties.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to our use of it, or ask us to restrict it. Email . You can also complain to the Information Commissioner's Office (ico.org.uk).