Privacy Policy

Last updated: 20 October 2026

This Privacy Policy explains how London Supplements collects, uses, shares and protects personal information when you visit londonsupplements.co.uk, place an order, create an account, contact us, join our marketing list or otherwise interact with us.

We process personal information in accordance with applicable UK data-protection and electronic-communications laws, including the UK GDPR and the Data Protection Act 2018, as amended.

1. Who we are

London Supplements is the controller of the personal information described in this policy.

Please use “Privacy request” in the subject line when contacting us about your information.

2. Personal information we collect

Depending on how you interact with us, we may collect:

  • Identity and contact information, such as your name, billing and delivery addresses, email address and telephone number.
  • Order and transaction information, such as products purchased, order value, discounts, delivery method, returns, refunds and payment status.
  • Account information, such as your login details, saved addresses, order history and account preferences.
  • Payment information. Payment card and wallet details are generally collected directly by Shopify or the relevant payment provider. We normally receive a payment confirmation, limited transaction details or a secure token rather than your full card number.
  • Device and usage information, such as IP address, browser and device type, cookie or similar identifiers, pages viewed, searches, referring pages, interactions and approximate location derived from an IP address.
  • Communications and customer-service information, including emails, contact-form submissions, messages, order enquiries, reviews and feedback.
  • Marketing preferences, including whether you have subscribed, opened or interacted with marketing communications, and your cookie or privacy choices.
  • Security and fraud-prevention information, such as risk indicators, account activity and information used to verify transactions.

Please do not send medical or other sensitive information unless it is necessary for your enquiry.

3. Where we obtain information

We collect information:

  • directly from you when you order, register, contact us, submit a review or join a mailing list;
  • automatically from your browser or device when you use the website;
  • from Shopify and service providers involved in payments, delivery, fraud prevention, analytics, advertising, reviews and customer support; and
  • from referral partners, social platforms or publicly available sources where permitted by law.

4. How we use personal information and our lawful bases

We use personal information only where we have a lawful basis. Depending on the activity, we rely on:

  • Contract: to process payment, fulfil and deliver orders, provide click-and-collect, manage returns or refunds, maintain your account and respond to order-related requests.
  • Legal obligation: to meet tax, accounting, consumer-protection, product-safety and other regulatory requirements, and to respond to lawful requests.
  • Legitimate interests: to secure the store, prevent fraud and misuse, operate and improve our services, understand performance, maintain records, handle enquiries and protect legal rights. We consider whether those interests are overridden by your rights.
  • Consent: for activities that require it, including certain direct marketing and non-essential cookies or similar technologies. You can withdraw consent at any time.

We may also use information to personalise the website, measure campaigns, troubleshoot problems, enforce our terms, establish or defend legal claims, and manage a sale or reorganisation of the business, where a lawful basis applies.

5. When we share personal information

We may share personal information with organisations that help us operate the store, including:

  • Shopify, which hosts and provides our ecommerce platform;
  • payment processors, banks and fraud-prevention providers;
  • couriers, fulfilment providers and collection locations;
  • website, hosting, security, customer-support, email, analytics, advertising and review-service providers;
  • professional advisers such as accountants, lawyers, insurers and auditors;
  • regulators, courts, law-enforcement bodies or other authorities where required or permitted by law; and
  • a buyer, seller or adviser involved in a proposed or completed business sale, merger, financing or reorganisation.

Service providers may use personal information only for the services they provide to us or as otherwise permitted by law. We do not sell personal information for money. Some privacy laws may define certain advertising disclosures as “sharing” or “selling”; where applicable, we provide the choices required by law.

6. Shopify

Our store is hosted by Shopify. Shopify processes personal information to provide and improve the platform, checkout, payments, security and related services. Depending on our settings and your choices, Shopify may also process device and shopping-activity data for personalised services or advertising features.

Where non-essential processing requires consent, it should not take place unless the required consent has been given through the store’s integrated privacy controls. You can learn more in Shopify’s Privacy Policy and exercise relevant Shopify-level choices through the Shopify Privacy Portal.

7. Cookies and similar technologies

We and our service providers use cookies, pixels, local storage and similar technologies. These generally fall into the following categories:

  • Strictly necessary: required for core functions such as security, basket, checkout, account login and remembering privacy choices.
  • Functional: used to remember preferences and provide enhanced features.
  • Analytics: used to understand website use and improve performance.
  • Advertising: used to measure campaigns and, where permitted, provide more relevant advertising.

We use non-essential cookies only where permitted by law and, where required, after obtaining consent. You can use the cookie or privacy controls made available on the website to accept, reject or change non-essential choices. You can also control cookies through your browser, although blocking strictly necessary cookies may prevent parts of the store from working.

Cookie technologies and providers can change as the store and Shopify services change, so we do not rely on a static list of legacy platform cookies in this policy.

8. Direct marketing

We may send marketing where you have consented or where applicable law otherwise permits it. You can unsubscribe at any time by using the link in a marketing email or contacting us. Withdrawing from marketing does not stop service messages about an order, account, return or security matter.

9. Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide services, maintain business and transaction records, comply with tax or legal duties, prevent fraud and resolve disputes.

Retention periods vary by category. We consider the amount, nature and sensitivity of the information, the risk of harm, the purpose of processing and applicable legal requirements. We may retain limited suppression information after an unsubscribe so that we can respect the preference.

10. International transfers

Shopify and some other providers may process information outside the United Kingdom. Where a restricted international transfer occurs, we use an appropriate legal mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard. Contact us if you would like more information about relevant safeguards.

11. Security

We use reasonable technical and organisational measures designed to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep account credentials confidential and contact us if you suspect unauthorised use.

12. Your data-protection rights

Depending on the circumstances and lawful basis, you may have the right to:

  • request access to your personal information;
  • ask us to correct inaccurate or incomplete information;
  • ask us to erase information;
  • ask us to restrict processing;
  • receive certain information in a portable format;
  • withdraw consent at any time where processing relies on consent; and
  • object to processing based on legitimate interests or to direct marketing.

Your right to object

You have an absolute right to object to the use of your personal information for direct marketing. You may also object to processing based on legitimate interests; we will stop unless we demonstrate compelling legitimate grounds or need the information for legal claims.

Subject access requests

You can make a subject access request verbally or in writing using the contact details above. We do not normally charge a fee. A reasonable fee may be charged only where the law permits, such as for a manifestly unfounded or excessive request or a request for further copies.

We respond without undue delay and normally within one month. Where a request is complex or you make several requests, the law may allow an extension of up to two further months; if so, we will explain this within the first month. We may request proportionate information to verify identity or authority before disclosing personal information.

Some rights are subject to legal conditions and exemptions. We will explain our decision if we cannot fully comply.

13. Automated tools and fraud prevention

Shopify, payment providers or fraud-prevention services may use automated signals to assess transaction or account risk. These checks may result in a transaction being referred, delayed or declined. Contact us if you have questions about a decision or wish to request human review where applicable. We do not otherwise use solely automated decision-making that produces legal or similarly significant effects unless we tell you and provide the safeguards required by law.

14. Children

Our store is not directed at children, and we do not knowingly collect personal information from children without an appropriate lawful basis or permission. If you believe a child has provided information improperly, contact us so that we can investigate.

15. Third-party websites

The website may link to services we do not control. Their privacy practices are governed by their own policies. Review those policies before providing personal information.

16. Changes to this policy

We may update this policy when our practices, Shopify features or legal requirements change. We will post the revised version here and change the “Last updated” date. Where appropriate, we will provide additional notice of a significant change.

17. Questions and complaints

Contact us first if you have a question or concern so that we can try to resolve it.

You also have the right to complain to the UK Information Commissioner’s Office. Visit the ICO complaints page for current contact and complaint information.