Legal

Privacy Policy

Last updated: 5 October 2026

1. Who we are

Varsons Limited operates varsons.com and sells food supplements. We are the controller of the personal information we use to run our store, fulfil orders, support customers and carry out our own marketing.

Company number: 15446691
Address: 124 City Road, London, United Kingdom, EC1V 2NX
Email: support@varsons.com
Telephone: 020 3488 4784

This policy explains our use of personal information under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable electronic privacy rules. Where EU data protection law applies to our activities, we also respect the rights and requirements it provides.

This policy is a notice, not a request for blanket consent. Buying a product or continuing to browse does not mean you have agreed to optional tracking or marketing.

2. Information we collect and where it comes from

Depending on your interaction with us, we collect:

Contact and delivery details: your name, email, telephone number, billing address and delivery address.
Order and subscription information: products ordered, prices, discounts, subscription preferences, transaction references, payment status, delivery records, returns, refunds and related correspondence.
Account information: information used to create, authenticate and manage your customer account.
Support and review information: messages, reviews, photographs and other information you choose to provide about an order or product.
Marketing and privacy preferences: consent records, subscription choices, opt-outs and records needed to respect those choices.
Technical and activity information: IP address, browser and device details, approximate location derived from IP address, pages viewed, referral information and interactions with our store. Optional tracking depends on your choices as explained below.
Security information: transaction checks, relevant device information and records of suspected misuse, payment disputes or fraud investigations.

We collect information directly from you, through our website and permitted tracking, and from providers such as Shopify, payment providers, delivery companies and our analytics and marketing services. Providers may supply payment verification, delivery status, security alerts and permitted activity information.

Payment providers process the payment details needed to complete a transaction. Please do not send us full payment card numbers, security codes or passwords by email.

If you provide another person's details, for example for a gift delivery, ensure you have a proper reason to do so and direct them to this policy. We use those details to fulfil the relevant delivery, not automatically to add that person to marketing lists.

Information needed to process payment and deliver an order is required for the purchase. Without it, we may be unable to fulfil your order. Marketing consent and optional tracking are not conditions of purchase.

3. Why we use information and our lawful bases

Purpose	Information used	Lawful basis
Process purchases, payments, subscriptions, delivery and returns	Contact, order, payment and delivery records	Performance of our contract with you, including steps you request before purchase
Manage accounts and respond to order-related requests	Account details, correspondence and order history	Contract, where needed to provide the service you requested
Answer general enquiries and improve customer support	Contact details and relevant correspondence	Legitimate interests in responding to enquiries and running an effective service
Keep accounts, tax and legally required product records	Transaction records and information required by the relevant law	Legal obligation
Protect the store, investigate fraud and resolve payment disputes	Relevant order, delivery, device and investigation records	Legitimate interests in protecting customers, preventing misuse and defending genuine claims; legal obligation where a specific law requires processing
Send optional marketing you have requested	Contact details and marketing preferences	Consent
Send permitted marketing about our own similar products under the customer soft opt-in	Contact details, relevant purchase history and opt-out records	Legitimate interests in promoting our products, only where all electronic marketing soft opt-in conditions are met
Run optional analytics, session replay and advertising tracking	Online identifiers, device details and permitted activity information	Consent
Publish and manage a review you submit for publication	Review text, selected public name and relevant product details	Legitimate interests in providing authentic customer feedback, subject to additional safeguards for sensitive information
Handle privacy requests and complaints	Contact details, relevant identity checks and request records	Legal obligation

When relying on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights and reasonable expectations. You can ask for more information or object to this use of your information.

We will explain any materially different new purpose before using information for it and obtain consent where required.

4. Health and other sensitive information

You do not need to provide medical information to buy our supplements or request a refund under our satisfaction guarantee. Please avoid sending medical records or unnecessary details about your health.

If you report a reaction, allergy or product safety concern, relevant information may reveal your health. We limit access and use to what is necessary to deal with the matter. Where we need your explicit consent to handle optional health information, we will ask separately and explain the purpose. Simply sending us a message is not treated as blanket explicit consent.

Where information is necessary to establish, exercise or defend a legal claim, we may rely on the relevant special-category condition for legal claims, together with an appropriate ordinary lawful basis. Any other non-consensual use of health information must meet a specific legal condition; a general business interest alone is insufficient.

We do not use health details from support requests to target advertising. We do not intentionally build advertising profiles that infer a medical condition from your purchases or browsing. We will not publish sensitive details from a private support conversation as a testimonial without separate, appropriate permission.

If we receive sensitive information that is unnecessary for a lawful purpose, we will minimise, redact or delete it as appropriate. Withdrawal of consent does not require deletion of information that we must lawfully retain for a separate, explained reason.

5. Marketing and your choices

We use Omnisend to help manage marketing contacts, messages, forms and permitted marketing activity.

We send promotional emails or texts when you have opted in, or where the customer soft opt-in lawfully applies. That exception applies only when we obtain your contact details directly during a sale or genuine sales negotiation, market our own similar products, and give you a clear opportunity to opt out both when collecting the details and in each message. We do not apply it simply because someone visits the website.

Abandoned-basket reminders containing promotional content follow the same marketing rules. Providing an email at checkout does not automatically authorise every marketing use.

You can unsubscribe using the link in an email, the opt-out instructions in a text, or by contacting us. You have an unconditional right to object to use of your information for direct marketing, including related profiling. We retain a limited suppression record where needed to prevent further marketing.

Order confirmations, delivery updates, safety notices and necessary subscription communications may continue after a marketing opt-out because they serve a different purpose.

Where enabled with the necessary consent, tracking may tell us which messages were opened, which links were used and which store activity followed. Optional email tracking is separate from necessary message delivery. You can contact us to withdraw that tracking consent, and use cookie settings for website tracking. We do not treat agreement to receive marketing as automatic agreement to every form of tracking.

6. Cookies, analytics and session replay

Cookies, pixels and similar technologies can store information on your device or access information from it. Some support functions you request, such as a basket, checkout or security. Others measure visits, record interactions or support advertising.

Our approach is to ask for consent before optional analytics, session replay and advertising tracking operate. You can accept or reject optional categories through our cookie controls and reopen Cookie settings to change your choice. Rejecting optional tracking does not prevent you from placing an order.

Technologies strictly necessary for a service you request may operate without consent. A tool is not essential simply because it is useful to our business. Where a preference technology qualifies for a different legal exception, we explain its purpose and provide any required means of objecting.

Our tools include:

Shopify: our store platform, checkout and associated store functionality, with optional analytics and marketing features subject to the relevant choices.
Google Analytics: optional measurement of website visits and interactions.
Google advertising technology: optional campaign measurement and, where enabled and consented to, advertising personalisation.
Omnisend: signup forms and, with appropriate consent, browser activity associated with contacts, baskets and marketing automations. A cookie that remembers a dismissed form has a different purpose from one that tracks browsing.
Inspectlet: optional session replay and interaction analysis to understand navigation and identify usability problems. It may collect page views, clicks, scrolling, pointer movements and technical details. A session replay reconstructs website interactions; it is not a recording from your camera or microphone.

We configure session recording to exclude or mask personal and sensitive fields and do not intentionally record payment credentials, passwords or health information. Consent to analytics does not authorise collection of unnecessary sensitive information.

Our cookie controls provide the current cookie names, providers, purposes and durations. Persistent cookies last for a defined period unless removed sooner; session cookies generally end with the browsing session. Some expiry periods refresh with activity. Cookie duration is distinct from how long a provider retains information already collected.

Browser settings can also remove or block cookies, but blocking essential cookies may affect checkout. Removing cookies does not itself delete information already held by us or a provider. You may need to set preferences again on a different browser or device.

Provider information: Shopify cookies, Google privacy, Omnisend privacy and Inspectlet privacy.

7. Who receives information

We share information relevant to the service or purpose with:

Shopify and providers supporting hosting, checkout, account and subscription functions.
Payment providers and banks for payments, security checks, refunds and disputes.
Delivery and fulfilment providers for shipping, tracking and delivery enquiries.
Customer support, IT and communications providers acting for us.
Omnisend and the analytics and advertising providers described above, subject to the applicable permissions.
Professional advisers, insurers and relevant product suppliers where necessary to address a complaint, safety issue or legal claim, with additional safeguards for health information.
Authorities where a disclosure is required or otherwise lawfully justified.

If our business is sold or reorganised, relevant information may be shared with advisers or a prospective buyer under appropriate confidentiality and data protection safeguards. A transaction does not remove your privacy rights or authorise unrelated marketing.

Providers acting as processors must follow our instructions and appropriate contractual safeguards. Some providers, including payment services and certain Shopify services you choose to use, act as independent controllers for their own specified purposes and explain those uses in their notices. See Shopify's consumer privacy policy and Shopify's privacy portal.

We do not give service providers unrestricted permission to use customer information for unrelated purposes. Public reviews are visible to other people, so avoid including information you do not want published.

8. International transfers

Our service providers may process information outside the UK, including through overseas hosting or support. Where a transfer is subject to UK transfer restrictions, we use an applicable UK adequacy decision or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, with the required assessment and additional measures where necessary.

For transfers subject to EU GDPR, we use the applicable EU transfer mechanism. We do not assume that an EU safeguard alone satisfies UK requirements.

You can contact us for information about the safeguards relevant to your data or a copy of them, subject to necessary redactions for security and confidential information.

9. How long we keep information

We retain identifiable information only for as long as necessary for the stated purpose. The relevant criteria are:

Order, payment and accounting records: the period needed to complete the transaction, handle returns and disputes, meet applicable tax and accounting requirements and address relevant legal claims.
Account and subscription records: while the service is active, then only the records needed for outstanding transactions, legal duties or justified claims.
Support and safety records: until the matter is resolved and for any justified follow-up, safety obligation or applicable claim period. Unnecessary medical detail is removed sooner.
Marketing records: while there is a valid basis to contact you, subject to periodic review of inactivity and continued relevance. A limited opt-out record may be retained to honour your wishes.
Consent and privacy request records: for the period needed to demonstrate and administer compliance and resolve associated complaints.
Analytics and session recordings: for the limited period configured for the stated analysis, followed by deletion or effective anonymisation. Browser cookie lifetimes do not determine the retention of recordings.
Fraud and security records: for as long as the specific risk or dispute reasonably requires, with review rather than indefinite retention based only on suspicion.

We may retain relevant records longer for a legal hold, an unresolved dispute or a specific legal obligation. Once no longer needed, information is deleted or effectively anonymised. Backup copies are removed through the applicable backup cycle and protected from ordinary use while awaiting deletion.

10. Security and fraud decisions

We use proportionate organisational and technical measures to protect personal information, including access controls and limits on staff and provider access. No online system is entirely risk-free, but this does not reduce our legal responsibilities for security or breach handling.

We may use automated tools to identify unusual transactions or suspected fraud. A risk flag is not proof of wrongdoing. Contact us if you believe a decision was incorrect so we can investigate and arrange an appropriate review.

If we make a solely automated decision with a legal or similarly significant effect, we will provide the information and safeguards required by law, including applicable opportunities for human intervention, to express your view and to challenge the decision. We will explain the relevant logic and likely consequences in understandable terms where required.

11. Your rights

Depending on the circumstances, you can ask us to:

Give you access to your personal information and explain how it is used.
Correct inaccurate or incomplete information.
Erase information where there is no lawful reason to retain it.
Restrict particular processing.
Provide portable information where the legal conditions apply.
Stop processing based on legitimate interests where your objection requires us to do so.
Stop direct marketing and related profiling.
Give effect to withdrawal of consent and applicable automated-decision safeguards.

Withdrawing consent does not make earlier lawful processing unlawful. Some records may still need to be retained for a different lawful purpose, such as accounting obligations or a legal claim. We will explain any restriction or refusal rather than treating a request as automatically invalid.

Contact support@varsons.com or use our postal address. We may request proportionate information to verify identity or authority; we do not routinely require identity documents for every request. Requests are normally free. We respond without undue delay and normally within one month, subject to lawful extensions or adjustments, which we will explain where applicable.

12. Privacy complaints

You can make a data protection complaint by email, telephone or post using the details above. We will acknowledge it within 30 days, investigate without undue delay, keep you informed as appropriate and explain the outcome and any action taken.

You also have the right to complain to the UK Information Commissioner's Office through ico.org.uk/make-a-complaint. You do not waive that right by contacting us. If EU GDPR applies, you may also complain to the appropriate EEA supervisory authority.

13. Children, external links and changes

Our store is directed at adults, and our purchasing terms require customers to be at least 18. We do not intentionally target children with marketing. If you believe a child has provided information, contact us so we can assess the situation and take appropriate action, including deletion where required.

Other websites linked from our store have their own privacy practices. This does not remove our responsibility for disclosures or tracking that we arrange through our own store.

We may update this policy when our practices or legal requirements change. We will revise the date and provide further notice where appropriate. A policy update does not itself create consent or retrospectively authorise a new use of your information.