We are UKHerbals, referred to throughout as we/us. We are based in Reading, UK and are a leading supplier of herbal remedies, herbal tinctures, superfoods and wholefoods to retail & trade customers.

To fulfil your order and comply with EU legislation, we need to collect:

• Your name and address
• Your phone number (if you have supplied it)
• Items that you have ordered from us
• Your email address

We collect anonymous data about your website visit using Google Analytics, however we cannot identify you from this data.

We may also collect your email address if you enter it during checkout but do not complete the purchase. This will be used inline with current GDPR policies on cart abandonment on the basis of legitimate interest. You can opt out of these emails by clicking on the ‘Unsubscribe’ link in any email received.

We also use a GDPR compliant behaviour analytics tool that helps us understand how users are interacting with our website through session replays and heatmaps.

We rely on the following legal bases to collect your information:

• To fulfil the contract between you and us, when you place an order with us, and to ensure performance levels can be verified for customer service or dispute resolution,
• Your positive consent to sign up for our mailing list. This may be withdrawn at any time by clicking the Unsubscribe link at the bottom of any email or contacting us directly.
• To comply with accounting and tax regulations.
• Under a legitimate interest to improve our service to you, we may ask for your feedback in the form of a survey or a review.

Information about our customers is crucial– if we don’t have the right information, we can’t get your orders to you! It also enables us to provide you with the best possible service we can.

Occasionally, we use external services to help us perform these tasks more efficiently and we may need to share your data with these 3rd parties. In order to be fully transparent, we utilise the services of the following companies/services:

• MailChimp – we use MailChimp to allow us to send email newsletters if you have given us your explicit permission to do so.
  Their privacy policy can be found here: https://kb.mailchimp.com/accounts/management/about-the-general-data-protection-regulation
• Stripe – we use Stripe to process payments and detect fraud. We do not process, hold or see any of your credit card data. This is dealt with by Stripe entirely. Their privacy policy can be found here: https://stripe.com/gb/privacy
• PayPal – PayPal are one of our payment processors. Their privacy policy can be found here: https://www.paypal.com/uk/webapps/mpp/ua/privacy-prev
• Customer Reviews Ltd. – We use Customer Reviews to send a one-off invitiation to leave a review on our website. Their privacy policy can be found here: https://www.cusrev.com/privacy-policy
• Google Analytics – We use Google Analytics to capture information about visitors to our site in order to improve our own performance. We do not have access to IP addresses, names or identities of users to our site. Their privacy policy can be found here: https://policies.google.com/privacy?hl=en 

We are legally obliged to retain your order data for the shortest time we can. For legal reasons under company law, we must keep purchase records for up to 7 years.

Some of the services that we utilise are based outside of the EU. The transfer of data will only ever be processed when absolutely necessary and all services are certified under a relevant scheme.

Currently, we have the following services based outside of the EU:

• MailChimp – MailChimp are based in the USA, and are certified under Privacy Shield
  https://kb.mailchimp.com/accounts/management/about-mailchimp-the-eu-swiss-privacy-shield-and-the-gdpr
• Stripe – Stripe process EU originating data in the EU, under Stripe Payments EU, based in Ireland. Some data may be transferred to their US parent company. Should this happen, this is done under their Privacy Shield certification.
  https://stripe.com/privacy-shield-policy

If you reside in certain territories, including the EU, you have several rights in regard to your personal data. While some of these rights apply generally, certain rights apply only in certain limited cases. These rights are described below:

• You may have the right to access and receive a copy of the personal information we hold about you by contacting me using the contact information below.
• Update information held about you. If we hold incorrect information about you, we will update it unless we have good reason not to, without undue delay.
• You have the right to ask us to delete data that we hold about you. We may not be able to comply with this should we have a legal obligation or overriding reason for this. If we do, we will give you a full reason, and tell you about your right to complain to the overseeing body.
• You may ask to restrict what we may do with your data. You may withdraw your consent from any marketing at any time.
  If you wish to restrict our processing of your data, we will suppress your data from any marketing or processing. We may continue to store your data in its entirety, or a subset of your data if it is required for legal reasons, or if we require it to ensure your request for suppression is upheld.
• You can object to
  • Our processing of some of your information based on legitimate interests and
  • receiving marketing messages from us after providing your express consent to receive them.

In such cases, we will suppress your data until we can examine your reasoning for objection and take action appropriate to the decision.
Should you disagree with our decision, you may complain to the appropriate overseeing authority.

• If you reside in the EU and wish to raise a concern about our use of your information (and without prejudice to any other rights you may have), you have the right to do so with your local data protection authority.
  In the first instance, please raise your concern with us, using the details specified at the bottom of this document. If you are unsatisfied with our response, you may complain to the overseeing body.
  In the UK, the overseeing body is the Information Commissioner’s Office (ICO). Details on how to make a complaint can be found here: https://ico.org.uk/concerns/

Should you wish to contact us to discuss our data retention policy please contacts us via the form at: https://www.ukherbals.co.uk/elements/pages/contact/

You may change the contents of your cart at any time until you click the ‘Place Order’ button. After you have placed your order and paid you will receive a confirmation email from us and from our payment provider. This is also your last chance to check the details and items for purchase that you have submitted. Please check this carefully, especially your address details as errors cannot be rectified after your order has shipped.  Please note that it is your responsibility to ensure that the order is correct, including both the billing and shipping address.  We cannot be held resposnbible in the event of you entering an incorrect address.

If you notice an error please contact us via email or our contact page ‘contact us’ form immediately.

If your order has already been dispatched then unfortunately we cannot help further at this point.  Any orders that are shipped to an incorrect address should be returned by Royal Mail.  Once returned we will contact you to arrange redelivery at your expense.