Privacy Policy

Woodlands Biohack is Woodlands Biohack Limited, a private limited company registered in England and Wales (company number 17490886), with its registered office at 1g Brighouse Road, Middlesbrough, England, TS2 1RT.

We supply exclusively to business customers as a business-to-business wholesale supplier.

For the purposes of applicable UK data-protection legislation, Woodlands Biohack will generally act as the data controller in relation to personal information described in this Privacy Policy.

Our current details are:

• Trading name: Woodlands Biohack
• Company: Woodlands Biohack Limited — registered in England and Wales, company number 17490886
• Registered office: 1g Brighouse Road, Middlesbrough, England, TS2 1RT
• Email: admin@woodlandsbiohack.com
• Website: woodlandsbiohack.com

References in this Privacy Policy to “Woodlands Biohack”, “we”, “our” or “us” refer to Woodlands Biohack.

References to “you” or “your” refer to individuals whose personal information we process, including business customers, prospective customers, representatives of business customers, suppliers, contractors and website visitors.

We process personal information in accordance with applicable UK data-protection and privacy legislation.

This includes, where applicable:

• the UK General Data Protection Regulation (“UK GDPR”);
• the Data Protection Act 2018;
• the Privacy and Electronic Communications Regulations 2003 (“PECR”), as amended; and
• other applicable UK privacy and electronic-communications legislation.

Our approach is based upon the principles that personal information should be processed lawfully, fairly and transparently and should be appropriate, relevant and limited to what is necessary for the relevant purpose.

“Personal data” or “personal information” means information relating to an identified or identifiable living individual.

It may include information that identifies someone directly, such as their name, or information that can identify them when combined with other information.

Business information that relates solely to a legal entity may not itself constitute personal data.

However, information relating to an identifiable employee, director, sole trader, business owner or business contact may constitute personal data even where it is provided in a business context.

Depending upon how you interact with Woodlands Biohack, we may collect and process the following categories of information.

4.1 Identity information

This may include:

• first name;
• surname;
• business contact name;
• job title;
• position within an organisation; and
• account username or identifier.

4.2 Business information

This may include:

• business name;
• trading name;
• business type;
• company registration number where applicable;
• VAT number where applicable;
• business address;
• billing address;
• delivery address;
• business website;
• nature of business;
• trade-account information; and
• information provided to demonstrate eligibility for B2B purchasing.

4.3 Contact information

This may include:

• email address;
• telephone number;
• business address;
• billing address;
• delivery address;
• social-media or messaging contact details.

4.4 Order and transaction information

This may include:

• products ordered;
• quantities;
• order values;
• quotations;
• invoices;
• transaction dates;
• payment status;
• discounts;
• shipping method;
• delivery status;
• tracking information;
• returns;
• refunds;
• credits;
• complaints;
• previous orders; and
• other information associated with a transaction.

4.5 Payment information

Depending upon the payment method used, payment information may include:

• payment method;
• transaction reference;
• payment status;
• bank-transfer reference;
• partial payment-card information provided by a payment processor;
• billing information; and
• information required to investigate disputed or fraudulent payments.

We do not ordinarily intend to directly store complete payment-card numbers, card security codes or other full card credentials where payment is handled by an external payment processor.

Payment providers process card and banking information according to their own security and privacy arrangements.

4.6 Communications

We may retain communications exchanged with you, including:

• emails;
• website enquiries;
• support requests;
• quotations;
• telephone notes;
• WhatsApp or other business messaging communications where used;
• social-media messages;
• complaints;
• feedback;
• delivery enquiries;
• account enquiries; and
• other business correspondence.

4.7 Website and technical information

When you access our website, certain technical information may be collected automatically.

Depending upon the technologies enabled on our website, this may include:

• IP address;
• browser type;
• browser version;
• operating system;
• device type;
• approximate geographic information derived from an IP address;
• referring website;
• pages viewed;
• links clicked;
• session information;
• timestamps;
• website interaction information;
• cookie identifiers;
• device identifiers;
• security logs; and
• diagnostic information.

4.8 Marketing information

Where applicable, we may maintain information concerning:

• marketing preferences;
• newsletter subscriptions;
• marketing consent;
• consent date and method;
• unsubscribe requests;
• objections to direct marketing;
• communication preferences;
• campaign interactions; and
• suppression-list information.

4.9 Fraud and security information

Ambassador referrals

With optional first-party tracking consent we store an anonymous referral token, ambassador reference and timestamps for a default 30-day attribution window. Valid referral codes can attribute an order without this storage. We retain commission and payout records for programme administration and financial audit. Ambassadors receive only minimal order references, eligible sale and commission figures; they never receive customer identities, contact details, addresses, payment details or internal notes. Withdrawal clears optional referral storage and stops future link attribution on that device.

We may process information relevant to preventing fraud, protecting our website and investigating suspicious transactions.

This may include:

• IP addresses;
• device information;
• unusual account activity;
• failed login attempts;
• suspicious order patterns;
• payment-risk information;
• chargeback information; and
• information supplied by payment or fraud-prevention providers.

As a B2B wholesale supplier, Woodlands Biohack does not ordinarily need to collect special-category personal data such as information about:

• health;
• ethnicity;
• religion;
• political opinions;
• sexual orientation;
• genetic information; or
• biometric information used for identification.

Please do not provide special-category personal information unless there is a genuine and lawful reason for doing so.

Our products are supplied on a B2B basis for their stated research purposes. Customers should therefore not submit personal medical histories, diagnoses or other unnecessary health information when placing an order or contacting us.

If special-category information is provided to us unexpectedly, we will handle it in accordance with applicable law and may delete it where it is unnecessary.

We may obtain personal information:

Directly from you

For example when you:

• create an account;
• apply for a trade account;
• place an order;
• request a quotation;
• make a payment;
• contact us;
• complete a website form;
• subscribe to communications;
• communicate through social media;
• make a complaint; or
• request customer support.

Automatically

Certain technical information may be generated when you interact with our website through cookies, server logs and similar technologies.

From service providers

We may receive information from organisations involved in providing services to us, including:

• payment providers;
• delivery companies;
• website providers;
• fraud-prevention providers;
• ecommerce platforms;
• accounting services; and
• other technology providers.

From publicly available business sources

Where appropriate for legitimate B2B activities, we may obtain professional contact information from:

• company websites;
• business directories;
• professional directories;
• Companies House;
• professional networking platforms; or
• other legitimate publicly accessible sources.

Where personal data obtained from another source is used, we will comply with applicable transparency requirements.

We may process personal information for the following purposes.

7.1 Providing products and services

We use information to:

• process orders;
• supply products;
• issue quotations;
• provide invoices;
• administer business accounts;
• process payments;
• arrange deliveries;
• manage returns;
• provide refunds or credits;
• communicate about orders; and
• provide customer support.

7.2 Verifying B2B customers

Because Woodlands Biohack operates on a B2B wholesale basis, we may use information to establish whether a purchaser represents a genuine business or professional organisation.

7.3 Operating our website

We process technical information where necessary to:

• operate the website;
• maintain functionality;
• maintain shopping-cart functionality;
• maintain account sessions;
• protect website security;
• identify technical problems; and
• improve website performance.

7.4 Accounting and financial administration

We may process information to:

• maintain transaction records;
• reconcile payments;
• prepare accounts;
• issue invoices;
• maintain tax records;
• process refunds; and
• meet accounting or taxation requirements.

7.5 Fraud prevention

Information may be used to:

• verify transactions;
• identify suspicious activity;
• prevent fraudulent purchases;
• investigate chargebacks;
• protect payment systems; and
• protect Woodlands Biohack and its customers.

7.6 Legal and regulatory compliance

We may process information where necessary to:

• comply with legislation;
• respond to lawful requests;
• establish, exercise or defend legal claims;
• comply with tax obligations;
• maintain legally required records;
• comply with court orders;
• cooperate with regulators or law-enforcement authorities where legally required; and
• protect our legal rights.

7.7 Business improvement

We may analyse appropriately limited information to:

• understand customer demand;
• improve our website;
• improve our product range;
• improve customer service;
• identify operational problems;
• analyse business performance; and
• develop our business.

7.8 Marketing

Subject to applicable law, we may use contact information to communicate about:

• products;
• new products;
• wholesale availability;
• price lists;
• promotions;
• services;
• business updates; and
• other information that may reasonably be relevant to our business customers.

UK data-protection law requires us to have a lawful basis for processing personal data.

Depending upon the circumstances, Woodlands Biohack may rely upon one or more of the following bases.

8.1 Contract

We may process personal information where it is necessary to perform a contract with you or to take steps at your request before entering into a contract.

Examples include:

• processing orders;
• managing accounts;
• arranging delivery;
• processing payments;
• communicating about an order;
• managing returns or refunds.

8.2 Legal obligation

We may process information where necessary to comply with a legal obligation.

Examples may include:

• accounting;
• tax records;
• fraud-related obligations;
• regulatory requirements;
• responding to legally valid requests.

8.3 Legitimate interests

We may process personal information where necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by the individual’s rights and freedoms.

Our legitimate interests may include:

• operating and improving our business;
• managing B2B customer relationships;
• maintaining website security;
• preventing fraud;
• recovering debts;
• protecting our legal rights;
• analysing business performance;
• responding to enquiries;
• maintaining suppression lists;
• communicating appropriately with business contacts; and
• appropriate B2B marketing where permitted by law.

Where legitimate interests are relied upon, we consider the necessity and proportionality of the processing and its potential impact on individuals.

8.4 Consent

Where consent is required, we may process information on the basis of your consent.

Examples may include certain:

• electronic marketing communications;
• non-essential cookies;
• analytics technologies;
• advertising technologies; or
• other optional processing.

Where we rely upon consent, you may withdraw that consent.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

When a business places an order, certain information is required to fulfil the transaction.

If required information is not provided, we may be unable to:

• verify the Customer;
• accept an order;
• process payment;
• deliver products;
• issue invoices; or
• provide customer support.

We will aim to collect only information reasonably necessary for the relevant purpose.

Woodlands Biohack may market products and services to businesses in accordance with applicable UK data-protection and electronic-marketing legislation.

Different rules can apply depending upon whether the recipient is a corporate subscriber, sole trader, partnership or other type of recipient.

Where personal data is used for B2B marketing, we will maintain an appropriate lawful basis.

Where consent is legally required for electronic marketing, we will seek appropriate consent unless another lawful route, such as an applicable soft opt-in, is available.

Marketing communications will identify Woodlands Biohack and provide an appropriate method for recipients to unsubscribe or object.

You have the right to object at any time to the processing of your personal data for direct-marketing purposes.

If you object, we will stop using your personal information for that direct-marketing purpose.

You can unsubscribe using the mechanism contained in a marketing communication or contact admin@woodlandsbiohack.com.

We may retain limited information on a suppression list after an opt-out.

This is not for continued marketing. It enables us to remember that you have opted out and helps prevent your details from accidentally being added to marketing again.

Our website may use cookies and similar storage or access technologies.

These technologies may be used for purposes such as:

• essential website functionality;
• maintaining shopping baskets;
• remembering account sessions;
• maintaining security;
• remembering preferences;
• measuring website performance;
• analytics; and
• advertising or marketing where enabled.

Some technologies are necessary for the website to function.

Other technologies may require your consent before they are used.

Where consent is required, non-essential technologies will not be intentionally activated until the appropriate consent has been obtained.

At the time of writing, our website uses the following browser storage (we do not currently use advertising pixels or third-party analytics services):

• Strictly necessary — research-access confirmation (session), your cookie choice, your shopping basket and saved comparison/favourites, and sign-in session data for customer and admin accounts;
• Analytics (only if you choose “Accept all”) — a random visitor and session identifier used to record pages viewed and basket activity on our own systems, together with approximate location, internet provider and device type derived from your connection. Raw visitor analytics are deleted automatically after 90 days.

You can change your choice at any time using the “Cookie settings” link in the website footer.

Where enabled and permitted by law, we may use analytics services to understand how visitors interact with our website.

Analytics information may help us understand:

• visitor numbers;
• popular pages;
• navigation patterns;
• website errors;
• device categories;
• traffic sources; and
• general website performance.

We do not use third-party analytics services. Our analytics are first-party records stored in our own database and only collected after you choose “Accept all” or enable Analytics in Cookie settings. Without that choice, no analytics identifier is stored on your device; we only keep basic hits from recognised search-engine crawlers.

If Woodlands Biohack uses advertising, remarketing, conversion tracking, pixels or similar technologies, those technologies will be implemented in accordance with applicable requirements.

Where consent is legally required, advertising or tracking technologies will not be intentionally activated until consent has been obtained.

You should be able to manage relevant choices through the website’s cookie or privacy controls.

We do not sell personal information as a standalone commercial product.

However, we may share information with trusted third parties where necessary for legitimate business purposes.

These may include:

Payment providers

For processing transactions, refunds, fraud checks and payment disputes.

Banks and financial institutions

For receiving and reconciling payments and investigating transactions.

Delivery and logistics providers

For delivering orders and providing tracking information.

Information shared may include a recipient’s:

• name;
• business name;
• delivery address;
• email address;
• telephone number; and
• information necessary for delivery.

Website and ecommerce providers

For hosting and operating our website, databases, checkout functionality and associated services.

IT and cloud providers

For email, hosting, backups, data storage, cybersecurity and business systems.

Accounting providers

For bookkeeping, invoicing, accounting and financial administration.

Marketing providers

Where lawfully used, service providers may assist with email distribution, customer communications, analytics or advertising.

Providers we currently use

• Website hosting and delivery: Lovable and Cloudflare;
• Database, customer accounts and sign-in: Lovable Cloud (built on Supabase);
• Card payments: Teya; pay-by-bank payments: Wallid;
• Order, account and shipping emails: our website’s built-in email service (Lovable); our business inbox is hosted by Zoho;
• Delivery: Royal Mail and, for some orders, UPS, which receive the recipient name, delivery address and parcel details;
• Fulfilment supplier: our wholesale supplier receives the recipient name, delivery address, telephone number and products ordered so the order can be dispatched in plain, white-label packaging;
• Website fonts: Google Fonts, which receives your IP address when the font files load;
• Visitor statistics (only with your consent): where your connection does not already give an approximate location, your IP address is sent to ipwho.is to look up an approximate country and city;
• Tracking links: Royal Mail, UPS, DPD or Evri receive your tracking number when you follow a tracking link;
• Search Console and Bing Webmaster tools receive no customer personal data.

Professional advisers

We may share information with accountants, lawyers, insurers, consultants and other professional advisers where reasonably necessary.

Regulators and authorities

Information may be disclosed where required or permitted by law to HM Revenue & Customs, courts, regulators, law-enforcement authorities, government bodies or other competent authorities.

Some organisations process personal information on our behalf.

Where required, we seek to use providers offering appropriate security and data-protection arrangements and to put appropriate contractual arrangements in place.

Service providers are expected to process personal information in accordance with their contractual obligations and applicable law.

Some providers may also act as independent controllers for particular processing activities.

Online payments may be processed through third-party payment providers.

Woodlands Biohack does not ordinarily intend to directly receive or retain full card credentials where payment is processed through an external payment gateway.

Payment providers may collect information directly from you and process that information under their own privacy policies and regulatory obligations.

Customers should review the privacy information presented by the relevant payment provider.

Some technology providers, cloud services, payment providers or other service providers may process information outside the United Kingdom.

Where a transfer of personal information is subject to UK international-transfer restrictions, we will take reasonable steps to ensure that an appropriate transfer mechanism or safeguard is used where required.

Depending upon the destination and circumstances, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to recognised contractual clauses;
• another legally recognised safeguard; or
• an applicable statutory exception.

We may also conduct relevant transfer assessments where required.

Further information about relevant safeguards may be requested by contacting admin@woodlandsbiohack.com.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, accounting, tax, fraud-prevention and dispute-resolution requirements.

Retention periods vary according to the type of information.

We may generally retain:

Order, invoice and accounting records

For the period required to satisfy applicable tax, accounting and legal obligations.

Customer-account information

For the duration of the active commercial relationship and an appropriate period afterwards.

Business correspondence

For as long as reasonably necessary to manage the relationship, resolve disputes and maintain appropriate business records.

Marketing information

Until consent is withdrawn, an objection is made, the information is no longer required, or our retention review determines it should be deleted.

Suppression-list information

We may retain minimal information for longer where necessary to ensure that an individual who has opted out is not inadvertently marketed to again.

Security and fraud information

For an appropriate period based upon security, fraud-prevention, legal and dispute requirements.

Website analytics

Raw first-party visit and basket-activity records are deleted automatically by a scheduled job once they are more than 90 days old.

Saved but unfinished baskets

Kept so we can follow up and to understand checkout problems; reviewed and removed when no longer needed.

Website logs

For a proportionate period based upon security and operational requirements.

When information is no longer required, we will take reasonable steps to delete it, anonymise it or otherwise dispose of it securely.

We take reasonable technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• inappropriate disclosure;
• alteration;
• destruction; and
• misuse.

Depending upon the systems involved, safeguards may include:

• password protection;
• access controls;
• secure hosting;
• encrypted connections;
• payment-provider security;
• account authentication;
• backups;
• software updates;
• security monitoring; and
• limiting access to information according to business need.

No internet-based system can be guaranteed to be completely secure.

We therefore cannot promise absolute security, but we take reasonable measures appropriate to our operations and the nature of the information processed.

If Woodlands Biohack becomes aware of a personal-data breach, we will assess it and take appropriate steps in accordance with applicable law.

Where a breach is legally reportable, we will notify the Information Commissioner’s Office within the applicable statutory timeframe.

Where the law requires affected individuals to be notified, we will take appropriate steps to inform them.

Depending upon the circumstances and the lawful basis used for processing, UK data-protection law may provide you with rights including:

Right to be informed

You have the right to receive appropriate information about how your personal information is processed.

Right of access

You may request access to personal information that we hold about you.

Right to rectification

You may request correction of inaccurate personal information and completion of incomplete information.

Right to erasure

In certain circumstances, you may request deletion of your personal information.

This right is not absolute. We may need to retain information where there is a lawful reason to do so.

Right to restrict processing

In certain circumstances, you may request restriction of processing.

Right to data portability

Where the relevant legal requirements are satisfied, you may have the right to receive certain information in a structured, commonly used and machine-readable format or have it transferred to another controller.

Right to object

You may have the right to object to processing based upon legitimate interests.

You have a specific right to object to processing for direct-marketing purposes.

Rights concerning automated decision-making

Where applicable, you may have rights concerning decisions based solely upon automated processing that produce legal or similarly significant effects.

Right to withdraw consent

Where processing is based upon consent, you may withdraw that consent at any time.

Withdrawal will not retrospectively make processing carried out while valid consent existed unlawful.

To exercise a data-protection right, contact admin@woodlandsbiohack.com.

Please clearly describe your request.

We may request reasonable information necessary to verify your identity before disclosing or altering personal information.

We will respond within the timeframe required by applicable law.

Data-protection requests will ordinarily be handled without charge, although the law permits fees or other action in certain limited circumstances.

Woodlands Biohack does not ordinarily intend to make decisions producing legal or similarly significant effects solely through automated processing.

However, third-party payment or fraud-prevention systems may use automated methods when evaluating transactions.

Where legally required, relevant information and rights will be provided.

Woodlands Biohack operates as a B2B wholesale business.

Our website, products and business accounts are not directed at children.

We do not knowingly seek to collect personal information from children for the purpose of selling products to them.

If we become aware that information has been supplied by a child in circumstances where it should not have been collected, we may take appropriate steps to delete or restrict that information.

Where a business account contains personal information concerning employees, directors, representatives or authorised purchasers, the business Customer is responsible for ensuring it has appropriate authority to provide relevant information to Woodlands Biohack.

Businesses should avoid providing personal information that is unnecessary for managing their account.

This Privacy Policy may also apply to individuals representing suppliers, contractors and other organisations with which Woodlands Biohack does business.

We may process their names, job titles, business email addresses, telephone numbers, payment information, correspondence and other relevant professional information.

This information may be processed for contract administration, procurement, payment, accounting, relationship management, legal compliance and legitimate business administration.

If you communicate with Woodlands Biohack through a third-party social-media or messaging service, the relevant provider may independently process information about you.

Such services operate according to their own privacy policies.

Information sent directly to Woodlands Biohack through those channels may also be retained by us where reasonably necessary for customer service, order management, business administration or legal purposes.

Our website may contain links to websites operated by third parties.

Woodlands Biohack is not responsible for the privacy practices of independent third-party websites.

You should review the privacy notice of the relevant third party before providing personal information.

We aim to collect personal information that is adequate, relevant and limited to what is reasonably necessary for the purposes for which it is processed.

Customers and website visitors should avoid sending us unnecessary personal information.

We take reasonable steps to maintain accurate information.

Customers should notify us where relevant account, contact, billing or delivery information changes.

You can request correction of inaccurate personal information by contacting admin@woodlandsbiohack.com.

If Woodlands Biohack is sold, transferred, reorganised or incorporated into another business structure, relevant personal information may form part of that transaction where legally permitted.

Any recipient would be required to handle personal information in accordance with applicable data-protection requirements.

Where required, affected individuals will be informed of material changes.

We may disclose personal information where we reasonably believe disclosure is required by applicable law, a court order or another legally binding requirement.

We may also disclose information where legally permitted and reasonably necessary to establish or defend legal claims, investigate suspected fraud, protect our legal rights, protect the rights of others or cooperate with competent authorities.

We will not voluntarily disclose more personal information than is reasonably necessary for the relevant lawful purpose.

We may retain and analyse information concerning suspected:

• payment fraud;
• chargeback abuse;
• account misuse;
• website attacks;
• unauthorised access;
• attempted fraud; or
• other unlawful activity.

Where appropriate, relevant information may be shared with payment providers, financial institutions, professional advisers, fraud-prevention services or competent authorities.

We may update this Privacy Policy periodically to reflect changes to our business, our website, new service providers, new technologies, changes in how information is processed, regulatory guidance or changes in applicable law.

The current version will be published on our website with an updated revision date.

Where a change materially affects how we process personal information, we will take appropriate steps to bring the change to the attention of affected individuals where required.

Questions about this Privacy Policy, how personal information is used or requests relating to your data-protection rights should be directed to:

• Woodlands Biohack Limited (company number 17490886)
• Registered office: 1g Brighouse Road, Middlesbrough, England, TS2 1RT
• United Kingdom
• Email: admin@woodlandsbiohack.com
• Website: woodlandsbiohack.com

Please use “Data Protection Request” in the subject line where your enquiry concerns your personal information.

If you have concerns about how Woodlands Biohack processes your personal information, please contact us first so that we have an opportunity to investigate the issue.

Email: admin@woodlandsbiohack.com

You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK’s independent data-protection regulator.

Further information about complaints and data-protection rights is available from the ICO.

Where our website uses non-essential cookies or other technologies requiring a user choice, visitors should be provided with an appropriate mechanism to manage those choices.

Rejecting optional cookies should not prevent access to website functions that do not depend upon those optional technologies.

Cookie preferences can be changed through the cookie-management mechanism made available on the website where applicable.

For further information, please see the Woodlands Biohack Cookie Policy at woodlandsbiohack.com/cookies.

Where reasonably appropriate to our operations, Woodlands Biohack aims to consider privacy and data protection when introducing new systems, service providers or ways of processing personal information.

This includes considering:

• what information is actually required;
• why it is required;
• how long it should be retained;
• who requires access;
• how it will be protected;
• whether information will leave the UK; and
• whether individuals need additional privacy information.

Woodlands Biohack aims to process personal information responsibly, transparently and only where there is an appropriate reason for doing so.

In summary:

• We collect information needed to operate our B2B business.
• We use information to process orders, provide support, operate and protect our website, meet legal obligations and manage legitimate business activities.
• We do not sell personal information as a standalone commercial product.
• We limit access to information and use appropriate service providers.
• We respect applicable marketing preferences and data-protection rights.
• Where optional tracking technologies require consent, appropriate choices should be provided.
• You can contact us at admin@woodlandsbiohack.com regarding your personal information.

Where an order is dispatched directly by an approved supplier or fulfilment partner, we share only what is needed to fulfil it: recipient name, delivery address, telephone number and the products ordered. They may not use it for their own marketing.

Card payments are processed by Teya and pay-by-bank payments by Wallid. We do not receive or store full card numbers or card security codes. We keep payment references, amounts, status and, where shown to us, limited details such as the card type and last four digits, to record and reconcile payments.

If you use a discount code, enter a competition or join the ambassador programme, we process the information needed to run it: entry or code details, eligibility checks, winner notification and, for ambassadors, account, referral attribution, commission and payout records. Ambassadors never see customers’ contact, delivery or payment details.

Accounting records relating to commissions, payouts and orders are kept for as long as UK tax and company law requires, normally at least six years from the end of the relevant financial year.

When you place an order we keep the order record, including its date, which shows the terms that applied at that time. We do not use automated decision-making that produces legal or similarly significant effects.