Privacy Policy

Privacy Policy

Last updated: June 2026

Holistic Haven (“we”, “us”, “our”) is committed to protecting your personal data and your right to privacy. This Privacy Policy explains what personal information we collect, how we use it, and what rights you have in relation to it. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Holistic Haven is an online supplement retailer based in the United Kingdom. For any data queries contact us at hello@myholistichaven.co.uk.

2. What Personal Data We Collect

Information you provide directly:

  • Identity data: First name, last name
  • Contact data: Email address, telephone number
  • Address data: Billing and delivery address
  • Payment data: Payment card details — processed securely by our payment providers. We do not store full card numbers.
  • Account data: Username and password if you create an account
  • Communications data: Any messages you send us including customer service enquiries
  • Marketing preferences: Your preferences for receiving marketing from us

Information collected automatically:

  • Technical data: IP address, browser type and version, device type, operating system
  • Usage data: Pages viewed, products browsed, time spent on site, referring URLs
  • Cookie data: Information stored via cookies and similar tracking technologies

3. How We Use Your Personal Data

Purpose Legal Basis (UK GDPR)
Processing and fulfilling your order Contract — Article 6(1)(b)
Sending order confirmations and shipping updates Contract — Article 6(1)(b)
Managing your customer account Contract — Article 6(1)(b)
Responding to customer service enquiries Legitimate interests — Article 6(1)(f)
Sending marketing emails and promotions Consent — Article 6(1)(a)
Improving our website and services via analytics Legitimate interests — Article 6(1)(f)
Fraud prevention and site security Legitimate interests — Article 6(1)(f)
Compliance with legal and tax obligations Legal obligation — Article 6(1)(c)

4. Third-Party Services

We share your personal data only with trusted service providers contractually bound to protect it:

  • Shopify Inc. — Our e-commerce platform. See Shopify’s Privacy Policy.
  • Payment processors (Stripe, PayPal, Apple Pay, Google Pay, Shop Pay) — Secure transaction processing only.
  • DPD Group — Delivery carrier for UK Zone 1. Receives name and delivery address.
  • Royal Mail — Delivery carrier for UK Zone 2. Receives name and delivery address.
  • Appstle — Subscription management and billing.

We do not sell, rent, or trade your personal data to any third parties for their own marketing purposes.

5. International Data Transfers

Some service providers operate outside the UK. Where we transfer data internationally we ensure appropriate safeguards are in place, including UK-approved standard contractual clauses or adequacy decisions.

6. Data Retention

  • Order data: 7 years from purchase date (HMRC tax compliance)
  • Account data: Duration of active account plus 2 years after closure
  • Marketing consent records: Until consent is withdrawn plus 1 year
  • Customer service communications: 3 years from correspondence date

7. Cookies

We use cookies and similar technologies to enhance your shopping experience:

  • Essential cookies: Required for core website functionality (cart, login). Cannot be disabled.
  • Analytics cookies: Anonymised data to help us understand how visitors use our site.
  • Marketing cookies: Placed only with your consent to deliver relevant advertising.

You can manage cookie preferences through your browser settings. For more information visit ico.org.uk.

8. Your Rights Under UK GDPR

You have the right to:

  • Access — Request a copy of the personal data we hold about you
  • Rectification — Request correction of inaccurate or incomplete data
  • Erasure — Request deletion of your personal data
  • Restrict processing — Request that we limit how we use your data
  • Data portability — Receive your data in a structured, machine-readable format
  • Object — Object to processing based on legitimate interests or for direct marketing

To exercise any right email hello@myholistichaven.co.uk. We will respond within 30 days at no charge. You also have the right to complain to the Information Commissioner’s Office (ICO).

9. Security

We implement appropriate technical and organisational security measures to protect your data. All data transmitted between your browser and our website is encrypted using SSL/TLS. Payments are processed through PCI-DSS compliant providers.

10. Changes to This Policy

We may update this policy from time to time. The current version is always published on this page with the date of last update.

Contact: hello@myholistichaven.co.uk