Privacy Policy

1. Who We Are

Bramble Cross Nutrition Ltd ("we", "us", "our") is the data controller responsible for your personal data. We are registered in England and Wales.

• Company name: Bramble Cross Nutrition Ltd
• Company No. / VAT: 14782933
• Registered address: 12 Holborn Viaduct, London EC1A 2BN, United Kingdom
• Email: privacy@shouldersforceec.world

We are registered with the Information Commissioner's Office (ICO) as a data controller.

2. What Data We Collect

We may collect and process the following categories of personal data:

2.1 Data You Provide to Us Directly

• Order form: full name, telephone number, quantity selected, order preferences
• Contact form: full name, email address, subject of enquiry, message content
• Consent records: timestamp and nature of consent given at the point of form submission

2.2 Data Collected Automatically

• Technical data: IP address, browser type and version, operating system, referring URL, pages visited, time and date of visit, time spent on pages
• Cookie data: identifiers set by cookies where you have provided consent - see our Cookie Policy for full details
• UTM and tracking parameters: where present in the URL at the time of order, we may record source, medium and campaign tags

2.3 Special Category Data

We do not knowingly collect or process any special category data (including health data, religious beliefs or biometric data). Our products are food supplements; we do not collect or store any data about your health conditions.

3. How We Use Your Data

Purpose	Legal Basis (UK GDPR)
Processing and confirming your order (calling to confirm, dispatching goods)	Article 6(1)(b) - Performance of a contract
Responding to your contact form enquiry	Article 6(1)(b) - Pre-contractual steps; Article 6(1)(f) - Legitimate interests
Sending order confirmation or delivery information	Article 6(1)(b) - Performance of a contract
Analytics - understanding how visitors use our website (aggregated, anonymised where possible)	Article 6(1)(a) - Consent (cookie consent)
Marketing and advertising (where consent given)	Article 6(1)(a) - Consent
Compliance with legal obligations (e.g. accounting records, consumer rights)	Article 6(1)(c) - Legal obligation
Fraud prevention and website security	Article 6(1)(f) - Legitimate interests

4. Consent Mode and Advertising

Our website implements Google Consent Mode v2. By default, all advertising storage, ad user data, ad personalisation and analytics storage are set to denied until you actively accept cookies via our cookie banner. Only essential cookies and security cookies are active by default.

If you choose to accept all cookies, your consent choices update the Consent Mode signals accordingly. You may withdraw or change your cookie consent at any time by clearing your browser cookies and revisiting the site.

5. How Long We Keep Your Data

Data Type	Retention Period
Order data (name, phone, order details)	6 years from the date of order (for accounting and legal purposes)
Contact form enquiries	2 years from the date of the enquiry, unless a longer period is required
Consent records	3 years from the date of consent, or until withdrawal
Analytics data (where consented)	As per the analytics platform's data retention settings (typically 14 months for Google Analytics)
Technical/server logs	90 days

6. Who We Share Your Data With

We do not sell, rent or trade your personal data. We may share your data with the following categories of third parties, strictly to the extent necessary:

• Delivery and logistics partners - to fulfil your order (name and delivery address only)
• Payment processors - where applicable (card payment processing; we do not store card details)
• IT and hosting providers - who process data on our behalf under data processing agreements
• Analytics providers - such as Google Analytics, where you have provided cookie consent
• Advertising platforms - such as Google Ads, where you have provided cookie consent
• Legal and regulatory authorities - where required by law, court order or regulatory investigation

All third-party processors with whom we share personal data are bound by contractual data processing agreements ensuring compliance with UK GDPR.

7. International Transfers

Some of our third-party service providers (including analytics and advertising platforms) may process your data outside the UK or European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the UK ICO, or equivalent transfer mechanisms.

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access - to request a copy of the personal data we hold about you (Subject Access Request)
• Right to rectification - to request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten") - to request deletion of your data in certain circumstances
• Right to restriction of processing - to request that we limit how we use your data
• Right to data portability - to receive your data in a structured, machine-readable format where processing is based on consent or contract
• Right to object - to object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making - we do not use automated decision-making or profiling that produces legal or similarly significant effects
• Right to withdraw consent - where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@shouldersforceec.world. We will respond within one calendar month. We may need to verify your identity before processing your request.

9. Right to Lodge a Complaint

If you believe we have handled your personal data unlawfully or have not respected your rights, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us in the first instance.

10. Cookies

For full details of the cookies we use and how to manage them, please see our Cookie Policy.

11. Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. These include HTTPS encryption, access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure.

12. Children's Privacy

Our website and products are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at privacy@shouldersforceec.world.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page indicates the most recent revision. We encourage you to review this policy periodically.

14. Contact

For any questions, requests or complaints regarding this Privacy Policy or our data practices, please contact us at:

Bramble Cross Nutrition Ltd
12 Holborn Viaduct, London EC1A 2BN, United Kingdom
Email: privacy@shouldersforceec.world