Privacy Policy
Last updated: 05/09/2026
This policy explains what personal data we collect when you use nutrilily.co.uk, why we collect it, who we share it with, and what rights you have.
1. Who we are
Nutrilily is the data controller for the personal data described here.
Nutrilily is a trading name of Deanna Smith, a sole trader based at Grosvenor Gardens, Newton le Willows, WA12 8LY.
Email: hello@nutrilily.co.uk
2. What we collect
When you place an order: your name, email address, billing and delivery address, phone number if you give one, what you ordered, and the amount paid.
When you pay: your card details go directly to Stripe. We never see or store your full card number. We receive confirmation of payment, the last four digits of the card, and the card type.
When you create an account: your name, email address, password (stored encrypted, never in readable form), and your order history.
When you subscribe to our emails: your email address, the date you subscribed, the IP address you subscribed from, and whether you confirmed. We also record whether you open our emails and click links in them.
When you contact us: whatever you put in your message, and your email address so we can reply.
Automatically, when you visit: your IP address, browser type, pages viewed, and referring site. This comes from our server logs and from cookies.
If you consent to statistics cookies: Google Analytics records which pages you view, how long you stay, roughly where in the country you are, and how you found us. If you decline, none of this is collected.
3. Why we use it, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Process and deliver your order | To fulfil the contract you entered into | Performance of a contract |
| Take payment and prevent fraud | To get paid and protect against fraudulent transactions | Contract; legitimate interests |
| Send order confirmations, dispatch and delivery emails | So you know what is happening with your order | Performance of a contract |
| Answer your questions | To provide customer service | Contract; legitimate interests |
| Send marketing emails | To tell you about products and offers | Your consent |
| Keep accounting records | Because tax law requires it | Legal obligation |
| Keep the site secure and working | To protect the site and our customers | Legitimate interests |
| Measure how the site is used | To see what people read and improve the site | Your consent |
You can withdraw consent for marketing at any time. Every marketing email has an unsubscribe link, and unsubscribing does not affect emails about orders you have placed.
You can withdraw consent for statistics cookies at any time using the cookie settings link in our footer.
4. Who we share it with
We do not sell your data. We share it only with the following, and only so far as they need it:
Stripe — payment processing. Stripe is an independent controller for the payment data it handles. Its own privacy policy applies: https://stripe.com/gb/privacy
Hetzner Online GmbH — our web hosting. Our server, and the database holding order and subscriber data, is located in Germany.
Zoho — our business email (Zoho Mail) and our transactional email sending (ZeptoMail). Both run on Zoho’s European infrastructure.
Google — three separate things:
- Google Analytics, which tells us how the site is used. These cookies are only set if you consent to them via our cookie banner.
- Google Drive, where we back up the site, including the database.
- Google Fonts, loaded from Google’s servers when you visit, which means your IP address is disclosed to Google.
Delivery companies — your name, address and contact details, so they can deliver your parcel.
Our accountant and professional advisers — where necessary, and only under a duty of confidentiality.
We may also disclose data where the law requires it.
5. Where your data goes
Our servers are in Germany, and our email systems run within the EU. The UK Government has decided that the EU offers an adequate level of protection, so no additional safeguards are needed for these transfers.
Some of our providers, including Stripe and Google, may process data outside the UK and EU. Where that happens, transfers are covered by the UK International Data Transfer Addendum, standard contractual clauses, or a UK adequacy decision.
6. How long we keep it
Order and transaction records: six years after the end of the tax year they relate to, because HMRC requires it.
Account details: for as long as your account is open. If you close it, we delete your account but retain order records for the period above.
Marketing subscribers: until you unsubscribe, or after 18 months of no opens or clicks, whichever is sooner.
Customer service emails: 18 months after the matter is resolved.
Server logs: 365 days.
Google Analytics data: retained by Google for the period set in our Analytics account, currently 14 months.
7. Cookies
We use cookies for the following:
Essential. WooCommerce sets cookies to remember what is in your basket and keep you logged in. The site will not work properly without these, and they do not require consent.
Preferences. We remember choices such as whether you have dismissed a notice, and what you chose on our cookie banner.
Statistics. With your consent, Google Analytics sets cookies that let us see how many people visit, which pages they read, and how they found us. The data is aggregated and we do not use it to identify you. These cookies are blocked until you accept them, and you can change your mind at any time using the cookie settings link in our footer.
We do not use advertising or marketing cookies.
You can block or delete cookies in your browser settings, but doing so may stop parts of the site working.
8. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct it if it is wrong
- Erase it, in certain circumstances
- Restrict how we use it, in certain circumstances
- Object to processing based on legitimate interests
- Portability — receive your data in a machine-readable format
- Withdraw consent at any time, where consent is the basis
To exercise any of these, email hello@nutrilily.co.uk. We will respond within one month.
There is no charge, unless a request is clearly unfounded or excessive.
9. Automated decision-making
We do not make decisions about you based solely on automated processing.
Stripe runs automated fraud checks on payments, which may result in a transaction being declined. If that happens to you and you think it is wrong, contact us and we will look into it.
10. Security
Our site runs over HTTPS with a valid certificate. Passwords are stored encrypted. Access to the server is restricted to key-based authentication. We keep the site and its software updated, and we back up regularly.
No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will tell you and the ICO as the law requires.
11. Children
Our site is not aimed at children and we do not knowingly collect data from anyone under 16. If you believe we hold data about a child, contact us and we will delete it.
12. Complaints
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 www.ico.org.uk
13. Changes
We may update this policy. The date at the top shows when it last changed. If we make a significant change, we will tell you.