Privacy Policy

1. Who we are

This Privacy Policy explains how babystart® ("babystart", "we", "us" or "our") collects, uses, shares and protects your personal information when you visit our website, create an account, place an order, or otherwise interact with us.

babystart® is the data controller responsible for your personal data for the purposes of UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Company name: [Registered company name]
Company registration number: [Company registration number]
Registered office: [Registered office address]
Data protection contact: [Data protection contact email]

If you have any questions about this policy or how we handle your personal data, please get in touch using the details in Section 13 below.

2. Information we collect

We collect personal information in a few different ways: information you give us directly, information generated when you use our site, and, occasionally, information from third parties. The main categories we collect are:

Account and order information

• Name, email address, delivery and billing address, and phone number
• Order history, products purchased, and any subscription preferences
• Payment confirmation details from our payment processor (we do not store full card numbers — see Section 6)
• Account login details, where you choose to create an account

Contact and customer service information

• Details you provide when contacting our customer service team, including the content of your enquiry, correspondence, and any information you share to help us resolve it
• Records of reviews or feedback you choose to submit

Browsing and technical information

• IP address, browser and device type, and general location (derived from IP address)
• Pages viewed, time spent on the site, and how you arrived at babystart®
• Information collected via cookies and similar technologies — see our Cookie Policy for full details

Because we sell fertility-related supplements and testing products, some information you provide us (for example, in customer service correspondence about trying to conceive) may be considered "special category" health-related data under UK GDPR. We only collect this where you choose to share it with us, we handle it with extra care, and we do not use it for anything beyond the purpose for which it was provided, such as responding to your enquiry.

3. How we use your information

We use your personal information for the following purposes:

• Fulfilling your order — processing payment, arranging delivery, and keeping you updated on order status
• Customer service — responding to enquiries, managing returns and refunds, and resolving complaints
• Account management — maintaining your account and order history, where you have one
• Marketing communications — sending you product updates, offers and fertility advice content, but only where you have opted in (see Section 9)
• Improving our site and products — understanding how customers use babystart®, via aggregated and anonymised analytics wherever possible
• Legal and regulatory compliance — meeting our obligations relating to tax, accounting, consumer protection and product safety
• Fraud prevention and security — protecting our business and customers from fraudulent transactions and misuse of the site

4. Our legal basis for processing

UK GDPR requires us to have a valid legal basis for each way we use your personal data. Depending on the activity, we rely on:

• Performance of a contract — where processing is necessary to fulfil an order or provide a service you have requested
• Consent — where you have actively opted in, such as to marketing emails or non-essential cookies
• Legal obligation — where we must process data to comply with the law, for example tax and accounting rules
• Legitimate interests — where processing is reasonably necessary for running our business (for example, fraud prevention or basic site analytics), and does not override your rights and interests

Where we rely on consent, you can withdraw it at any time — see Sections 5 and 9 below.

5. Cookies

Our website uses cookies and similar technologies to run properly, remember your preferences, and (with your consent) understand how the site is used and show you relevant marketing. For full details of the cookies we use, their purpose, and how to manage your preferences, please see our dedicated Cookie Policy.

6. Sharing your information

We do not sell your personal information. We share it only where necessary, with trusted organisations who help us run babystart®, including:

• Payment processors — to securely process your payment. We do not store your full card details ourselves; these are handled directly by our payment provider under its own security standards
• Delivery couriers — to deliver your order, we share the delivery name, address and contact details needed to get your parcel to you
• IT, hosting and email service providers — who support the technical operation of our website, systems and communications
• Professional advisers and regulators — such as auditors, insurers or legal advisers, or bodies like HMRC, where required
• Analytics and marketing platforms — used to understand site performance and, where you've consented, to deliver marketing (see our Cookie Policy)

We require all third parties who process personal data on our behalf to respect the security of your data and to treat it in accordance with the law. Where any provider is located outside the UK, we put appropriate safeguards in place, such as approved standard contractual clauses, before your data is transferred.

7. How long we keep your data

We keep personal data only for as long as necessary for the purposes it was collected, including to satisfy any legal, accounting or reporting requirements. As a general guide:

• Order and transaction records: retained for [Number] years to meet UK tax and accounting obligations
• Account information: retained while your account remains active, and for [Number] after closure or last activity
• Marketing preferences and consent records: retained until you unsubscribe or withdraw consent, plus a reasonable period to evidence that consent was given or withdrawn
• Customer service correspondence: retained for [Number] to allow us to handle any follow-up queries or complaints

Where data is no longer needed, we securely delete or anonymise it.

8. Your rights

Under UK GDPR, you have a number of rights in relation to your personal data. These include the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — ask us to delete your data, in certain circumstances (sometimes known as the "right to be forgotten")
• Restriction — ask us to limit how we use your data while a query is resolved
• Portability — request your data in a structured, commonly used format to transfer to another provider
• Objection — object to certain processing, including direct marketing at any time, and processing based on legitimate interests
• Withdraw consent — where we rely on your consent, withdraw it at any time without affecting processing carried out before withdrawal

To exercise any of these rights, please contact us using the details in Section 13. We will normally respond within one month, in line with our legal obligations.

If you are unhappy with how we have handled your personal data, you also have the right to complain to the UK's independent regulator, the Information Commissioner's Office (ICO), at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the chance to address your concerns directly first.

9. Marketing preferences

We will only send you marketing communications by email if you have opted in to receive them, for example when creating an account or placing an order. You can withdraw your consent and unsubscribe at any time by clicking the "unsubscribe" link in any marketing email, or by contacting us directly. Opting out of marketing does not affect service communications relating to your orders, such as dispatch confirmations.

10. Children's privacy

babystart® sells fertility products intended for adults, and our website is not directed at, or intended for use by, anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

11. Keeping your data secure

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction, including secure servers, encryption in transit, and access controls that limit who within our business can see your information. While we work hard to protect your data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect changes in the law or in how we operate. Any changes will be posted on this page with an updated "last updated" date. Where changes are significant, we will take reasonable steps to let you know, such as by email or a notice on our website.

13. How to contact us

If you have any questions about this Privacy Policy, or wish to exercise any of your rights, please contact us:

Email: [Data protection contact email]
Post: [Registered office / data protection address]
Phone: [Customer service phone number]