Privacy Policy

1. Data Controller

Elv8 Wellness is the data controller responsible for your personal data collected through this website. If you have any questions about how your data is handled, please contact us at info@elv8wellness.com.

2. What Data We Collect

We may collect and process the following personal data:

• Identity data: your full name as provided during orders or contact form submissions.
• Contact data: your email address, phone number (if provided), and delivery address.
• Order data: details of products ordered, transaction references, and order history.
• Technical data: IP address, browser type and version, time zone, operating system, and platform via standard server logs and analytics.
• Communication data: records of correspondence when you contact us via the website or email.

3. Legal Basis for Processing

We process your personal data on the following legal grounds under UK GDPR:

• Contract performance: processing necessary to fulfil your order or purchase, including dispatching products and sending order confirmations.
• Legitimate interests: processing necessary for our legitimate business interests, such as improving our website, preventing fraud, and responding to enquiries, where those interests do not override your fundamental rights.
• Consent: where you have given specific consent, for example opting in to marketing communications. You may withdraw consent at any time.
• Legal obligation: processing required to comply with our legal obligations, such as tax and accounting requirements.

4. How We Use Your Data

Your personal data is used to:

• Process and fulfil your orders;
• Send order confirmations, dispatch notifications, and other transactional communications;
• Respond to your enquiries submitted via the contact form;
• Improve our website and services;
• Comply with legal and regulatory obligations;
• Detect and prevent fraud or unauthorised activity on our platform.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Order data: retained for 6 years from the date of transaction for tax and accounting compliance.
• Contact form submissions: retained for 12 months from the date of submission, unless the enquiry relates to an ongoing order or dispute.
• Technical/analytics data: retained for up to 26 months.

After the applicable retention period, your data is securely deleted or anonymised.

6. Your Rights

Under UK GDPR, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of any inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data where there is no compelling reason for continued processing.
• Right to restrict processing: request that we limit how we use your data in certain circumstances.
• Right to data portability: request a copy of your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at info@elv8wellness.com. We will respond within one month of receiving your request. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

7. Cookies

Our website uses cookies and similar technologies to improve your browsing experience and analyse site traffic:

• Essential cookies: required for the website to function correctly, such as session management and age verification. These cannot be disabled.
• Analytics cookies: help us understand how visitors use the site. We use anonymised analytics data to improve our content and services. You may opt out of analytics cookies at any time.

We do not use advertising or tracking cookies. No personal data is sold to third parties for marketing purposes.

8. Third-Party Services

We may share your personal data with the following categories of third-party service providers, who process data on our behalf:

• Email service providers (e.g., Resend) for sending transactional and order-related emails.
• Shipping carriers (e.g., Royal Mail, DPD) for order fulfilment and delivery tracking.
• Hosting and infrastructure providers for website hosting and data storage.
• Analytics providers for anonymised website usage analysis.

All third-party processors are contractually obligated to handle your data securely and in compliance with UK GDPR. We do not sell your personal data to any third party.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit (SSL/TLS), access controls, and regular security reviews.

10. International Transfers

Where personal data is processed by third-party services located outside the UK, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the ICO, to protect your data to a standard consistent with UK GDPR.

11. Contact for Data Requests

For any questions regarding this Privacy Policy, or to exercise your data protection rights, please contact:

Elv8 Wellness
Email: info@elv8wellness.com

We aim to respond to all data protection enquiries within one calendar month.