Privacy Policy

1. Who We Are (Data Controller)

ZDRAVEX LTD is the data controller responsible for the personal data collected through this Website. This means we determine the purposes and means of processing your personal information.

If you have any questions about how we handle your personal data, please contact us at info@zdravexx.com.

2. What Data We Collect

We collect only the personal data that is necessary to provide our services and fulfil your orders. The categories of data we collect are set out below.

2.1 Account & registration data

• Full name
• Email address
• Username and password (stored securely in encrypted form)

2.2 Order & transaction data

• Delivery address (including postcode and country)
• Order history and order details (items, quantities, prices)
• Payment confirmation data (transaction reference, payment status — see Section 10 regarding card data)

2.3 Communication data

• Messages and enquiries sent to us via email or our contact form
• Customer service correspondence
• Returns and refund requests

2.4 Technical & usage data

• IP address
• Browser type and version
• Device type and operating system
• Pages visited, time spent on pages, and referring URLs
• Cookie identifiers (see our Cookies Policy)

3. How We Collect Your Data

We collect your personal data in the following ways:

3.1 Directly from you

• Account registration — when you create an account on the Website
• Placing an order — when you complete checkout
• Contacting us — when you send an email or fill in our contact form
• Returning an item — when you initiate a return or refund request
• Subscribing to marketing — if you opt in to receive email communications from us

3.2 Automatically

• Cookies and similar technologies — when you browse the Website (see our Cookies Policy for full details)
• Technical data — collected automatically by our web server and analytics tools

4. Why We Use Your Data (Legal Bases)

Under the UK GDPR, we must have a valid legal basis for processing your personal data. The table below explains what we use your data for and the legal basis we rely on for each purpose.

5. How Long We Keep Your Data

We do not keep your personal data for longer than is necessary for the purposes for which it was collected, and we comply with applicable UK data protection and tax law retention requirements.

When data is no longer required, we will securely delete or anonymise it in accordance with our internal data retention procedures.

6. Sharing Your Data

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

We may share your data only in the following limited circumstances:

6.1 Service providers (data processors)

We may share data with trusted third-party service providers who process data on our behalf and under our instructions. These include:

• Payment processors — to securely process your Visa/Mastercard transactions
• Delivery and fulfilment providers — to ship your orders and manage logistics
• IT and hosting providers — to host and maintain our Website and systems
• Email service providers — to send order confirmations and transactional emails

All service providers are contractually required to process your data only as instructed by us and to maintain appropriate security standards.

6.2 Legal requirements

We may disclose your data if required to do so by law, by a court order, or by a regulatory or governmental authority (such as HMRC). We will only disclose the minimum information required.

6.3 Business transfers

In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred as part of that transaction. We will notify you if this occurs and if it affects your data in a material way.

7. International Data Transfers

ZDRAVEX LTD is based in England and Wales. However, some of our service providers may be located outside the UK or the European Economic Area (EEA). Where we transfer your data internationally, we ensure that appropriate safeguards are in place in accordance with UK GDPR requirements, such as:

• Transferring data to countries that the UK has recognised as providing an adequate level of data protection;
• Using standard contractual clauses approved for use under UK data protection law; or
• Applying other lawful transfer mechanisms as permitted under the UK GDPR.

You may contact us at info@zdravexx.com to request further information about the safeguards in place for any specific international transfer.

8. Cookies & Tracking

We use cookies and similar technologies on our Website. Cookies are small text files placed on your device that help us understand how you use the Website and improve your experience.

Full details of the cookies we use, what they do, and how you can manage your preferences are set out in our Cookies Policy.

When you first visit the Website, you will be presented with a cookie consent banner allowing you to choose which categories of cookies you accept. You can update your preferences at any time through the cookie settings on the Website.

9. Marketing Communications

We will only send you marketing emails or promotional communications if you have actively opted in to receive them. We will never add you to a marketing list without your consent.

9.1 Opting out

You can unsubscribe from marketing communications at any time by:

• clicking the "Unsubscribe" link in any marketing email you receive from us; or
• emailing us at info@zdravexx.com with your request.

Opting out of marketing communications will not affect transactional emails related to your orders (such as order confirmations and shipping updates).

10. Payment & Card Data

We only retain confirmation of the transaction (such as a transaction reference number and payment status) for order management and accounting purposes.

11. Children's Privacy

Our Website is intended for use by individuals who are 18 years of age or older. We do not knowingly collect personal data from anyone under the age of 18.

If you believe that we have inadvertently collected data from a person under 18, please contact us immediately at info@zdravexx.com and we will delete that data without delay.

12. Your Rights Under UK GDPR

As a resident of the UK (or the EEA where applicable), you have the following rights in relation to your personal data:

13. How to Exercise Your Rights

To exercise any of your rights under UK GDPR, please contact us at:

• Email: info@zdravexx.com
• Contact form: zdravexx.com/contact-us

We will respond to your request within 30 days of receipt, as required by UK GDPR. In complex or multiple cases, we may extend this period by a further two months, in which case we will notify you.

We may need to verify your identity before processing your request to ensure we do not disclose data to an unauthorised person.

Exercising your rights is free of charge. However, if requests are unfounded, repetitive, or excessive, we may charge a reasonable administrative fee or refuse to act, in which case we will explain our decision.

14. Complaints

If you are unhappy with how we have handled your personal data, we encourage you to contact us first at info@zdravexx.com so that we can try to resolve the matter.

If you remain unsatisfied, you have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our business, services, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this page periodically. Where changes are significant, we may also notify you by email (if you have an account with us). Your continued use of the Website after any changes constitutes your acknowledgement of the updated Privacy Policy.

16. Contact Us

For any questions, requests, or concerns relating to this Privacy Policy or how we handle your personal data, please contact us:

We aim to respond to all data-related enquiries within 2–3 business days.