Privacy Policy

1. Introduction

Aryan Herbals Ltd ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website.

We are registered in England and Wales. Our registered office is at Ved Court, London, TW3 1LS, UK. We are the data controller responsible for your personal data.

2. Information We Collect

Personal Data

We may collect the following personal information:

• Name and contact details (email address, phone number, postal address)
• Payment information (processed securely through our payment providers)
• Order history and preferences
• Communications you send to us
• Account information if you create an account, and the terms version you accepted
• Loyalty programme: points balance, points history and rewards redeemed
• Product reviews: your review, rating and display name
• Basket contents (used to keep your basket and for basket reminders)
• If you are signed in and allow analytics: products you have viewed (used for recommendations)
• Your email preferences (whether you subscribed to, or opted out of, marketing emails)

Automatically Collected Data

Only if you switch on "Analytics" in our cookie banner:

• Our own website statistics: pages visited, products viewed, basket and checkout steps, device type, browser, language and time zone (used to estimate your country). If you are signed in, this is linked to your account. We do not store your IP address in these statistics.
• Session recordings: a replay of how you used the site (pages, scrolling, mouse movements, clicks and taps, screen size), plus technical details (browser and device, page addresses without search terms, loading speed, errors, and which of our systems the page contacted). This is provided by our hosting provider Base44. This includes your basket, checkout, account and order pages, so we can see where people get stuck. Anything you type into forms, email addresses, and the names, addresses, phone numbers and messages shown on those pages are hidden, and staff pages are never recorded. The products you look at and add to your basket are visible. If you are signed in, the recording is linked to your account. Recordings end after 30 minutes or when you are inactive, and are deleted automatically after 30 days.
• Google Analytics

Always, because the website needs them to work safely:

• Security logs kept by our hosting provider (which may include IP addresses)
• Spam protection on forms (Cloudflare Turnstile), where enabled

3. Legal Basis for Processing (GDPR)

Under the UK GDPR, we process your personal data on the following legal bases:

• Contract: orders, payments, delivery, your account, returns, and the service emails described below
• Legitimate interests: keeping the site secure, preventing fraud, loyalty programme administration, and marketing emails to customers who didn't opt out at checkout (see below)
• Consent: newsletters and offers you sign up for; website statistics, session recordings, recommendations based on products you view, and Google Analytics (the "Analytics" choice in our cookie banner); and any advertising or conversion tracking we may use in future (the "Marketing" choice). You can withdraw consent at any time using "Cookie Settings" at the bottom of every page.
• Legal obligation: tax and accounting records

4. How We Use Your Information

• Process and fulfil your orders
• Send order confirmations and delivery updates
• Respond to your enquiries and provide customer support
• Improve our website and services
• Send marketing communications (with your consent)
• Prevent fraud and maintain security
• Comply with legal obligations

We use simple automated rules to suggest products you might like and to decide who receives a basket reminder. We do not make any decisions about you that have legal or similarly significant effects using automated means alone.

Emails we send you

Service emails are part of your account and orders: order confirmations, payment, dispatch and delivery updates, refunds and returns, account and security messages, and replies to your enquiries. These are sent whether or not you receive marketing emails.

Marketing emails (newsletters, offers, wellness tips and basket reminders) are sent only if:

• you signed up for them (for example when creating your account or in the footer), or
• you started a checkout and did not tick the box to say no. In that case we may email you once about items left in your basket and occasionally about similar products of ours (known as the "soft opt-in").

Every marketing email includes an unsubscribe link, and you can change your choices at any time in My Account → Email Preferences. Unsubscribing does not affect service emails.

5. Data Sharing and Disclosure

We may share your information with:

• Base44 (Wix.com group): website hosting, database, email sending and, with your consent, session recordings (USA/EU)
• Stripe Payments Europe: card payments; we never see your full card number (EU/USA)
• Google: website statistics, only with your consent (USA)
• unpkg (public code service): supplies the session-recording software to your browser, only with your consent; like any website, it receives your IP address when the file is downloaded
• Advertising partners: none at present. If we use advertising or conversion tracking in future (for example Google Ads or Meta), it will only run with your "Marketing" consent and we will name the provider here first
• Cloudflare (Turnstile): spam protection on forms, where enabled
• Royal Mail and other couriers: delivery (UK)
• Our accountants and professional advisers: statutory accounts, tax and legal advice (UK)
• Legal authorities: when required by law or to protect our rights

Our staff can see only the information they need for their role, and changes to user accounts are logged.

We do not sell your personal data to third parties.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

7. Your Rights (GDPR)

Under the UK GDPR, you have the following rights:

You can delete your account yourself in My Account → Personal Details (we keep order records for the period shown above because the law requires it). To exercise any other right, including getting a copy of your data, please contact us via our form. We will respond to your request within one month.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Card payments are handled by Stripe and never stored by us. Access to customer data is limited to authorised staff with role-based permissions, changes to user accounts are recorded in an audit log, and secret keys are held in our hosting provider's encrypted secret store.

9. International Transfers

Some of our providers (Base44, Stripe and Google) process data in the United States. Where they do, the transfer is protected by the UK Extension to the EU–US Data Privacy Framework or by the UK International Data Transfer Addendum to the Standard Contractual Clauses.

10. Cookies

We use cookies and similar technologies (such as browser storage and session recordings). Anything that isn't needed for the website to work is off until you switch it on in our cookie banner, and you can change your choice at any time. For detailed information, please see our Cookie Policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new policy on this page and update the "Last updated" date. If you have an account, we'll ask you to review important changes the next time you sign in. If we start using a new kind of tracking that needs your consent, we'll ask you again through the cookie banner before it runs.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us via our form.

13. Supervisory Authority

If you are not satisfied with our response or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): www.ico.org.uk