Privacy

The Biohack Group CY Ltd, 9 Kastellorizou, 4532 Agios Tychonas, Limassol, Cyprus. Products are stored and dispatched by our UK fulfilment partner, Citipost, in Belvedere, Kent. UK importer address (for label purposes): 50 Liverpool Street, London EC2M 7PY.

We are the controller of the personal data described here. Questions or requests about your data can go to [email protected].

We handle your data under the UK GDPR and Data Protection Act 2018 for customers in the United Kingdom, and under the EU GDPR as a company established in Cyprus.

Orders and delivery: your name, email, phone number if you give one, delivery and billing address, the items you ordered and your order history. We use these to take payment, deliver your order, send order emails and handle returns. The legal basis is performing our contract with you.

Payment: card and wallet details are entered into Stripe and held by Stripe. We receive the card brand, the last four digits and the payment status, not your full card number.

Your account: your email address, name, saved addresses and subscription settings, and a sign-in session. We use these to run your account and subscription. The legal basis is performing our contract with you.

Service emails: order confirmations, dispatch and delivery updates, subscription reminders and billing notices come from [email protected]. Sign-in links and account changes come from [email protected]. These are part of delivering your order and running your account. The legal basis is performing our contract with you.

Marketing emails: if you opt in, we send our newsletter and offers from [email protected] and keep a record of when and how you agreed. We also note whether you open or click our emails so we can send you relevant news. The legal basis is your consent, and you can withdraw it at any time using the unsubscribe link in any email.

Support: when you write to [email protected], reply to any of our emails (replies go to support), send us a message through the support section of your account, or chat with us on our site, we keep your message, any order or subscription you link it to, and our replies so we can help you. If you chat with us without signing in, we also keep the name, email address and phone number you give us. Our mailboxes are hosted with Microsoft 365. The legal basis is our legitimate interest in answering you and improving our service.

Fraud prevention and records: we keep order and payment records to prevent fraud and to meet our accounting and tax duties. The legal bases are our legitimate interests and our legal obligations.

Address lookup: when you type a postcode at checkout, the characters you type are sent to Ideal Postcodes to suggest matching addresses.

We count visits to this site using our own system, with no cookie and nothing stored on your device. This lets us see how many people visit, which pages they view and whether visits lead to orders, without following anyone across days or across other sites.

For each page view we record the page, the referring site or campaign, the country (from your network), the type of device and whether you added to your basket, began checkout or ordered. To tell visits apart we compute a one-way code from your IP address, your browser type and the date, mixed with a secret. The code changes every day, and we do not store your IP address.

Page views less than 30 minutes apart count as one visit. We do not count staff pages or automated traffic. We keep these records for up to 13 months and then delete them. The legal basis is our legitimate interest in understanding and improving our site, and the data cannot be used to identify you.

If you accept analytics, we load Google Analytics. If you accept marketing, we load the Meta and TikTok pixels. These tools receive information about your visit, such as the pages you view and purchases, and may set cookies. Nothing from these providers loads until you choose, and you can change your choice at any time from the cookie settings link in the footer. The legal basis is your consent. See our cookie policy for details.

We use these providers to run the service, and they act on our instructions: Stripe (payments), Neon (database, hosted in the EU), Vercel (website hosting and file storage), SMTP2GO (sending email, including delivery, bounce, open and click records), Microsoft 365 provided through GoDaddy (our email inboxes), Ideal Postcodes (address lookup), and Citipost, our UK fulfilment partner, which receives your name, address, phone number if given, and order contents so it can prepare and send your order. If you leave a review through Trustpilot, Trustpilot handles that review under its own policy.

Google, Meta and TikTok receive data only if you accept the relevant cookie choice, and they act as independent controllers for that data.

We may also share data with professional advisers, with tax and other authorities when the law requires, and with a buyer if the business is sold. We do not sell your personal data.

Some providers, including Stripe, Vercel, SMTP2GO and Microsoft, may process data outside the UK and the European Economic Area. Where they do, we rely on adequacy decisions, the UK International Data Transfer Addendum or the EU standard contractual clauses, or another safeguard recognised by law.

Order, invoice and payment records: six years from the end of the financial year, which is our tax and accounting requirement.

Your account and subscription details: while your account is open. If you ask us to close it, we delete the account details and keep only the order records we are required to keep.

Marketing consent records: until you withdraw consent, and for a short period afterwards so we can honour your request.

Support emails and our email inboxes: up to three years from the last message.

Support messages sent through your account or our live chat: 24 months after the conversation is closed, then deleted, unless we need them to deal with a complaint, a dispute or a safety report. A chat with no activity for 30 days is closed automatically. Copies of ticket notifications in our email inboxes follow the inbox period above.

Email delivery records (delivered, bounced, opened, clicked): up to 13 months.

Site statistics: up to 13 months.

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent you can withdraw it at any time. Email [email protected] and we will reply within one month. We may need to confirm your identity first.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office in the UK (ico.org.uk), or to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy).

We protect data with encrypted connections, access controls and a staff sign-in that expires. No online service can promise perfect security, and we will tell you and the regulator if a breach affects you as the law requires.

Our products and site are for adults. We do not knowingly collect data from anyone under 18.

We will update this page when our practices change and show the date at the top. If a change is significant we will tell you by email.