Privacy Policy

1. Who We Are (Data Controller)

The data controller for personal data collected through this website is:

Pinehurst Grove Nutrition Ltd
14 Northgate Row, Chester, CH1 2EF, United Kingdom
Company No. / VAT: 16284759 / GB948372615
Email: info@hipscrub.world
Tel: +44 1244 678 392

We process your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) as retained in UK law by the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018.

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

Category	Examples
Identity data	First name, last name
Contact data	Telephone number, email address, delivery address
Transaction data	Order details, product purchased, quantity, price, payment method preference (e.g. payment on delivery)
Technical data	IP address, browser type and version, time zone, browser plug-in types, operating system and platform, device identifiers
Usage data	Information about how you use our website, pages visited, time on page, referral source
Marketing & communications data	Your preferences for receiving marketing from us and your communication preferences
Cookie data	As described in Section 6 and our Cookie Policy

We do not collect any special category personal data (such as health, racial, political, religious or biometric data). We do not knowingly collect data from persons under the age of 18.

3. How We Collect Your Data

We collect personal data through the following means:

• Order form: when you place an order on our website, we collect your name, phone number and delivery address.
• Contact form: when you send us an enquiry, we collect your name, email address and message.
• Cookies and similar technologies: automatically when you visit our website, subject to your consent choices (see Section 6).
• Third-party analytics and advertising platforms: where you have consented, we may receive aggregated usage data from platforms such as Google Analytics.

4. Why We Process Your Data (Legal Basis)

Purpose	Legal Basis (UK GDPR Article 6)
Processing and fulfilling your order	Performance of a contract (Art. 6(1)(b))
Communicating with you about your order	Performance of a contract (Art. 6(1)(b))
Responding to your contact enquiries	Legitimate interests (Art. 6(1)(f)) - responding to requests you have initiated
Complying with legal obligations (e.g. tax records)	Legal obligation (Art. 6(1)(c))
Analytics and site performance (with consent)	Consent (Art. 6(1)(a))
Marketing communications (with consent)	Consent (Art. 6(1)(a))
Fraud prevention and site security	Legitimate interests (Art. 6(1)(f))

5. How We Use Your Data

• To process, confirm and fulfil your order for Wellaray Coffee, including contacting you by telephone to confirm delivery details.
• To respond to enquiries submitted via our contact form.
• To send order confirmation and dispatch information.
• To maintain accurate business and accounting records as required by law.
• To detect and prevent fraud, spam or abuse of our website (e.g. via honeypot form field).
• To analyse website usage and improve our content and user experience, where you have consented to analytics cookies.
• We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

6. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. We implement Google Consent Mode v2, which means non-essential cookies are set to denied by default until you provide consent. Please see our full Cookie Policy for details of each cookie used, its purpose, and its retention period.

You may update your cookie preferences at any time using the cookie settings panel displayed in the banner at the bottom of each page.

7. Sharing Your Data

We do not sell your personal data. We may share your data with:

• Delivery and logistics partners: to fulfil your order (name and address only).
• Payment processors: where applicable, for payment on delivery arrangements.
• IT and website service providers: who host and maintain our website under data processing agreements.
• Analytics providers (e.g. Google Analytics): only where you have consented to analytics cookies; data is anonymised or pseudonymised.
• Legal authorities: where we are required to disclose data by law, court order or regulatory requirement.

All third-party processors are required to maintain the confidentiality and security of your data and are only permitted to process it for specified purposes.

8. International Transfers

Where we transfer personal data outside the UK or European Economic Area (for example, to Google servers for analytics), we ensure appropriate safeguards are in place, including reliance on the UK Government's adequacy regulations or standard contractual clauses approved by the ICO. You may request details of these safeguards by contacting us.

9. How Long We Keep Your Data

Data Type	Retention Period
Order and transaction records	7 years (UK tax and accounting requirement)
Contact enquiry records	2 years from date of enquiry
Cookie consent records	13 months
Analytics data	As per Google Analytics default (26 months, unless configured otherwise)
Marketing consent records	Until consent is withdrawn, plus 1 year

After the relevant retention period, data is securely deleted or anonymised.

10. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: to request a copy of the personal data we hold about you (Subject Access Request).
• Right to rectification: to ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): to request deletion of your data where there is no compelling reason for us to continue processing it.
• Right to restrict processing: to ask us to pause processing of your data in certain circumstances.
• Right to data portability: to receive your data in a structured, commonly used, machine-readable format where processing is based on consent or contract.
• Right to object: to object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making: not to be subject to a decision based solely on automated processing that produces significant effects (we do not carry out such processing).
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at info@hipscrub.world. We will respond within one calendar month. We may ask you to verify your identity before processing your request.

11. How to Complain

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns before you contact the ICO, so please contact us in the first instance.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Where changes are material, we will notify you by displaying a prominent notice on our website. The "Last updated" date at the top of this page indicates when this policy was most recently revised. Your continued use of our website after any changes constitutes acceptance of the updated policy.

13. Contact the Data Controller

For any questions, requests or concerns relating to this Privacy Policy or the processing of your personal data, please contact:

Pinehurst Grove Nutrition Ltd
14 Northgate Row, Chester, CH1 2EF, United Kingdom
Email: info@hipscrub.world
Tel: +44 1244 678 392