Privacy
Privacy policy
This policy must be reviewed by a solicitor before launch and updated once your processors are confirmed. It is a working draft, not legal advice.
Who controls your data
Elaborate Nutrition Ltd, 167–169 Great Portland Street, London, W1W 5PF, is the data controller. Company number [PLACEHOLDER]. ICO registration number [PLACEHOLDER — registration with the Information Commissioner's Office is a legal requirement for most UK businesses processing personal data, and carries an annual fee].
Contact: info@elaboratenutrition.co.uk
What we collect
- Order information: name, delivery and billing address, email, phone, order contents
- Account information, if you create an account, including subscription preferences
- Payment information, which is processed by our payment provider — we do not see or store full card details
- Marketing preferences, where you have given consent
- Technical and usage data from the website, including cookies
Why we process it, and on what basis
- To fulfil your order and manage your subscription — performance of a contract
- To meet legal obligations, including food safety traceability and tax records — legal obligation
- To contact you about a batch, including in the event of a recall — legal obligation and vital interests
- Marketing email — consent, withdrawable at any time
- Site analytics and fraud prevention — legitimate interests
Who we share it with
[PLACEHOLDER — list actual processors once confirmed. At minimum this will include Shopify as the platform, your payment provider, your delivery carrier, your email provider and your subscription app. Each needs naming.]
Some of these providers are based outside the UK. Where personal data is transferred internationally it is protected by appropriate safeguards, such as the UK International Data Transfer Agreement or an adequacy decision.
How long we keep it
Order and transaction records are kept for six years to meet tax and food traceability obligations. Marketing consent records are kept until you withdraw consent, and for a period afterwards to evidence the withdrawal. Account data is kept until you ask us to delete it.
Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to data portability. To exercise any of these, email us.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Cookies
[PLACEHOLDER — cookie table and consent mechanism. Under PECR, non-essential cookies including analytics require consent before they are set, not merely notice.]