Privacy Policy

This Privacy Policy explains how Remvola Wellness Ltd, a company registered in England and Wales under Company No. 16874256, with its registered office at 65 Deansgate, Manchester, M3 2BY ("Remvola", "we", "us" or "our"), collects, uses, shares and protects personal information gathered through remvola.world and through the pay-on-delivery ordering process for Ashwagandha KSM-66. We are the data controller for the personal information described in this policy. This document is intended to be read by any visitor, prospective customer or existing customer who wants to understand exactly what happens to their data, for how long, and what choices they have. It is organised into fourteen numbered sections, ending with a dated change log so that returning visitors can see what has been updated.

1. Scope of this policy

This policy applies to personal information we collect through the remvola.world website, the order request form, telephone confirmation calls, email correspondence and any written enquiries sent to our registered address. It applies equally to casual visitors browsing product information and to customers who complete an order. It does not apply to the practices of couriers, payment terminal providers or any other organisation once information has been lawfully passed to them and they are acting as an independent controller of that data, nor does it apply to any third-party website you may reach via a link from our site. We encourage you to review the privacy notices of any external site you visit from a link on remvola.world.

2. Information we collect

Directly from you, we collect your full name, telephone number, delivery address and postcode, any optional delivery notes, and the contents of messages you send us by email, phone or contact form. Automatically, our website and hosting logs collect your IP address, browser type and version, device type, referring page, and the pages and timestamps of your visit. Where you consent to optional cookies, we additionally collect aggregated browsing behaviour such as pages viewed, time on page and general geographic region inferred from your IP address. We do not knowingly collect special category data, such as health records or precise medical history, through the order form; any voluntary health-related comments you choose to share by email are handled with additional care and are not used for marketing.

3. Legal basis for processing

We process order-related information under the "contract" basis in Article 6(1)(b) UK GDPR, because it is necessary to take steps you request before entering into a contract and to perform that contract once confirmed. We rely on "legitimate interests" under Article 6(1)(f) for website security, fraud prevention and improving our service, having balanced those interests against your rights. We rely on your "consent" under Article 6(1)(a) for optional analytics and marketing cookies, and for any newsletter you actively opt into. We rely on "legal obligation" under Article 6(1)(c) where we must keep financial records for HM Revenue & Customs or respond to a lawful request from a public authority.

4. Retention periods

Order and delivery records, including name, address and phone number, are retained for six years from the end of the financial year in which the order was placed, in line with our statutory bookkeeping obligations. Website server logs are retained for 90 days on a rolling basis and then automatically purged. Analytics identifiers, where you have consented to them, are retained for up to 13 months, and aggregated event-level analytics data is reviewed and, where no longer needed, deleted after 26 months. Correspondence with our support team is retained for three years from the date of the last message in the thread, to allow us to handle any follow-up queries. Call recordings, where made, are retained for 90 days. If you ask us to delete your data sooner, we will do so unless a legal retention obligation requires us to keep specific fields for longer, in which case we will explain which fields and why.

5. Your rights and how to exercise them

Under UK data protection law you have the right to be informed about how your data is used, the right to access a copy of your personal data, the right to have inaccurate data corrected, and the right to have data erased where there is no overriding reason for us to keep it. You also have the right to restrict or object to certain processing, the right to data portability for information you provided to us electronically, and rights relating to automated decision-making, although we do not currently use automated decision-making that produces legal or similarly significant effects.

• Email [email protected] or telephone +44 161 399 4809, Mon–Fri 9:00–17:30, quoting your name and, if you have one, an order reference.
• We will ask for reasonable proof of identity before actioning a request involving personal data.
• We aim to acknowledge every rights request within five working days and to complete it within one calendar month, extendable by a further two months for complex requests, in which case we will explain why.
• There is no charge for a standard request; we may charge a reasonable administrative fee only for manifestly unfounded, repetitive or excessive requests.

6. Third-party processors and partners

We use a small number of carefully selected service providers, each acting under a data processing agreement that restricts them to using your data only as we instruct. These include: a website hosting and infrastructure provider that stores the site and order-form submissions; an email delivery provider used to send order confirmations and respond to enquiries; a telephone confirmation service provider that may assist with placing or logging pre-dispatch calls; our nominated UK courier network, selected by delivery region, which receives only the name, address, phone number and parcel value needed to complete delivery; and, where you consent to analytics cookies, a cookie-based analytics service that reports aggregated, largely anonymised usage statistics. None of these processors is authorised to use your data for their own independent marketing purposes.

7. Cookies and similar technologies

Our site uses a small number of cookies. rv_session is a strictly necessary session cookie that supports navigation and the order form and expires when you close your browser. rv_consent is a necessary preference cookie that remembers your cookie choice for 180 days so we do not repeat the same notice on every visit. Where you opt in, rv_analytics_id is an analytics cookie lasting up to 13 months that helps us understand overall visit patterns, and rv_analytics_evt supports event-level reporting reviewed within 26 months. We do not currently set any advertising or cross-site marketing cookie. Full details, including how to withdraw consent at any time, are set out in our Cookie Policy.

8. International data transfers

Our website and order data are hosted primarily on infrastructure located within the United Kingdom and the European Economic Area. Where any processor we use stores backup or support infrastructure outside the UK or EEA, that transfer takes place under protections recognised by UK data protection law, such as an adequacy decision or a UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, ensuring your data continues to receive a comparable standard of protection. We do not sell personal data to any third party, and we do not knowingly transfer personal data to any country subject to a UK data protection restriction.

9. Complaints and how to contact us

If you have a concern about how we have handled your personal data, please contact us first at [email protected] or +44 161 399 4809, Mon–Fri 9:00–17:30, so that we can try to resolve it directly. We will acknowledge a data protection complaint within five working days and aim to provide a substantive response within one calendar month. If you remain unsatisfied, you have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, website ico.org.uk, although we would always welcome the opportunity to put things right ourselves first.

10. Revision history

11. Children's information

Our order request form and product content are intended for adults resident in the United Kingdom, and we do not knowingly collect personal data from anyone under the age of eighteen. If we become aware that a request has been submitted by, or on behalf of, a minor without appropriate parental involvement, we will decline to progress the order and will delete any personal data received. Parents or guardians who believe their child has provided us with personal information are welcome to contact us so that we can investigate and, where appropriate, remove it.

12. Security measures

We apply technical and organisational measures appropriate to the nature of the personal data we hold, including encrypted connections between your browser and our servers, restricted staff access to order records on a need-to-know basis, and regular review of the small number of third-party processors described above. No method of transmission over the internet is completely secure, and while we work to protect your personal data, we cannot fully assure its absolute security; we encourage you to take reasonable precautions when sharing information with us, such as avoiding sending card details by email since we never request them there.

13. Marketing preferences

We do not add you to any marketing list simply because you submitted an order request or spoke to us on a confirmation call. If, in the future, we introduce an optional newsletter or promotional update, we will only contact you in that way if you have actively opted in, and you will be able to withdraw that consent at any time by emailing [email protected] or using an unsubscribe link provided in the message itself, at no cost and without affecting any existing order.

14. Updates to this policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, our service providers, or UK data protection law. Where a change is significant, we will update the "Updated" date shown at the top of this page and, where appropriate, provide a more prominent notice on the site. We encourage you to review this page periodically; continued use of remvola.world after an update takes effect constitutes acknowledgement of the revised policy, though your statutory rights are never reduced by a change to this document.