Privacy policy
How we collect, use, and protect your personal data. Your rights under UK GDPR and how to exercise them.
We collect the personal data you give us when you shop, sign up, or contact us. We use it to fulfil your orders, provide customer support, and send marketing you’ve opted into. We don’t sell your data. You have full rights under UK GDPR to access, correct, or delete your data — contact us at privacy@hazecbd.co.uk.
We collect the personal data you give us when you shop, sign up, or contact us. We use it to fulfil your orders, provide customer support, and send marketing you’ve opted into. We don’t sell your data. You have full rights under UK GDPR to access, correct, or delete your data — contact us at privacy@hazecbd.co.uk.
Who controls your data
For the purposes of UK GDPR and the Data Protection Act 2018, the data controller is:
- Haze CBD REVIEW: confirm legal entity name
- Registered office: 15 Whetley Lane, Bradford BD8 9EH
- Companies House No: [Companies House number] REVIEW
- Phone: 0333 2422 723
- Email: privacy@hazecbd.co.uk
We are registered with the Info
What personal data we collect
We collect different categories of personal data depending on how you interact with us.
When you place an order
- Name and contact details (email, phone)
- Delivery and billing address
- Payment information (processed by Stripe / PayPal — we don’t store full card details)
- Order history and product preferences
- IP address and device information for fraud prevention
When you create an account
- Email address and password (passwords stored as hashed values, never plain text)
- Saved addresses and payment methods (tokenised, not full card details)
- Marketing preferences
When you contact us
- Contents of your message and any attachments
- Contact details you provide for our response
When you visit our website
- IP address, browser type, device type, operating system
- Pages visited and time spent
- Referring website
- Cookie data (see our cookies policy)
What we do NOT collect
- Health or medical information about you (this is irrelevant to a food supplement business)
- Special category data (race, religion, sexual orientation, etc.)
- Full payment card numbers (handled by our payment processors)
How we use your personal data
We use your personal data for the following purposes:
| Purpose | Data used |
|---|---|
| Process and fulfil your orders | Name, address, payment info, order details |
| Send order confirmations and dispatch updates | Email, order details |
| Provide customer support | Contact details, message history |
| Send marketing (only if you've opted in) | Email, marketing preferences, purchase history |
| Improve our website and products | Aggregated browsing data, purchase patterns |
| Prevent fraud and abuse | IP address, device info, transaction patterns |
| Comply with legal obligations (tax, accounting) | Transaction records |
| Verify age (CBD products require 18+) | Date of birth declaration / age verification check |
Our lawful basis for processing
Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on:
- Contract performance (Article 6(1)(b)) — to fulfil orders you’ve placed
- Legitimate interests (Article 6(1)(f)) — to operate and improve our business, prevent fraud, and provide customer support
- Consent (Article 6(1)(a)) — for marketing emails and non-essential cookies
- Legal obligation (Article 6(1)(c)) — for tax, accounting, and regulatory records
You can withdraw consent at any time by clicking unsubscribe in any marketing email, updating preferences in your account, or contacting us at privacy@hazecbd.co.uk.
Who we share your data with
We share your data only with the parties needed to provide our services. We do not sell your data to anyone.
Service providers (data processors)
- Payment processors: Stripe, PayPal — for processing transactions
- Couriers: Royal Mail, DPD — for delivering your orders
- Email service provider: Klaviyo — for transactional and marketing emails
- Reviews platform: Trustpilot — to invite reviews after delivery
- Hosting provider: [hosting provider] REVIEW: confirm at build
- Analytics: Google Analytics 4 (anonymised IP)
All service providers are bound by data processing agreements requiring them to handle your data securely and only as instructed by us.
Legal obligations
We may disclose data if required by law, regulation, or legal process (e.g. court order, tax investigation, fraud prevention).
Business transfers
If our business is sold or merged, your data may be transferred to the new owner as part of the transaction. We will notify you before any such transfer.
How long we keep your data
We keep personal data only as long as needed for the purposes we collected it. REVIEW: confirm retention periods with legal/finance
| Data type | Retention period |
|---|---|
| Order & transaction records | 7 years (for UK tax/HMRC compliance) |
| Account data | Until account closure + 30 days |
| Marketing preferences | Until you unsubscribe + 90 days for suppression list |
| Customer support emails | 2 years from last interaction |
| Website analytics | 14 months (GA4 default) |
| Fraud prevention logs | 5 years |
Your rights under UK GDPR
You have the following rights regarding your personal data:
- Right of access — request a copy of what we hold about you
- Right to rectification — correct any inaccurate data
- Right to erasure (“right to be forgotten”) — request deletion of your data, subject to legal retention obligations
- Right to restrict processing — pause our use of your data
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interests, including direct marketing
- Right to withdraw consent — for processing based on consent (e.g. marketing)
- Right not to be subject to automated decision-making — we don’t currently use automated decision-making
To exercise any of these rights, contact us at privacy@hazecbd.co.uk. We’ll respond within one month of receiving your request.
We may need to verify your identity before responding to protect your data from unauthorised access.
Cookies & tracking
We use cookies and similar technologies to operate our website, analyse usage, and (with your consent) deliver marketing. Full details are in our separate Cookies Policy.
You can manage your cookie preferences at any time via the cookie banner or in your browser settings.
International data transfers
Some of our service providers (e.g. Google Analytics, Klaviyo) may process data outside the UK. When this happens, we ensure appropriate safeguards are in place under UK GDPR:
- Transfers to countries with UK adequacy decisions (e.g. EEA countries)
- Standard Contractual Clauses (SCCs) for transfers to other countries
- Compliance with the UK International Data Transfer Agreement (IDTA) where applicable
REVIEW: confirm all third-party processors meet UK adequacy/SCC requirements
How we protect your data
We use industry-standard security measures to protect your personal data:
- HTTPS encryption across our entire site
- Encrypted database storage of sensitive data
- Hashed passwords (never stored in plain text)
- PCI-DSS compliant payment processing via Stripe / PayPal
- Access controls limiting who in our team can view personal data
- Regular security audits and software updates
However, no method of transmission over the internet is 100% secure. If we become aware of a personal data breach affecting your data, we’ll notify you and the ICO within 72 hours where required by law
Children's data
Our products are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at privacy@hazecbd.co.uk and we will delete it.
All purchases on our site require age verification confirming the buyer is 18 or over.
Changes to this policy
We may update this privacy policy from time to time. The “last updated” date at the top of this page tells you when. Material changes will be communicated to you by email (if you have an account) or via a prominent notice on our website.
Continued use of our website after changes constitutes acceptance of the updated policy.
Contact us & complaints
For any questions about this policy or to exercise your rights:
- Email: privacy@hazecbd.co.uk
- Post: Data Protection, Haze CBD, 15 Whetley Lane, Bradford BD8 9EH
- Phone: 0333 2422 723 (Mon–Fri 9am–5pm GMT)
Complaints to the ICO
If you’re unhappy with how we’ve handled your personal data, you have the right to complain to the Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
We’d appreciate the chance to address your concerns first, so please contact us before going to the ICO.
Privacy questions or data requests?
Contact our data protection team directly.