Draft for review — not yet in effect.
1. Who we are
The data controller for this website is Helix Biograde, operated as a sole trader. Helix Biograde is not currently a registered company. A full geographical trading address is not published on this site at this time. For any privacy question or to exercise a right in this notice, contact us via our Contact page or at sales@helixbiograde.com.
2. What personal data we collect
We collect the personal data you give us when you place an order or contact us: your name, delivery and billing address, email address, telephone number if you give one, and your order history. Card and payment details are entered directly with our payment processor and handled on their systems — they are never sent to or stored by this website.
3. Why we use it, and our lawful basis
We use your personal data for the following purposes:
- To fulfil your order — processing payment, arranging delivery, and dealing with any query or return. Necessary to perform our contract with you.
- Fraud prevention and record keeping — verifying orders, preventing fraudulent transactions, and keeping records we are required to keep, for example for tax purposes. Necessary for our legitimate interests and to comply with our legal obligations.
- Marketing communications, where you have opted in — sent only with your consent, which you can withdraw at any time.
4. Cookies and analytics
This site stores a cart session identifier in your browser’s local storage so your basket survives a page reload; this is strictly necessary for the site to function and is not used to track you. When you go to checkout, our WooCommerce backend sets its own cookies to keep you signed in to that session. We do not currently run any analytics, advertising or marketing cookies.
5. Who we share it with
We share personal data with the categories of recipient needed to run the store: our payment processor, to take payment; our courier, to deliver your order; our website hosting and email providers; and our accountant, for bookkeeping. We do not sell personal data to anyone.
6. International transfers
Some of the providers listed in clause 5 may store or process personal data outside the UK. Where that happens, we rely on an appropriate safeguard, such as the UK’s International Data Transfer Addendum or an adequacy decision.
7. How long we keep it
We keep order and payment records for 6 years, in line with HMRC’s record-keeping requirement for tax purposes. We keep other personal data only for as long as needed for the purpose it was collected for, and delete or anonymise it after that.
8. Your rights
Under UK GDPR you have the right to ask us for a copy of the personal data we hold about you, to have inaccurate data corrected, to ask us to delete it, to restrict or object to certain processing, to receive certain data in a portable format, and to withdraw consent at any time where we rely on it. To exercise any of these rights, contact us via our Contact page. We aim to respond within one month.
9. Complaints
If you are unhappy with how we handle your personal data, please raise it with us first via our Contact page so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
10. Changes to this notice
We may update this notice from time to time; the current version is the one published here. This version was last updated on 27 September 2026.