Legal
GDPR & CCPA Rights
Your rights over the personal data we hold, and the exact steps to exercise them.
Last updated: September 12, 2026
Who this page is for
This notice explains the rights you have over your personal data and how to use them. It applies to everyone, and it gives specific detail for people in the UK and European Economic Area under the GDPR, and for California residents under the CCPA/CPRA. It supplements our Privacy Policy.
Your rights under the GDPR
If you are in the UK or EEA you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent at any time where consent is the basis we rely on.
Our legal bases for processing
We process personal data to perform our contract with you (delivering products you bought), on the basis of legitimate interests (securing the service, improving it, and marketing to existing customers), with your consent (non-essential cookies and marketing to new subscribers), and where necessary to comply with a legal obligation such as tax record-keeping.
Your rights under the CCPA/CPRA
If you are a California resident you have the right to know what personal information we collect and the purposes for it, to request deletion, to request correction, to limit the use of sensitive personal information, and to opt out of any sale or sharing of personal information. We will not discriminate against you for exercising these rights.
We do not sell your personal information
We do not sell personal information for money. Where advertising or analytics cookies are enabled, some data may be “shared” for cross-context behavioural advertising as the CPRA defines it — you can switch that off through our cookie settings or by using a Global Privacy Control signal, which we honour.
How to make a request
Email us at [[contact_email]] with the subject line “Privacy Request”, tell us which right you are exercising, and use the email address associated with your account where possible. An authorised agent may submit a request on your behalf with written proof of authorisation.
Verifying your identity
Before we act on a request about specific data, we need to be reasonably sure it is you. We may ask you to confirm details we already hold, such as the email on the account or a recent order number. We use anything you send for verification only, and delete it afterwards.
Response times
We aim to respond to every request within 30 days, and within 45 days for California requests. If a request is complex we may extend that once and will tell you why before the original deadline passes. There is no charge unless a request is manifestly unfounded or excessive.
Data retention
We keep personal data only as long as needed for the purpose it was collected: account and order records for as long as you have an account plus the period tax and accounting law requires, marketing contacts until you unsubscribe, and support correspondence for a reasonable period afterwards.
Marketing preferences
Every marketing email includes an unsubscribe link that takes effect immediately. Unsubscribing from marketing does not stop transactional messages such as receipts, security notices, and account or delivery updates, which we need to send to run your account.
Complaints
If you are unhappy with how we handled your data or your request, tell us first so we can put it right. You also have the right to complain to your data protection authority — in the UK that is the Information Commissioner’s Office, and in the EEA it is the supervisory authority where you live or work.
Contact us
Questions about this policy? Write to us at [[contact_email]] and we will get back to you.