Privacy Policy

1. Who We Are & Data Controller

This Privacy Policy applies to personal data collected by Unicorn Brands Ltd, trading as Nutrition Geeks ("Nutrition Geeks", "we", "us", or "our"), via our website nutritionsgeeks.co and related online services.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Unicorn Brands Ltd is the Data Controller responsible for your personal data.

2. The Personal Data We Collect

Personal data means any information relating to an identified or identifiable natural person. We collect and process the following categories of personal information:

• Identity Data: First name, last name, title, date of birth (where age verification is required), and username.
• Contact Data: Billing address, delivery/shipping address, email address, and telephone number(s).
• Financial & Transaction Data: Details of payments, payment card token references (we do not store raw card numbers; transactions are handled securely by accredited payment gateways), order history, items purchased, and refund records.
• Technical & Device Data: IP address, browser type and version, time zone setting, location data, operating system, device identifiers, and network connection details.
• Usage & Interaction Data: Information about how you navigate our store, pages viewed, time spent on pages, search queries, cart additions, and interaction with marketing emails.
• Customer Support & Communications: Records of correspondence, inquiries, feedback, product reviews, and survey responses.
• Marketing & Preferences: Your preferences in receiving marketing emails, newsletter subscriptions, and cookie preferences.

3. Lawful Bases for Processing Your Data

Under UK data protection law, we only process your personal information when we have a valid legal basis to do so:

4. How We Use Your Information

We utilize your personal information for specific and lawful purposes:

• To process, pack, and deliver your orders accurately to your chosen address.
• To authorize and verify payment transactions via encrypted gateways.
• To send transactional emails, such as order confirmations, dispatch notices, and tracking numbers.
• To provide prompt, helpful customer support and handle returns, replacements, or refunds.
• To manage your account, active subscriptions, and loyalty rewards.
• To send marketing communications, discounts, and nutritional articles when you have opted in (you may unsubscribe at any time).
• To analyze website performance, optimize user navigation, and troubleshoot technical errors.
• To protect against fraudulent transactions, unauthorized account access, and cyber threats.

5. Third-Party Disclosures & Service Providers

We never sell, rent, or monetize your personal data. In order to provide our e-commerce services, we share necessary information with carefully vetted third-party service providers bound by strict confidentiality and data protection agreements:

• Payment Processors: Stripe, PayPal, Apple Pay, Google Pay, and Klarna for encrypted transaction authorization.
• Logistics & Courier Services: Royal Mail, DPD, and fulfillment partners to deliver parcels to your doorstep.
• Communication & Email Platforms: Klaviyo, Mailchimp, or transactional email servers to send order updates and newsletters.
• Review & Customer Feedback Tools: Trustpilot and Judge.me to collect authentic product feedback.
• Analytics & Optimization: Google Analytics and LiteSpeed caching tools to monitor site reliability and speed.
• Legal & Regulatory Authorities: HM Revenue & Customs (HMRC), law enforcement, or regulatory bodies when required by applicable law.

6. International Data Transfers

Where personal data is transferred outside the United Kingdom or European Economic Area (EEA), we ensure appropriate safeguards are implemented in compliance with UK GDPR. These include utilizing UK International Data Transfer Agreements (IDTAs), European Commission Standard Contractual Clauses (SCCs), and adequacy regulations to guarantee an equivalent level of protection.

7. Data Security & Encryption

We have implemented rigorous technical, administrative, and physical security measures to safeguard your personal data against unauthorized access, loss, alteration, or disclosure.

• 256-bit SSL/TLS end-to-end encryption across all web pages and checkout sessions.
• Strict Level 1 PCI-DSS compliant payment processing environments.
• Role-based access controls ensuring only authorized personnel access customer records.
• Regular vulnerability assessments, malware screening, and automated backups.

8. Data Retention Periods

We retain your personal data only for as long as necessary to fulfill the purposes for which it was gathered:

• Order & Financial Records: Retained for 6 years following the financial year of purchase to comply with UK HMRC accounting and tax statutory regulations.
• Customer Accounts: Maintained while your account remains active or until you request deletion.
• Marketing Subscriptions: Maintained until you opt out or unsubscribe via the link in any marketing email.

9. Your Legal Rights Under UK GDPR

Under UK data protection legislation, you possess comprehensive rights regarding your personal information:

• Right of Access (Subject Access Request): You have the right to obtain confirmation and a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate, outdated, or incomplete data.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where there is no legal reason for its continued processing.
• Right to Restrict Processing: You may request that we suspend processing your data under certain circumstances.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You can object at any time to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

To exercise any of these statutory rights, please email our Data Protection team at customerservices@nutritionsgeeks.co. We respond to all verified requests within 30 days without charge.

10. Cookies & Tracking Technologies

Our website uses cookies, web beacons, and similar technologies to enhance functionality, remember your shopping cart, and analyze site performance. For comprehensive information on how we use cookies and how you can manage your preferences, please view our full Cookie Policy.

11. Children's Privacy

Our website and supplement products are intended for individuals aged 18 and older. We do not knowingly collect personal information from children under 16 years of age. If we become aware that we have inadvertently received personal data from a child under 16, we will delete such data immediately.

12. Updates to This Privacy Policy

We may revise this Privacy Policy periodically to reflect changes in our operational practices or legal requirements. Material updates will be highlighted on this page with an updated effective date. We encourage you to review this policy periodically.

Contact Our Privacy Team

If you have questions, comments, or requests regarding this Privacy Policy or wish to lodge a data subject request, please contact:

Email: customerservices@nutritionsgeeks.co
Postal Address: Unicorn Brands Ltd (Nutrition Geeks), Unit 15 Ribocon Way, Progress Park, Luton, Bedfordshire, LU4 9UR, UK
Regulatory Authority: You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.