Privacy policy

Herbishire Ltd, a company registered in England and Wales under number 14744357, whose registered office is at Unit 20C, Moorlands Trading Estate, Bristol Road, Gloucester, GL1 5RZ, United Kingdom is the data controller for the personal information described on this page.

Any question about your data, or any request to exercise the rights below, should go to herbishire@gmail.com.

When you place an order we collect your name, delivery address, billing address, email address, telephone number if you give one, and the details of what you ordered. We need these to take your order, pack it, send it and deal with you afterwards. The lawful basis is performance of a contract with you — without this information there is no order.

Our payment processor collects your card details directly. They never reach our servers and we cannot see them; what we receive back is confirmation that a payment succeeded, the last four digits, and a reference.

If you contact us by email we keep that correspondence so we can deal with the matter and have a record of what was agreed. The lawful basis is our legitimate interest in running the business and answering customers properly.

If you leave a product review we publish the name or initials you choose to give and what you wrote. The lawful basis is your consent, which you give by submitting it and can withdraw at any time by asking us to remove the review.

We keep records of sales and tax for as long as HMRC requires. The lawful basis there is compliance with a legal obligation.

We do not sell your data. We do not share it with advertisers or data brokers, and we do not use it to build profiles or to target advertising anywhere.

We do not make any decision about you by automated means, and there is no automated profiling on this site.

We do not send marketing email unless you have specifically asked for it. You can opt in through the tick box at checkout or on your account page. If you do, every message will carry a one-click unsubscribe and we will act on it immediately.

What someone buys from a herbal retailer can imply something about their health. We are conscious of that, and we treat order history accordingly: it is used to fulfil and support your order and for nothing else.

We do not ask you about your health, we do not record health information, and we do not draw conclusions about your health from what you buy. If you volunteer something about your health in an email to us — which people sometimes do — we use it only to answer that message, and you may ask us to delete it.

Shopify, which runs our checkout, and its payment provider process your payment and carry out fraud screening. Their own privacy policy governs what they do with it.

Our hosting and database provider stores the site and the order records on our behalf, under contract and on our instructions only.

Our delivery carrier receives your name, address and, where you have given one, your phone number or email so that they can deliver your parcel and notify you.

Our email provider carries the order confirmations and any correspondence between us.

Each of these is a processor acting on our instructions under a written contract, other than the payment processor, which is also a controller in its own right for fraud prevention and regulatory purposes.

We host and store data in the United Kingdom or the European Economic Area wherever we can. Some of the services above are operated by companies with infrastructure outside the UK.

Where personal data is transferred outside the UK, it is protected either by UK adequacy regulations or by the International Data Transfer Agreement or Addendum approved by the UK government. We will tell you which applies to a specific service if you ask.

Order and transaction records: six years after the end of the tax year they fall in, because HMRC requires it.

Email correspondence: two years from the last message in the thread, unless it relates to an order dispute, in which case it is kept with the order record.

Product reviews: until you ask us to remove the review.

Anything that has passed these periods is deleted or anonymised.

Under UK GDPR you have the right to be told what we hold about you and to receive a copy of it; to have inaccurate data corrected; to have data erased where we no longer have a reason to hold it; to restrict or object to our processing; to receive data you gave us in a portable form; and to withdraw consent where consent is what we relied on.

Write to herbishire@gmail.com and we will respond within one calendar month. We will not charge you, and we will not ask you to justify the request.

If you are not satisfied with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk, by calling 0303 123 1113, or by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You can complain to the ICO without coming to us first, though we would rather you gave us the chance to fix it.

The site runs over HTTPS throughout, payment is handled off-site by a PCI-compliant processor, and access to order records is limited to the people who pack and support orders, each behind their own login.

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours and tell you directly where the risk to you is high.

This site is not intended for children and we do not knowingly collect data from anyone under 18. You must be 18 or over to place an order.