Privacy Policy

How your personal data is used when you shop, sign in or use your portal.

1. Who is responsible for your data

The business you buy from, or that invited you to your account, is the controller of your personal data: it decides why and how your data is used. PepFlow provides the software that business uses to run its store, portal and operations, and processes your data on its behalf and only on its instructions.

2. What we collect

Your name and contact details; your account sign-in details; delivery addresses; your orders and payments (card and bank details are handled by the payment provider and never stored on our servers); messages you send; and, where you choose to record them in your portal, health and dosing information. We also keep technical records such as sign-in times and device information, to keep your account secure.

3. Why it is used

To take and deliver your orders, run your account and portal, answer your questions, meet legal and accounting obligations, and keep the service secure. Health information you add is used only to provide the features you use it for. Your data is not sold.

4. Lawful basis

Processing is necessary to perform the contract you enter into when you order or open an account, to meet legal obligations, and for the legitimate interest of running a secure service. Health information is special category data and is processed with your explicit consent, which you can withdraw at any time.

5. Who it is shared with

Only with those needed to provide the service: payment providers, couriers, email and messaging providers, and hosting providers, each bound to protect it. Where data is transferred outside the UK, it is protected by appropriate safeguards such as the UK International Data Transfer Agreement.

6. How long it is kept

For as long as your account is open and then for as long as the law requires — order and payment records are typically kept for six years for accounting purposes. Anything not needed is deleted or anonymised.

7. Your rights

Under UK GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, and ask for it in a portable form. Contact the business you deal with to exercise these rights. You can also complain to the Information Commissioner's Office (ico.org.uk).

8. Security

Data is encrypted in transit, access is limited to the people who need it, and sign-ins can be protected with two-factor authentication.

9. Changes

This notice may be updated from time to time. The version shown here is the one in force.

10. Contact

For anything about your data, contact the business that sent you your store link or invitation — it is the controller and will respond to your request.