Privacy policy

This policy explains what personal data Evopure Ltd collects when you use evopure.co.uk, buy from us or hear from us, why we collect it, and the choices you have. We keep it short and in plain English; if anything is unclear, email hello@evopure.co.uk.

1. Who we are

Evopure Ltd (company number 11927113, 128 City Road, London, EC1V 2NX) is the data controller for the personal data described here. We are registered with the Information Commissioner’s Office (ICO). You can contact us about your data at hello@evopure.co.uk.

2. What we collect

• Account and order details: name, email, phone number, delivery and billing address, what you ordered, and your order history.
• Payment details: handled by our payment provider, Viva.com. We receive confirmation of payment and the last four digits of the card; we never see or store your full card number.
• Subscriptions: your chosen products, frequency, renewal dates and payment status.
• Marketing and quiz data: your email address and preferences if you sign up to our emails, refer a friend, or take our product quiz (the quiz stores your answers, your matches and the products shown, so we can email your results).
• Reviews, messages and forms: anything you send us through the contact form, lab-report requests, product suggestions, reviews or email.
• Technical data: IP address, browser and device type, the pages you visit and how you got here, collected through cookies and similar technologies (see section 5).

We do not ask for health information. If you choose to tell us about a condition in a message, we use it only to answer you and delete it when the conversation is over.

3. How we use your data and why we are allowed to

What we do	Lawful basis
Take, process and deliver your orders and subscriptions, take payment, and send order emails (confirmation, dispatch, renewal notices)	Performance of a contract
Keep records of sales, refunds and VAT	Legal obligation
Answer your questions, handle returns and complaints	Contract and our legitimate interest in serving customers
Send marketing emails about products, offers and articles	Consent (you can withdraw it at any time), or the soft opt-in for existing customers with an unsubscribe link on every email
Run the product quiz and email your results and welcome offer	Consent, given when you enter your email in the quiz
Run referral and loyalty rewards and prevent misuse	Contract (the reward terms) and our legitimate interest in preventing fraud
Understand how the site is used and improve it, using analytics cookies	Consent, given through the cookie banner
Keep the site secure and detect fraud	Our legitimate interest in running a safe business
Check you are over 18 where we have reason to doubt it	Legal obligation and legitimate interest

4. Marketing

We send marketing emails only if you have signed up, taken the quiz, or bought from us and not opted out. Every email has an unsubscribe link, and you can also change your preferences from My Account or by emailing us. We use Klaviyo to send and measure our emails (opens and clicks), which means your email address, name, order history and preferences are stored in Klaviyo. We do not sell your data and we do not share it with other companies for their own marketing.

5. Cookies

Cookies are small files placed on your device. We use:

• Essential cookies that make the site work: your basket, checkout, login and your cookie choice. These do not need consent.
• Analytics and marketing cookies, which we only set if you choose “Accept all” in the cookie banner. They help us understand which pages are used and measure our advertising. Choosing “Essential only” keeps these off.

You can change your choice at any time by clearing your cookies, and most browsers let you block cookies in their settings, though the site may not work fully without the essential ones.

6. Who we share your data with

We share data only with the services we need to run the business, each under a contract that restricts how they can use it:

• Viva.com (payment processing) and our bank;
• Royal Mail and couriers (name, address and phone number for delivery);
• Klaviyo (email marketing and quiz results);
• our website hosting provider and the WooCommerce platform the shop runs on;
• our loyalty and referral provider, where you take part in rewards;
• Lipscore (product and store reviews): your name, email and the products you ordered, so they can invite you to review your order and publish any review you choose to leave;
• our accountants and professional advisers, and regulators or law enforcement where the law requires it.

7. Where your data is stored

Our site and order data are hosted in the UK and the EU. Some providers, including Klaviyo, process data in the United States. Where data leaves the UK we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so it stays protected to UK standards.

8. How long we keep it

• Order, payment and subscription records: six years after the transaction, for tax and legal purposes.
• Account details: for as long as you have an account, then deleted within 12 months of your request or of the account becoming inactive for three years.
• Marketing data: until you unsubscribe, plus a record of the unsubscribe so we do not email you again.
• Quiz answers and results: 24 months.
• Messages and form entries: 12 months after the matter is closed.

9. Your rights

Under UK GDPR you have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, to have it moved to another provider, and to withdraw consent at any time. To exercise a right, email hello@evopure.co.uk; we respond within one month and will not charge you unless a request is clearly excessive. If you are unhappy with how we handle your data you can complain to the ICO at ico.org.uk or on 0303 123 1113, though we would appreciate the chance to resolve it first.

10. Security

The site is served over HTTPS, payments are handled by a PCI DSS compliant provider, access to customer data is limited to the people who need it, and our systems are kept up to date. No system is perfectly secure; if a breach affects your data we will tell you and the ICO as the law requires.

11. Children

The site and our products are for adults aged 18 and over. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.

12. Changes to this policy

We update this policy when our practices or the law change. The “last updated” date at the top shows the current version; significant changes will be highlighted on the site or by email.