Privacy policy

Last updated: 15 September 2026

1. Who we are

The Supplement Store is operated by Fortitude Ventures Ltd, a company registered in England and Wales under company number 07566632.

Our registered address is:

Fortitude Ventures Ltd
E-Innovation Centre
Telford
Shropshire
TF2 9FT
United Kingdom

Fortitude Ventures Ltd is the controller of the personal data described in this policy, except where another organisation processes your information as an independent controller.

This policy explains how we collect, use, disclose and protect personal information when you:

• Visit or use www.thesupplementstore.co.uk.

• Create or use a customer account.

• Place an order or request a return or refund.

• Join a loyalty or rewards programme.

• Submit a review.

• Subscribe to marketing.

• Contact us or otherwise interact with us.

2. Personal information we collect

Depending on how you interact with us, we may collect:

• Identity and contact information, including your name, billing address, delivery address, email address and telephone number.

• Account information, including account identifiers, login details and saved preferences.

• Order and transaction information, including products viewed or purchased, basket contents, discount codes, order values, refunds, delivery details and limited payment information.

• Customer-service information, including enquiries, complaints, correspondence and information you provide when asking for assistance.

• Marketing information, including newsletter subscriptions, communication preferences and responses to marketing.

• Review, loyalty and promotional information, including reviews, ratings, reward activity and entries into promotions.

• Technical and usage information, including IP address, browser and device type, operating system, approximate location, referring pages, pages viewed, searches, basket activity and interactions with our store.

• Advertising and attribution information, including identifiers used to understand whether an advertisement resulted in a visit or purchase.

• Security and fraud-prevention information, including device, transaction and behavioural indicators used to detect suspicious activity.

We generally do not receive or store your full payment-card number. Payment providers process payment details and provide us with confirmation and limited transaction information.

3. Information concerning health

We do not require health or medical information to process an ordinary order.

You may choose to mention health information when asking us a product-related or customer-service question. Please do not provide health information unless it is genuinely necessary.

If you voluntarily provide health information, we will use it only as reasonably necessary to respond to your enquiry, protect your safety or meet legal obligations. Where an additional legal condition is required to process this type of information, we will rely on your explicit consent or another condition permitted by law.

Information provided by our store is not a substitute for professional medical advice.

4. How we obtain information

We collect information:

• Directly from you when you order, create an account, contact us, subscribe, submit a review or participate in a programme.

• Automatically when you use our store, including through cookies, pixels, tags and similar technologies.

• From service providers involved in payments, delivery, fraud prevention, customer support, analytics or advertising.

• From marketplaces, advertising platforms or referral partners when you interact with us through those services.

• From publicly available sources where permitted by law.

5. How and why we use personal information

We use personal information for the following purposes and lawful bases:

Providing products and services

We use information to:

• Process payments and orders.

• Arrange warehousing, fulfilment and delivery.

• Provide order confirmations and delivery updates.

• Manage returns, refunds and customer accounts.

• Operate loyalty, review and customer-support services.

We normally do this because it is necessary to perform a contract with you or take steps at your request before entering into a contract.

Meeting legal obligations

We use information where necessary to:

• Maintain tax, accounting and business records.

• Respond to lawful requests from regulators, courts or law-enforcement bodies.

• Meet consumer-protection, product-safety and recall obligations.

• Establish, exercise or defend legal claims.

Security and fraud prevention

We use information to secure our store, verify transactions, prevent fraud, enforce our terms and protect customers and the business.

We rely on our legitimate interests in operating a secure business, compliance with legal obligations and, where applicable, performance of our contract with you.

Payment and ecommerce providers may generate automated risk indicators. We do not normally make decisions that have legal or similarly significant effects on you solely through automated processing.

Improving our store and services

We may analyse how customers use the store, identify technical problems, measure performance and improve our products, navigation and customer experience.

Where cookies or similar technologies require consent, we perform this processing only after you provide that consent. In limited circumstances, we may use aggregated, restricted or cookieless measurement where permitted by law and where your rights do not override our legitimate interests.

Marketing and advertising

We may:

• Send marketing communications you requested.

• Send marketing about similar products to existing customers where the law permits.

• Measure advertising performance.

• Build advertising audiences or display personalised advertisements where you have consented.

• Use enhanced conversion measurement, which may transform information such as an email address into a hashed identifier before sending it to an advertising provider for attribution.

We rely on consent where required. In limited cases, such as the electronic-marketing “soft opt-in” for existing customers, we may send marketing where otherwise permitted by law.

You can unsubscribe using the link in any marketing message. We may retain a minimal suppression record so that we continue to respect your request.

6. Shopify

Our store is hosted by Shopify. Shopify processes personal information when you visit the store, create an account, use checkout or make a purchase.

Shopify processes information to operate and secure its platform, provide checkout and payment functionality, maintain customer preferences, prevent fraud and provide other Shopify services.

Where Shopify Network Intelligence or another Shopify Enhanced Service is enabled, Shopify may also process information concerning your interactions with this store, other Shopify merchants and Shopify services to provide features such as personalisation, security, analytics and advertising. Processing for non-essential advertising or similar purposes is subject to applicable law and your privacy choices.

Information may be transferred to Shopify and its service providers in other countries.

You can read the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal to learn more about Shopify’s processing and exercise Shopify-specific privacy choices.

7. Cookies and similar technologies

We use cookies, pixels, tags, local storage and similar technologies.

These technologies may fall into the following categories:

• Strictly necessary: required for checkout, basket operation, security, payments, delivery location, consent choices and other services you request.

• Analytics and performance: help us understand visits and improve the store. Providers may include Shopify Analytics, Google Analytics 4, Microsoft Clarity and Ahrefs.

• Advertising and attribution: help measure advertising, attribute purchases and, with permission, personalise advertising. Providers may include Google Ads and the Google & YouTube app, Meta, and Microsoft Advertising.

• Functionality: support optional store features such as reviews, loyalty services, customer support and preferences.

Strictly necessary technologies may operate without consent where legally permitted.

In regions where consent is required, non-essential analytics and advertising cookies are not stored unless you accept them through our cookie banner. If you decline, certain providers may still receive limited technical requests, aggregated information or consent-status signals where permitted by law, but they are not authorised by us to store non-essential cookies for those purposes.

You can accept, decline or change your choices at any time using the Cookie Preferences link in the footer of our store. Withdrawing consent does not affect processing that occurred lawfully before withdrawal.

You can also delete or block cookies using your browser. Blocking strictly necessary cookies may prevent parts of the store from working properly.

Further information about Shopify cookies is available in the Shopify Cookie Policy.

8. Organisations with whom we share information

Where necessary for the purposes described above, we may share information with:

• Shopify, which provides our ecommerce platform, checkout, customer accounts, fraud-prevention tools and related services.

• Payment providers, card networks and payment methods selected during checkout, such as Shopify Payments, PayPal, Amazon Pay, Google Pay or Shop Pay.

• Any warehousing or fulfilment providers involved in preparing your order.

• Royal Mail and other delivery providers used to deliver and track orders.

• Customer-support providers.

• Review, loyalty and store-feature providers, including Judge.me, Google customer-review services and BON Loyalty where those features are used.

• Analytics and advertising providers, including Google, Microsoft, Meta and Ahrefs, subject to your consent choices and applicable law.

• IT, hosting, security and professional advisers, including accountants, insurers, lawyers and technical support providers.

• Public authorities, courts or regulators where disclosure is legally required.

• A buyer, investor or successor organisation in connection with a proposed or completed sale, restructuring or transfer of the business, subject to appropriate safeguards.

We do not sell personal information for money. Certain advertising disclosures may be treated as “sale”, “sharing” or targeted advertising under some non-UK privacy laws. Where those laws apply, we provide the required choices or opt-out mechanism.

Service providers are permitted to use information only for the agreed services, their legitimate independent purposes or as required by law.

9. Reviews and public content

If you submit a product review, rating or other public content, the information you choose to publish may be visible to other visitors.

Do not include personal, medical or confidential information in a public review.

We may moderate or remove content in accordance with our terms and legitimate interests, but copies may remain with review-platform providers or in lawful records.

10. International transfers

Some service providers operate outside the United Kingdom. Your information may therefore be processed in countries with different data-protection laws.

Where required, we use recognised safeguards such as:

• UK adequacy regulations.

• The UK International Data Transfer Agreement.

• The UK Addendum to approved Standard Contractual Clauses.

• Other safeguards permitted under applicable data-protection law.

You may contact us for further information about safeguards relevant to your information.

11. How long we retain information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, fraud-prevention and dispute-resolution requirements.

In general:

• Order, transaction, refund and accounting records are normally retained for at least six years where required for UK tax, accounting or legal purposes.

• Account information is retained while the account is active and afterwards where reasonably necessary for legal or operational purposes.

• Customer-service correspondence is retained until an enquiry is resolved and for an appropriate period afterwards in case of further questions or claims.

• Marketing information is retained until you withdraw consent, object or the information is no longer required. A limited suppression record may be retained to honour an opt-out.

• Reviews and loyalty records are retained while the relevant feature or account remains active, subject to legal and operational requirements.

• Analytics and advertising information is retained according to our configured settings and the retention periods applied by the relevant provider.

We periodically review information and delete, anonymise or securely archive it when it is no longer required.

12. Security

We use reasonable organisational and technical measures intended to protect personal information from loss, misuse, unauthorised access, alteration and disclosure.

No internet transmission or storage system is completely secure. You should use a strong, unique password and contact us promptly if you believe your account or information has been compromised.

13. Your rights

Depending on the circumstances, UK data-protection law may give you the right to:

• Be informed about how we use your information.

• Request access to your personal information.

• Ask us to correct inaccurate or incomplete information.

• Ask us to erase information in certain circumstances.

• Ask us to restrict processing.

• Object to processing based on legitimate interests.

• Object at any time to processing for direct marketing.

• Request portability of information you provided to us where the right applies.

• Withdraw consent at any time.

• Ask about safeguards used for international transfers.

• Not be subject to certain decisions based solely on automated processing.

These rights are not absolute and exemptions may apply.

We may request information needed to confirm your identity and locate the relevant records. We will normally respond within one month after receiving the information necessary to process your request.

To exercise a right, use our contact form or write to us at the address above. State “Data protection request” at the beginning of your message.

14. Children

Our store is not directed at children, and we do not knowingly collect personal information from children without appropriate involvement from a parent or guardian.

If you believe a child has provided information to us inappropriately, please contact us so that we can investigate and take appropriate action.

15. Data-protection complaints

You can make a data-protection complaint using our contact form or by writing to our registered address. State “Data protection complaint” at the beginning of your message and explain what you believe has gone wrong.

We will:

• Acknowledge the complaint within 30 days.

• Take appropriate steps to investigate without undue delay.

• Keep you informed where an investigation takes time.

• Tell you the outcome without undue delay after completing our investigation.

You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator:

Make a data-protection complaint to the ICO
Telephone: 0303 123 1113

You do not have to contact us before approaching the ICO, although we would appreciate the opportunity to resolve your concern.

16. Third-party websites and services

Our store may contain links to third-party websites, social platforms, payment services or marketplaces.

Those organisations control their own processing, and their privacy policies apply when you use their services. We are not responsible for the privacy practices of websites or services we do not control.

17. Changes to this policy

We may update this policy when our business, services, providers or legal obligations change.

The date at the top shows when the policy was last updated. Where a change materially affects how we use personal information, we will take reasonable steps to provide additional notice where required.

18. Contact us

For privacy questions, rights requests or complaints, contact:

Fortitude Ventures Ltd, trading as The Supplement Store
E-Innovation Centre
Telford
Shropshire
TF2 9FT
United Kingdom

Company number: 07566632

Contact The Supplement Store