Privacy policy

This policy explains what we do with your personal data. We have tried to write it in plain English rather than the usual thing.

Who is responsible for your data

The data controller is Ben Webber, a sole trader trading as LOMA, at Old Barn Cottage, Down Lane, Compton, Guildford, Surrey GU3 1DQ, United Kingdom. Contact lomasupplements@gmail.com about anything in this policy. We are registered with the Information Commissioner's Office under reference [TO CONFIRM: ICO registration number]. We have not appointed a data protection officer, because the scale and nature of our processing does not require one.

What we collect, why, and on what legal basis

• Your order. Name, delivery and billing address, email, phone and what you bought. We need this to send you the product and run your subscription. Basis: performance of a contract.
• Your payment. Handled by our payment processor. We receive confirmation and the last four digits of the card. We never see or store your full card number. Basis: performance of a contract.
• Marketing emails and texts. Your email, your name and what you have bought or looked at. Basis: your consent, which you can withdraw at any time by clicking unsubscribe. For existing customers we may also rely on the PECR soft opt-in for emails about similar products, and every one of those carries an unsubscribe link too.
• Analytics and advertising. Pages you visited, what you clicked, approximate location from your IP, and a device identifier. Basis: your consent, given through the cookie banner. Decline and these do not run.
• Accounting records. Basis: our legal obligation to keep records for HMRC.
• Fraud prevention. Basis: our legitimate interest in not being defrauded, balanced against your rights.

Health information

We do not ask for health information and you should not send it to us. If you email us about a health matter, we will use it only to answer you and will delete it when the conversation is finished. Health data is a special category under UK GDPR and we deliberately keep our collection of it at zero.

Who else processes your data

• Shopify, for the shop, checkout and order records
• Appstle, for subscription management
• Shopify Payments, for taking payment
• Klaviyo, for email and SMS
• PostHog, for website analytics, hosted in the EU
• Vercel, for hosting this website
• Google Analytics and Meta, for advertising measurement, only if you consent
• Royal Mail, for delivery

Each of these acts on our instructions under a contract. Some are based outside the UK, mainly in the United States. Where that happens we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK-US Data Bridge where the recipient is certified, whichever applies to that supplier.

We do not sell your data, and we do not share it with insurers.

How long we keep it

• Order and accounting records: six years, as HMRC requires
• Marketing profile: until you unsubscribe, and we remove profiles inactive for three years
• Analytics: up to 14 months
• Support emails: two years

Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to us using it, ask for it in a portable format, and withdraw consent at any time. Email us and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you told us first so we can fix it.

Cookies

We set only strictly necessary cookies unless you agree to more. See our cookie policy for the full list and to change your choice.

Automated decisions and children

We do not make decisions about you by automated means that have a legal or similarly significant effect. This website and our product are not intended for anyone under 18, and we do not knowingly collect data from children.