Privacy Policy
Last updated: 1 August 2026
This policy explains how personal data is collected and used when you visit herbavibe.co.uk, contact us or place an order, in line with the UK GDPR and the Data Protection Act 2018.
1. Who is responsible for your data
The data controller is Herbavibe, an independent Herbalife Nutrition member. Contact for all privacy matters: [email protected], telephone +44 (0)7930 130505.
We are separate from Herbalife. Herbalife operates its own websites and member systems under its own privacy notices; this policy covers only this website and our own dealings with you.
2. What we collect and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Name, email, phone, delivery and billing address, order details | To take, process, deliver and support your order, and to deal with returns and refunds | Contract |
| Payment confirmation data (we do not receive or store full card numbers; Stripe and PayPal process payments) | To take payment, prevent fraud and keep financial records | Contract; legal obligation; legitimate interests (fraud prevention) |
| Order and accounting records | Tax and accounting duties | Legal obligation |
| Messages you send through contact forms or email | To answer your enquiry | Legitimate interests; contract if related to an order |
| Account details if you register (username, password hash, order history) | To let you log in and view orders | Contract |
| Marketing email address and preferences, if you opt in | To send news and offers about products | Consent |
| Technical and usage data: IP address, device and browser type, pages viewed, approximate location (analytics) | To understand and improve how the site is used, and to keep it secure | Consent for analytics cookies; legitimate interests for security |
We do not knowingly collect special category data (such as health data) through the site. Please do not include health details in free-text messages unless you want us to discuss them with you; if you do, we will use them only to respond to you.
You must give us the data needed to complete an order. If you do not, we cannot fulfil it.
3. Who we share data with
We use these service providers (processors or independent controllers) only as needed:
- Stripe and PayPal: payment processing.
- Royal Mail and other couriers we use: delivery.
- Our website host and technical support provider, Intellitech IT Solutions Ltd, and Cloudflare (security and content delivery).
- Brevo: sending transactional and, if you opt in, marketing emails.
- Google Analytics (Google LLC): site analytics, only if you consent to analytics cookies.
- WooCommerce and related WordPress plugins running on our server: store, forms and backups.
- Professional advisers (accountants, lawyers) and authorities where the law requires.
We do not sell your personal data.
4. International transfers
Some providers (for example Stripe, PayPal, Google, Cloudflare and Brevo) may process data outside the UK. Where they do, we rely on UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the UK-US data bridge, as applicable to each provider.
5. Cookies and similar technologies
Strictly necessary cookies (basket, checkout, login, security) are needed for the shop to work. We also use Google Analytics cookies (measurement ID G-QMEG1SJKZ8) to understand how the site is used. You can block or delete cookies at any time through your browser settings.
6. Marketing
We only email marketing if you have opted in, or in limited cases where you bought from us and we are promoting similar products with a clear way to opt out (PECR “soft opt-in”). Every email has an unsubscribe link, or you can contact us.
7. Your rights
You have the right to access your data, correct it, have it erased, restrict or object to processing, move it to another provider (portability), and withdraw consent at any time (this does not affect earlier processing). To use any right, email [email protected]. We will respond within one month. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113), though we would appreciate the chance to resolve it first.
8. Security
The site is served over HTTPS, protected by Cloudflare, kept updated and backed up, and access is limited to authorised people. No system is perfectly secure; if a breach is likely to affect your rights we will notify you and the ICO as the law requires.
9. Children
The site and our products are for adults. We do not knowingly collect data from anyone under 18.
10. Changes
We may update this policy and will post the new version here with a new date. Material changes will be highlighted where appropriate.