Privacy Policy

1. Information we collect

1.1 Information you provide to us

We collect personal information that you voluntarily provide when you:

• Create an account: name, email address, password, date of birth
• Make a purchase: billing address, shipping address, payment information (processed securely through our payment provider)
• Contact us: name, email address, phone number, message content
• Subscribe to our newsletter: email address, name (optional), preferences
• Participate in surveys or promotions: survey responses, competition entries
• Leave product reviews: name or username, review content, rating

1.2 Information collected automatically

When you visit our website we automatically collect certain information about your device:

• Log and usage data: IP address, browser type, operating system, access times, pages viewed, referring website addresses
• Device data: device type, unique device identifiers, mobile network information
• Location data: general location based on IP address
• Cookies and tracking: information collected through cookies, web beacons and similar technologies

1.3 Information from third parties

• Payment processors — transaction completion confirmations
• Delivery partners — shipping status updates
• Social media platforms — if you connect your account
• Analytics providers — aggregated usage statistics

2. How we use your information

2.1 To fulfil orders and provide services

• Process and complete your transactions
• Manage your account and orders
• Send order confirmations and shipping updates
• Provide customer support
• Handle returns and refunds

2.2 To improve our services

• Analyse website usage and customer behaviour
• Improve our product offerings and website functionality
• Develop new products and services
• Conduct market research and testing

2.3 To communicate with you

• Send marketing communications, with your consent
• Respond to your enquiries and customer service requests
• Send administrative information such as policy updates and security alerts
• Request feedback and reviews

2.4 To ensure security and prevent fraud

• Monitor and prevent fraudulent transactions
• Protect against malicious or illegal activity
• Enforce our terms and conditions
• Comply with legal obligations

2.5 To personalise your experience

• Recommend products based on your purchase history
• Customise website content and advertisements
• Remember your preferences and settings

3. Legal basis for processing (UK GDPR)

Under UK GDPR we process your personal data on the following lawful bases:

• Contract performance: processing necessary to fulfil our contract with you, such as completing orders
• Legitimate interests: processing necessary for our legitimate business interests, such as fraud prevention and analytics
• Consent: processing based on your explicit consent, such as marketing communications
• Legal obligation: processing required to comply with legal requirements, such as tax records

4. Cookies and tracking

Cookies are small data files placed on your device when you visit our website. We use them to improve your browsing experience and analyse site usage.

• Essential cookies: necessary for website functionality such as the shopping cart and account login
• Performance cookies: help us understand how visitors use our site, via Google Analytics
• Functional cookies: remember your preferences and settings
• Advertising cookies: deliver relevant advertisements based on your interests

You can control cookies through your browser settings, though disabling certain cookies may affect website functionality. To learn more, visit allaboutcookies.org.

5. How we share your information

We share information with third-party service providers who perform services on our behalf:

• Payment processors such as Stripe and PayPal
• Shipping and fulfilment partners such as Royal Mail and DPD
• Email service providers for newsletters and transactional emails
• Web hosting and cloud storage providers
• Analytics providers including Google Analytics
• Customer service platforms

We may also disclose your information if required by law, in response to valid legal processes, government or regulatory requests, to protect our rights or safety, or to prevent fraud. If we are involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction.

6. International data transfers

Your information may be transferred to and processed in countries outside the UK and EEA. When we transfer data internationally we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner’s Office, adequacy decisions recognising equivalent data protection standards, and other legally approved transfer mechanisms.

7. Data retention

We retain your personal information for as long as necessary to fulfil the purposes in this policy, unless a longer period is required by law.

• Account information: as long as your account is active, plus 2 years after closure
• Purchase records: 7 years, for tax and accounting purposes
• Marketing data: until you unsubscribe, plus 2 years for compliance
• Website analytics: 26 months
• Customer service records: 3 years after last interaction

After the retention period expires we will securely delete or anonymise your personal information.

8. Your data protection rights

Under UK GDPR you have the following rights:

• Right to access: request a copy of the personal information we hold about you
• Right to rectification: request that we correct inaccurate or incomplete information
• Right to erasure: request that we delete your personal information in certain circumstances
• Right to restriction: request that we limit how we use your information
• Right to data portability: request a copy of your data in a structured, machine-readable format
• Right to object: object to processing for marketing purposes or based on legitimate interests
• Right to withdraw consent: withdraw consent at any time where processing is based on it
• Right to complain: lodge a complaint with the Information Commissioner’s Office

To exercise any of these rights, email tamaryn@thegummyvitamin.co.uk. We will respond within 30 days.

9. Security of your information

We implement appropriate technical and organisational security measures to protect your personal information:

• Encryption of sensitive data using SSL/TLS certificates
• Secure payment processing through PCI-DSS compliant providers
• Regular security audits and vulnerability assessments
• Access controls and authentication procedures
• Staff training on data protection
• Secure backup and disaster recovery procedures

However, no method of transmission over the internet is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

10. Children’s privacy

Our website and services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately and we will delete it.

11. Marketing communications

With your consent we may send you marketing emails about new products and promotions, special offers and discounts, health and wellness tips, and company news.

You can unsubscribe at any time by clicking the unsubscribe link in any marketing email, updating your preferences in your account settings, or emailing tamaryn@thegummyvitamin.co.uk.

12. Third-party websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites and encourage you to review their privacy policies.

13. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on our website, updating the “last updated” date, and sending an email notification for significant changes.

Your continued use of our website after changes are posted constitutes acceptance of the updated policy.

14. Specific processing activities

Payment processing

We use secure third-party payment processors such as Stripe and PayPal to handle all payment transactions. We do not store full credit card information on our servers. Our payment processors comply with PCI-DSS standards.

Email service providers

We use third-party email service providers to send transactional and marketing emails. These providers have access to your email address and name for the purpose of sending emails on our behalf.

Analytics

We use Google Analytics to understand how visitors use our website — how often they visit, which pages they view, and which sites they came from. We use this to improve our website and services.

Delivery partners

We share your name, address and phone number with our delivery partners to fulfil your orders. Our delivery partners are contractually obliged to protect your information and use it only for delivery purposes.

15. Contact us

If you have any questions, concerns or requests regarding this privacy policy or our data practices, please get in touch.

By using our website and services you acknowledge that you have read and understood this Privacy Policy.