Privacy policy

Privacy Notice (UK & EU GDPR)

Last updated: 27 January 2026

1) Who we are

The Postbiotic Company ("we", "us", "our") is the data controller for the personal data described in this notice.

  • Registered office: 521-525 Battersea Park Road, London, SW11 3BN, United Kingdom
  • Company number: 16543857
  • Contact email: hello@thepostbioticcompany.co.uk
  • Contact address (privacy enquiries): the registered office address

If you have questions about this notice or how we use your data, contact us using the details above.

Data Protection Officer (DPO): We have not appointed a DPO (not required for our current activities). If this changes, we will update this notice with the DPO's contact details.

EU Representative: If and when we are required to appoint an EU/EEA representative (for example, if EU GDPR applies to our activities and we have no EU establishment), we will publish their contact details here.

2) What this notice covers

This notice explains how we collect, use, share and protect personal data when you:

  • visit our website;
  • contact us (including customer support or product enquiries);
  • purchase from us online (if available);
  • subscribe to marketing communications (e.g., email); and/or
  • engage with us as a retailer, distributor, supplier or other business partner.

3) Personal data we may collect

Depending on how you interact with us, we may collect:

A. Contact and account data

Name, email address, telephone number, delivery/billing address, and (if you create an account) login details.

B. Order and payment data

Order details, purchase history, returns and customer service interactions. Payment card details are typically processed by our payment provider (we do not store full card numbers).

C. Communications data

Your messages to us, enquiries, feedback, and support history.

D. Marketing preferences

Your subscription status and communication preferences.

E. Website and device data

IP address, browser type, device identifiers, pages viewed, and similar technical data (often collected via cookies and similar technologies).

Special category data (e.g., health data)

We do not ask for or require health information to use our site or buy our products. If you choose to share health-related information with us (e.g., in an email), we will handle it carefully and only use it to respond to you.

4) How and why we use your data (purposes and lawful bases)

We use personal data only where we have a lawful basis to do so. Depending on the situation, the lawful bases may include:

A. To process orders and provide products/services

  • Purpose: fulfil orders, deliver products, manage returns, provide customer support
  • Lawful basis: performance of a contract (or steps taken at your request before entering a contract)

B. To manage our relationship with you and respond to enquiries

  • Purpose: reply to questions, provide support, handle complaints
  • Lawful basis: legitimate interests (running our business and providing customer service) and/or contract

C. To send marketing communications

  • Purpose: newsletters, product updates, offers
  • Lawful basis: consent (where required) and/or soft opt-in for existing customers (where permitted), with an easy opt-out every time

You can unsubscribe at any time using the link in our emails or by contacting us.

D. To improve our website and protect our business

  • Purpose: website administration, analytics (where enabled), troubleshooting, fraud prevention, security logging
  • Lawful basis: legitimate interests (keeping our website secure and improving our services) and/or consent (for non-essential cookies/trackers)

E. To comply with legal obligations

  • Purpose: accounting/tax records, regulatory compliance, product safety processes
  • Lawful basis: legal obligation

5) Cookies and similar technologies

We use cookies and similar technologies to operate our website and (where enabled) to analyse performance and support marketing.

Where required, we ask for your consent for non-essential cookies and provide a way to change your preferences at any time via [Cookie Preferences link/location].

6) Who we share personal data with

We may share personal data with trusted third parties where necessary, such as:

  • E-commerce and IT providers (website hosting, e-commerce platform, customer support tools)
  • Payment processors (to take payments securely)
  • Delivery and logistics partners (to ship products)
  • Professional advisers (legal, accounting, insurance)
  • Authorities/regulators where required by law

We only share what is necessary and require appropriate confidentiality and security measures from service providers.

7) International transfers (UK, EU/EEA and beyond)

Your data may be processed in the UK, the EU/EEA, and other countries depending on where our suppliers or technology providers operate.

Where we transfer personal data outside the UK or the EU/EEA to a country that is not recognised as providing an adequate level of protection, we use appropriate safeguards (such as Standard Contractual Clauses and, where relevant, the UK Addendum) and take additional measures where necessary.

EU/EEA to UK transfers: As at the "Last updated" date above, the UK benefits from an EU adequacy decision, enabling transfers from the EEA to the UK without additional safeguards.

8) How long we keep your data

We keep personal data only for as long as necessary for the purposes described in this notice, including to meet legal, accounting, tax, and reporting requirements. Typical retention periods include:

  • Order records: kept for the period required for accounting/tax and customer service
  • Enquiry/support records: kept for a reasonable period to handle your query and maintain service history
  • Marketing records: kept until you unsubscribe (and then minimal suppression records to respect your opt-out)

9) Your rights (UK and EU/EEA)

Subject to applicable law, you may have the right to:

  • request access to your personal data;
  • request correction of inaccurate data;
  • request deletion (in certain circumstances);
  • restrict or object to processing (including objection to direct marketing);
  • request data portability (in certain circumstances);
  • withdraw consent (where we rely on consent); and
  • lodge a complaint with a supervisory authority.

To exercise your rights, contact hello@thepostbioticcompany.co.uk

10) Complaints

UK: You can complain to the UK Information Commissioner's Office (ICO).

EU/EEA: If EU GDPR applies, you can complain to your local supervisory authority in the EU/EEA member state where you live, work, or where you believe an infringement occurred.

11) Children's data

Our website and products are not intended for children, and we do not knowingly collect personal data from children.

12) Changes to this notice

We may update this notice from time to time. We will post the latest version on our website and update the "Last updated" date above.

N.B. This notice includes international transfer language and reflects the UK's EU adequacy position as of 19 December 2025 (lasting until 27 December 2031), per ICO and European Commission materials.