1. Who We Are

This Privacy Policy explains how Fine Supplements Limited collects, uses, stores and shares personal information when you visit, use or make a purchase through www.finesupplements.co.uk, contact us or otherwise interact with our services.

Fine Supplements is operated by Fine Supplements Limited, a company registered in England and Wales under company number 11483149.

For the purposes of applicable UK data-protection law, Fine Supplements Limited is the data controller responsible for the personal information described in this policy, except where another organisation acts as a separate controller.

Data controller: Fine Supplements Limited Company number: 11483149 Registered office: 8 Hansard Gate, West Meadows Industrial Estate, Derby, England, DE21 6AR Privacy email: help@finesupplement.com Website: www.finesupplements.co.uk

In this policy, “Fine Supplements”, “we”, “us” and “our” refer to Fine Supplements Limited. “You” and “your” refer to the person whose personal information is processed.

2. Scope of This Policy

This policy applies to personal information collected through:

• Our online store and checkout;
• Customer accounts;
• Orders, payments, deliveries, returns and refunds;
• Customer-service communications and complaints;
• Email marketing and promotional communications;
• Cookies, pixels, tags and similar technologies;
• Shopify and Shopify Network Intelligence where enabled;
• Google Analytics, Google Ads and related Google services where enabled;
• Meta Pixel and Meta Conversions API where enabled; and
• Other services or integrations that we clearly identify when collecting your information.

Third-party websites and platforms have their own privacy notices. This policy does not control how an independent third party processes information for its own purposes.

3. Personal Information We Collect

The personal information we collect depends on how you interact with us and may include the following categories.

4. Sensitive and Health-Related Information

We do not ask customers to provide medical records or detailed health information when making an ordinary purchase.

You may voluntarily disclose health-related information when asking about a product, reporting an adverse reaction or making a product-safety complaint. Health information may qualify as special-category personal data and receives additional legal protection.

Please avoid sending unnecessary medical information. We may be unable to provide individual medical advice and may recommend that you contact a doctor, pharmacist, veterinarian, manufacturer or appropriate authority.

Where we need to process special-category information, we will identify an appropriate legal basis and additional condition under applicable data-protection law. This may include your explicit consent, the establishment or defence of legal claims, or another condition permitted by law.

5. How We Obtain Personal Information

We may obtain personal information:

• Directly from you, when you place an order, create an account, contact us, subscribe to marketing, submit a review or exercise a legal right;
• Automatically, through cookies, pixels, tags, server logs and similar technologies when you use the website;
• From Shopify, which hosts and powers our online store;
• From payment providers, including payment status and fraud-screening results;
• From delivery carriers and fulfilment providers, including tracking and delivery information;
• From Google, Meta and other marketing or analytics providers, where the relevant integration is enabled and processing is permitted;
• From fraud-prevention and security providers; and
• From publicly available or legally accessible sources, where necessary to verify information, prevent fraud or protect legal rights.

6. Why We Use Personal Information and Our Lawful Bases

UK data-protection law requires us to have a lawful basis for processing personal information. The lawful basis depends on the particular purpose and circumstances.

Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights, freedoms and reasonable expectations.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

7. Information Required to Fulfil an Order

Certain information is required so that we can enter into and perform a sales contract, including your name, delivery address, contact information, order details and valid payment information.

If you do not provide the required information, we may be unable to accept, process, deliver or support your order.

Information used only for marketing, non-essential analytics or advertising is not required to place an ordinary order.

8. Shopify and Shopify Network Intelligence

Our store is hosted and powered by Shopify. Shopify processes personal information when you visit our website, use the checkout, create an account or make a purchase in order to provide and improve the ecommerce services available to you.

Information submitted through our store is transmitted to and shared with Shopify and relevant third-party providers. Shopify and those providers may be located in countries other than the country where you live.

In some circumstances, Shopify acts as a processor on our behalf. In other circumstances Shopify acts as a separate data controller responsible for its own processing.

Shopify Network Intelligence is currently enabled for our store. When this feature is enabled, Shopify may securely use information from your interactions with our store together with information from your interactions with Shopify and other Shopify merchants.

Shopify uses this information to provide Enhanced Services designed to protect, grow, personalise and improve our store and Shopify’s services. These services may include fraud prevention, insights, measurement, product improvement, personalisation and advertising features.

Depending on the service and your consent choices, this processing may involve information about:

• Your device and browser;
• Your interactions with our store;
• Your interactions with Shopify and other Shopify merchants;
• Products viewed, searched for, added to a basket or purchased;
• Transaction and order information;
• Cookie and advertising identifiers; and
• Information used to provide personalised services or advertising.

Other Shopify merchants do not receive access to our customer records merely because Shopify Network Intelligence is enabled.

Where UK law requires consent for non-essential technologies or advertising personalisation, Shopify’s use of eligible device data for non-essential purposes is controlled by the choices made through our cookie banner.

You can withdraw or change your consent through the cookie-preference controls on our website.

You can learn more about Shopify’s processing and exercise relevant rights through:

• The Shopify Consumer Privacy Policy; and
• The Shopify Privacy Portal.

9. Google Analytics and Google Advertising

Where enabled and permitted by your consent choices, we may use Google Analytics 4 and related Google services to understand how visitors find and use our website.

Google Analytics may process information such as:

• Cookie and device identifiers;
• IP-derived approximate location;
• Browser and device information;
• Referral source and advertising campaign information;
• Pages and products viewed;
• Search, basket and checkout interactions; and
• Ecommerce events such as product views, additions to basket, checkout activity and purchases.

We may also use Google Ads and the Google tag to:

• Measure whether advertising results in purchases or other actions;
• Attribute conversions to advertising campaigns;
• Create or use advertising audiences where permitted;
• Limit or improve advertising relevance; and
• Measure order value, currency and transaction information.

Where enhanced conversions or similar features are enabled, first-party contact information such as an email address may be transformed or hashed before being transmitted to Google for matching and conversion measurement. Hashed information may still be treated as personal information under applicable law.

Google may process information as a separate controller in accordance with its own terms and privacy policy. For more information, visit the Google Privacy Policy.

You can manage certain Google advertising choices through Google My Ad Center.

10. Meta Pixel and Meta Conversions API

Where enabled and permitted by your consent choices, we may use the Meta Pixel and Meta Conversions API in connection with Facebook and Instagram advertising.

The Meta Pixel operates through the website and may collect browser-based events. The Meta Conversions API can send selected events from Shopify or our server-side integration to Meta.

Information sent to Meta may include:

• Page and product views;
• Products added to a basket;
• Checkout activity;
• Purchase and transaction events;
• Order value and currency;
• Product identifiers;
• IP address, browser and device information;
• Cookie or advertising identifiers; and
• Customer-matching information such as email address, telephone number, name or location information where permitted.

Customer-matching information may be normalised or hashed before transmission where supported by the integration. Hashing does not necessarily make the information anonymous.

We use this information to measure advertising performance, attribute conversions, build or use audiences, reduce duplicate event reporting and improve advertising relevance.

Meta may match information with Facebook or Instagram accounts and may act as a separate controller for its own processing. For more information, visit the Meta Privacy Policy.

11. Cookies, Pixels and Similar Technologies

We use cookies, pixels, tags, local storage and similar technologies to operate the website and, where you consent, to perform analytics, personalisation and advertising.

These technologies may include:

• Strictly necessary technologies, required for checkout, security, fraud prevention, basket functionality, account login, consent choices and core website operation;
• Analytics technologies, used to understand website traffic, usage and performance;
• Functional technologies, used to remember preferences and provide enhanced features; and
• Advertising technologies, used for conversion measurement, audience creation, remarketing and advertising personalisation.

Strictly necessary technologies may operate without consent where legally permitted. Non-essential analytics and advertising technologies will be controlled by the consent choices made through our cookie banner where consent is required.

You can accept, reject or manage non-essential technologies through the cookie-consent controls available on our website.

Rejecting non-essential technologies will not prevent you from making an ordinary purchase, although some optional features or personalisation may be limited.

You may also control cookies using your browser settings. Blocking all cookies may affect essential website functionality.

Where supported and legally required, Shopify may recognise browser-based privacy signals such as Global Privacy Control for applicable opt-out rights.

12. Marketing Communications

We may send marketing emails where you have consented or where another lawful electronic-marketing basis applies, such as the soft opt-in for relevant products offered to existing customers.

Every marketing email will provide a way to unsubscribe. You may also ask us to stop marketing by emailing help@finesupplement.com.

Unsubscribing from marketing does not prevent us from sending service messages required for an order, account, security issue, product recall, legal notice or customer-service enquiry.

We may retain limited information on a suppression list so that we can respect your request not to receive further marketing.

13. When We Share Personal Information

We may share personal information with the following recipients where necessary and lawful:

• Shopify and ecommerce-platform providers;
• Payment processors, banks and payment-security providers;
• Delivery carriers, warehouses and fulfilment providers;
• Website hosting, cloud, security and technical-support providers;
• Customer-service, email and communication providers;
• Analytics and advertising providers, including Google and Meta where enabled and permitted;
• Fraud-prevention, identity-verification and cybersecurity providers;
• Product manufacturers, suppliers or insurers where necessary to investigate a safety, authenticity, warranty or quality issue;
• Accountants, auditors, insurers, legal advisers and other professional advisers;
• Government bodies, regulators, courts, law-enforcement agencies or tax authorities where disclosure is required or legally justified;
• A purchaser, investor or successor in connection with a proposed or completed sale, restructuring or transfer of the business, subject to appropriate safeguards; and
• Other parties where you direct us or provide valid consent.

We require service providers acting on our behalf to use personal information only for authorised purposes and to apply appropriate confidentiality and security protections.

We do not sell personal information for money. Some advertising or platform disclosures may be treated as “sharing”, “sale” or “targeted advertising” under certain non-UK privacy laws even where no money is exchanged. Where such laws apply, we will provide the required choices or opt-out mechanism.

14. International Transfers

Some service providers, including Shopify, Google and Meta, may process information in countries outside the United Kingdom.

Where UK personal information is transferred internationally, we will use a lawful transfer mechanism where required. Depending on the destination and recipient, this may include:

• UK adequacy regulations;
• The UK International Data Transfer Agreement;
• The UK Addendum to approved standard contractual clauses;
• Another safeguard recognised under UK data-protection law; or
• A specific legal exception where applicable.

You may contact us if you would like more information about the safeguards relevant to a particular transfer.

15. Data Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, tax, accounting, product-safety, fraud-prevention and dispute-resolution requirements.

Retention is normally determined as follows:

• Order, payment, invoice and refund records: retained for the period required by applicable tax, accounting and legal rules, commonly up to six years after the relevant accounting period or transaction;
• Customer-service and complaint records: retained for as long as needed to resolve the matter and for an appropriate period afterwards in case of legal claims or repeat enquiries;
• Product-safety and recall information: retained for as long as reasonably necessary to comply with safety, traceability and legal requirements;
• Customer-account information: retained while the account remains active and afterwards where necessary for security, transaction records or legal obligations;
• Marketing information: retained until you withdraw consent, object or unsubscribe, subject to retaining a minimal suppression record;
• Cookie, analytics and advertising information: retained according to the duration of the relevant technology, consent choice and provider settings; and
• Fraud and security information: retained for as long as reasonably necessary to prevent and investigate fraud, protect systems and establish legal claims.

When personal information is no longer required, we will delete, anonymise or securely isolate it, subject to technical backup and legal-retention requirements.

16. Security

We use reasonable technical and organisational measures intended to protect personal information against unauthorised access, loss, alteration, misuse or disclosure.

These measures may include access controls, encryption in transit, payment-security controls, account authentication, monitoring, backups and contractual safeguards with service providers.

No internet service or storage system can be guaranteed to be completely secure. You are responsible for keeping account credentials confidential and should contact us if you suspect unauthorised access.

Please do not send full payment-card details, passwords or unnecessary medical information through ordinary email or contact forms.

17. Children

Our online store is intended for adults and is not directed at children. You must be at least 18 years old to place an order.

We do not knowingly collect personal information directly from a child for the purpose of allowing the child to purchase products.

If you believe a child has provided personal information without appropriate authority, please contact us so that we can investigate and take appropriate action.

18. Automated Risk Assessment

Shopify, payment providers and fraud-prevention services may use automated tools to assess transactions, devices, addresses and payment activity for potential fraud or security risks.

This may result in an order being held for verification, referred for human review or declined before acceptance.

Where a solely automated decision produces a legal or similarly significant effect and applicable law gives you relevant rights, you may contact us to request information, express your view, challenge the decision or request human review.

19. Your Data-Protection Rights

Subject to applicable conditions and exemptions, you may have the right to:

• Request access to your personal information;
• Request correction of inaccurate or incomplete information;
• Request deletion of personal information;
• Request restriction of processing;
• Receive certain information in a portable format;
• Object to processing based on legitimate interests;
• Object to direct marketing;
• Withdraw consent at any time where processing relies on consent; and
• Raise concerns about qualifying automated decisions.

These rights are not absolute. We may need to retain or continue processing information where permitted or required by law.

To exercise a right, email help@finesupplement.com with the subject line Data Protection Request.

We may request reasonable information to verify your identity and ensure that personal information is not disclosed to an unauthorised person.

We will respond within the timeframe required by applicable law. Data-protection complaints and formal rights requests may be governed by different statutory timeframes.

20. Your Right to Object

You have the right to object at any time to the use of your personal information for direct marketing. If you object, we will stop using your information for direct marketing.

You may also object to processing based on legitimate interests. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

21. Data-Protection Complaints

If you are concerned about how we have used your personal information, you can make a data-protection complaint by emailing help@finesupplement.com with the subject line Data Protection Complaint.

Please explain:

• What you believe happened;
• The personal information or processing concerned;
• Any relevant order or account reference; and
• What outcome you are seeking.

We will:

• Acknowledge receipt of a data-protection complaint within 30 days;
• Take appropriate steps to investigate it without undue delay;
• Keep you appropriately informed of progress; and
• Explain the outcome without undue delay.

If you remain dissatisfied, you have the right to complain to the UK Information Commissioner’s Office:

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF United Kingdom

Website: ico.org.uk/make-a-complaint

22. Third-Party Links

Our website may contain links to websites or platforms operated independently by third parties.

We are not responsible for the privacy, security or content of an independent third-party service. You should review its privacy notice before providing personal information.

23. Changes to This Policy

We may update this Privacy Policy when our services, technologies, providers or legal obligations change.

We will publish the updated version on this website and revise the “Last updated” date. Where a change is significant or required by law, we will provide additional notice before the new use begins.

24. Contact Us

For privacy questions, rights requests or complaints, contact:

Fine Supplements Limited Email: help@finesupplement.com Registered office: 8 Hansard Gate, West Meadows Industrial Estate, Derby, England, DE21 6AR Company number: 11483149

The registered office is not automatically the correct address for product returns. Please follow the return instructions provided by Customer Service.