Privacy Policy

Winslow Nutrition Ltd ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share information about you when you visit https://vitback.world (the "Website") or place an order with us.

We are the data controller for your personal data. Our registered address is: Winslow Nutrition Ltd, 14 Harley Street, London W1G 9PH, United Kingdom. Our Company No. / VAT is GB 123 4567 89.

This policy is drafted in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. What Personal Data We Collect

We may collect the following categories of personal data:

• Identity data: full name provided when placing an order or contacting us.
• Contact data: telephone number, email address.
• Order data: product selected, bundle size, price, UTM parameters and Google Click ID (gclid) where present.
• Technical data: IP address, browser type and version, time zone setting, browser plug-in types, operating system and platform, and other technology on the devices you use to access this Website.
• Usage data: information about how you use our Website, products, and services.
• Marketing and communications data: your preferences in receiving communications from us and your communication preferences.
• Cookie data: as described in our Cookie Policy.

We do not collect any special categories of personal data (health data, biometric data, etc.) through this Website.

2. How We Collect Your Personal Data

We collect data through:

• Direct interactions: when you complete our order form, contact form, or quiz; when you correspond with us by email, phone, or otherwise.
• Automated technologies: cookies and similar tracking technologies placed on your device when you browse our Website. See our Cookie Policy for details.
• Third parties: analytics providers (e.g. Google Analytics, subject to your cookie consent) and advertising platforms (e.g. Google Ads, subject to your consent).

3. How We Use Your Personal Data

Purpose	Legal Basis (UK GDPR)
To process and fulfil your order and contact you to confirm it	Performance of a contract (Art. 6(1)(b))
To respond to your enquiries and provide customer support	Legitimate interests (Art. 6(1)(f)) - to provide customer service
To send you marketing communications (if you have opted in)	Consent (Art. 6(1)(a))
To measure the effectiveness of our advertising	Consent (Art. 6(1)(a)) - via cookie consent
To analyse Website usage and improve our services	Consent (Art. 6(1)(a)) - via cookie consent; or Legitimate interests (Art. 6(1)(f))
To comply with legal obligations (e.g. tax, accounting)	Legal obligation (Art. 6(1)(c))
To prevent fraud and ensure Website security	Legitimate interests (Art. 6(1)(f))

4. Cookies and Consent Mode

We implement Google Consent Mode v2. By default, all non-essential cookies (analytics, advertising) are set to denied until you provide consent via our cookie banner. This includes ad_storage, ad_user_data, ad_personalization, and analytics_storage signals.

When you click "Accept All", we update consent signals to granted and store your preference in your browser's localStorage. When you click "Reject All", non-essential cookies remain denied. You may change your preferences at any time by clicking "Settings" in the cookie banner.

For full details of the cookies we use and their purposes, see our Cookie Policy.

5. Sharing Your Personal Data

We may share your personal data with:

• Order fulfilment and logistics partners - to process and deliver your order.
• IT and technology service providers - web hosting, email services, CRM systems.
• Analytics and advertising providers - Google LLC (Google Analytics, Google Ads), subject to your cookie consent. Google may process data in the United States; this transfer is governed by Standard Contractual Clauses approved by the UK ICO.
• Professional advisers - solicitors, accountants, and auditors who owe us duties of confidentiality.
• Regulatory authorities - where required by law (e.g. HMRC, the ICO).

We do not sell your personal data to third parties.

6. International Transfers

Where we transfer your personal data outside the UK, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK ICO, or adequacy decisions. Google LLC transfers are covered by Google's SCCs and additional safeguards under the UK-US Data Bridge.

7. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy:

• Order data: 6 years from the date of order (UK statutory accounting and tax requirements).
• Customer service correspondence: 2 years from the date of last contact.
• Marketing consent records: until you withdraw consent plus 1 year.
• Cookie consent records: 12 months.
• Technical / log data: up to 12 months.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access - to request a copy of the personal data we hold about you.
• Right to rectification - to request that inaccurate data be corrected.
• Right to erasure - to request deletion of your data where we have no legitimate ongoing reason to process it.
• Right to restriction of processing - to request that we limit how we use your data.
• Right to data portability - to receive your data in a structured, machine-readable format (where processing is based on consent or contract).
• Right to object - to object to processing based on legitimate interests, including for direct marketing.
• Rights related to automated decision-making - we do not use automated decision-making or profiling that produces legal or similarly significant effects.
• Right to withdraw consent - where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at info@vitback.world. We will respond within 30 days. We may need to verify your identity before processing your request.

9. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the supervisory authority for data protection in the United Kingdom:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We would, however, appreciate the opportunity to address your concerns directly before you approach the ICO, so please contact us first.

10. Security

We have implemented appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include TLS/HTTPS encryption for data in transit, access controls on internal systems, and regular reviews of our security practices.

Despite these measures, no transmission over the internet is entirely secure. You provide data at your own risk, and we cannot guarantee the security of data transmitted to our Website.

11. Third-Party Links

Our Website may include links to third-party websites. Clicking those links may allow third parties to collect or share data about you. We do not control these websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated via a prominent notice on our Website. Continued use of our Website after such changes constitutes your acceptance of the revised policy.

13. Contact Us

For any questions about this Privacy Policy or our data practices, please contact:

Winslow Nutrition Ltd
14 Harley Street, London W1G 9PH, United Kingdom
Email: info@vitback.world
Phone: +44 20 7946 0958