Privacy policy
Last updated: [DATE]
This policy explains what personal data we collect, why, and what you can do about it. It is written to meet UK GDPR and the Data Protection Act 2018.
Who we are
Keravix is a trading name of [COMPANY NAME], the data controller for the personal data described here.
Registered office: [FULL ADDRESS]
Company number: [NUMBER]
Data protection contact: privacy@keravix.co.uk
ICO registration number: [NUMBER — you must register with the ICO if you process personal data for commercial purposes.]
What we collect
When you buy something
Name, billing and delivery address, email address, phone number, order details, and partial payment card information. We never see or store your full card number — payments are handled by Shopify Payments, PayPal and any other providers shown at checkout.
When you contact us
Your name, email address and whatever you put in your message.
When you sign up to emails
Your email address, and whether you open and click our emails.
When you browse the site
IP address, device and browser type, pages viewed, referring site, and time on site, collected through cookies and similar technologies. See our Cookie Policy.
Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Processing and delivering your order | Performance of a contract |
| Customer support and returns | Performance of a contract |
| Fraud prevention and site security | Legitimate interests |
| Keeping accounting and tax records | Legal obligation |
| Marketing emails | Consent, or legitimate interests for existing customers about similar products |
| Analytics and advertising cookies | Consent |
Health information
We do not ask you for health information and you should not send it to us. If you mention a health condition in a support message, we use it only to answer you and we do not add it to any marketing profile. We do not target advertising based on health conditions.
Who we share it with
- Shopify — our ecommerce platform and payment processing
- Our fulfilment partner and delivery carriers — to pick, pack and deliver your order
- [EMAIL PLATFORM, e.g. Klaviyo] — to send emails you've asked for
- [REVIEW PLATFORM, e.g. Judge.me] — to invite reviews after purchase
- Google Analytics and Meta — analytics and advertising, where you've consented
- Our accountant, and HMRC — for tax and accounting
[Update this list to match the apps you actually install.]
We do not sell your personal data.
Transfers outside the UK
Some of our providers are based outside the UK, including in the United States. Where data is transferred outside the UK we rely on UK adequacy regulations or the International Data Transfer Agreement / Addendum to keep it protected.
How long we keep it
- Order and transaction records: 6 years after the end of the relevant tax year (HMRC requirement)
- Customer support emails: 2 years
- Marketing contacts: until you unsubscribe, then a suppression record so we don't email you again
- Website analytics: up to 26 months
Your rights
Under UK GDPR you have the right to access your data, correct it, have it erased, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time.
To exercise any of these, email privacy@keravix.co.uk. We'll respond within one month and it's free.
If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Marketing
You can unsubscribe from any marketing email using the link at the bottom of it, or by emailing us. We'll action it immediately.
Children
Our products are not intended for under-18s and we do not knowingly collect data from children.
Changes
If we change this policy we'll update the date at the top, and tell you by email if the change is significant.