Privacy policy

Privacy Policy

Last updated: 30 September 2026

This policy explains how Vitaluxe Labs collects, uses, shares and protects your personal information when you visit vitaluxelabs.co.uk, place an order, sign up to our marketing emails, ask to be told when a product is back in stock, or contact us. It also explains your rights under UK data protection law.

1. Who we are

Vitaluxe Labs is the trading name of Curtis Dodds, a sole trader. 6 Roseberry Place, Skelton, TS12 2GQ. vitaluxe@vitaluxelabs.co.uk

Curtis Dodds, trading as Vitaluxe Labs, is the controller of your personal information. This means we decide how and why it is used, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. In this policy, "we", "us" and "our" mean Curtis Dodds trading as Vitaluxe Labs.

How to contact us about your personal information:
- Email: vitaluxe@vitaluxelabs.co.uk
- Post: Curtis Dodds (trading as Vitaluxe Labs), 6 Roseberry Place, Skelton, TS12 2GQ, United Kingdom

We don't have a telephone line, so please contact us by email or post. We reply to emails within 24 hours, Monday to Friday.

2. The information we collect

When you place an order:
- your name, email address, delivery address and billing address;
- your phone number, if you give one at checkout;
- what you ordered, the prices, the delivery method, your order history, and any cancellations, returns or refunds;
- payment details. You enter your card or payment details into Shopify's secure checkout or your chosen payment provider. We don't see or store your full card number. We receive confirmation of payment and limited details such as the payment method and the last digits of the card.

If you create a customer account (where this is offered), we also hold your login details and account settings.

When you sign up to our marketing emails:
- your email address, when and how you signed up, the sign-up wording you saw, and whether you are subscribed or have unsubscribed.

When you ask to be told when a product is back in stock:
- your email address, the product and size you asked about, a link to that product page, and whether you ticked the optional marketing box.

When you contact us:
- your name, email address, your message, your order number if you include it, and our replies.

When you use our website:
- information about your device and how you use the site, such as your IP address, browser type, the pages you view and the items in your basket. This is collected by Shopify, which runs our store, using cookies and similar technologies. Non-essential cookies are only used if you agree to them (see section 11).

If we need to check an order:
- our Terms of Service allow us to ask for more information where reasonably necessary to check that an order is consistent with our research-use-only terms. If we ask and you reply, we keep the information you give us with your order.

Most of this information comes directly from you. We also receive some information from others: Shopify and payment providers tell us whether a payment has gone through and whether an order has been flagged as a possible fraud risk, and Royal Mail provides tracking and delivery updates.

We don't ask for any health information. Please don't send us any.

3. How we use your information and our lawful bases

UK data protection law says we must have a lawful basis for each way we use your information. These are ours:

- To process your order: taking payment, dispatching and delivering your order, sending order and dispatch emails, and dealing with cancellations, returns, refunds and faulty items. Lawful basis: contract (we need the information to carry out our contract with you, or to take steps you ask for before you order).

- To answer your questions and complaints. Lawful basis: contract, where your message is about an order; otherwise legitimate interests (our interest in replying to people who contact us).

- To prevent fraud, keep our website, payments and customer information secure, and check that orders are consistent with our research-use-only terms. Lawful basis: legitimate interests (protecting our business and our customers, and making sure our products are supplied only for laboratory research use).

- To send our marketing emails. Lawful basis: consent. We only send marketing emails to people who have agreed to receive them.

- To send you one back-in-stock alert for the product and size you asked about. Lawful basis: legitimate interests (doing what you asked us to do). You can object at any time by emailing us, and we'll delete your request.

- To keep accounting and tax records and to meet other legal requirements, for example if we must share information with HMRC or another authority. Lawful basis: legal obligation.

- To deal with legal claims, for example a dispute about an order. Lawful basis: legitimate interests (establishing, exercising or defending legal claims).

- To understand how our website is used and to measure marketing, using analytics and marketing cookies. Lawful basis: consent, which you give or refuse through our cookie banner.

Where we rely on legitimate interests, we have considered your interests and rights and believe they are not overridden by ours. You can object to this use at any time (see section 9).

If you don't give us the information we need to process an order, such as a delivery address, we won't be able to fulfil it.

4. Marketing emails

You can sign up to our marketing emails using a sign-up form on our website (for example, the form on our homepage), or by ticking the optional box when you ask for a back-in-stock alert. Placing an order doesn't sign you up to marketing emails. We use your email address to send marketing emails about our products, restocks and offers, through Shopify. Our lawful basis is your consent (UK GDPR Article 6(1)(a)). You can withdraw it at any time using the unsubscribe link in any marketing email, or by emailing vitaluxe@vitaluxelabs.co.uk. We keep a record of when and how you signed up, and the wording you saw, for as long as you're subscribed and for 2 years after you unsubscribe, so we can show we had your consent. We also keep your email address on a "do not email" list so we never send you marketing by mistake. Our lawful basis for that list is our legitimate interests in respecting your choice (Article 6(1)(f)).

5. Back-in-stock requests

When a product is sold out, you can leave your email address on the product page to ask to be told if it becomes available again. Your request reaches us by email through our Shopify store's contact form. We keep it in our email inbox (Google Workspace) and in a private list of requests until it's dealt with. A request does not sign you up to our marketing emails.

We use your email address to send you one email about the product and size you asked about. If we decide not to bring a product back, we may instead send one short email telling you so. Either way, that's the only message the request produces. Our lawful basis is our legitimate interests in doing what you asked us to do (UK GDPR Article 6(1)(f)). You can object at any time by emailing us, and we'll delete your request.

We only send you marketing if you tick the separate optional box. That box is not ticked unless you tick it. If you do tick it, our lawful basis for marketing is your consent (see section 4), and you can unsubscribe at any time.

We delete your back-in-stock request once we've sent you the alert. We delete restock sign-ups when we stop selling a product, can't restock it or decide not to send alerts for it, or after 2 years, whichever is sooner. You can ask us to cancel your request at any time by emailing us.

6. Who we share your information with

We don't sell your personal information. We share it only with the following:

- Shopify, which provides our online store. Shopify hosts our website and checkout, stores our order and customer records and our marketing email list, sends our order and marketing emails, runs our cookie banner and website analytics, and protects our forms from spam. Shopify acts on our instructions as our processor. For some of its own services and features, Shopify uses information as a controller in its own right. You can read how in the Shopify Consumer Privacy Policy (https://www.shopify.com/legal/privacy/app-users) and exercise rights over that data through the Shopify Privacy Portal (https://privacy.shopify.com/en).

- Payment providers: Shopify Payments and its payment processors, and any other payment option you choose at checkout (such as PayPal or Google Pay). They use your payment information to process your payment and to prevent fraud. Some act as controllers in their own right under their own privacy notices.

- Royal Mail, which delivers our parcels. We give Royal Mail your name and delivery address and the details needed for tracking. Royal Mail handles this information under its own privacy notice.

- Google Workspace, our business email provider, which hosts our vitaluxe@vitaluxelabs.co.uk mailbox. This includes the emails that our contact and back-in-stock forms send to us.

- Professional advisers, such as an accountant or solicitor, where we need their advice.

- HMRC, the police, regulators, courts or other authorities, where the law requires us to or where it's needed to prevent or detect crime or to deal with legal claims.

7. International transfers

We are based in the UK, and Royal Mail delivers our parcels within Great Britain. Shopify may store and process your information in other countries where Shopify, its group companies or its service providers operate, including Canada and Singapore. Shopify protects these transfers with safeguards recognised under UK law, such as UK adequacy regulations, its binding corporate rules and standard contractual clauses with the ICO's International Data Transfer Addendum. Google Workspace may also process information outside the UK, under safeguards approved for UK data protection law. Payment providers may also transfer information outside the UK under their own safeguards. You can ask us for more information about these safeguards.

8. How long we keep your information

- Orders, invoices, payments and refunds: 6 years from the end of the tax year in which the order was placed. We need these records for HMRC and in case of a claim about an order.
- Any extra information you give us so we can check an order: kept with the order record for the same period.
- Emails and messages with you: kept with the order record if they're about an order. Otherwise, up to 2 years after we've dealt with your query.
- Marketing emails: until you unsubscribe. We keep the record of your consent for as long as you're subscribed and for 2 years after you unsubscribe. We keep your email address on our "do not email" list so that we don't send you marketing again.
- Back-in-stock requests: until we've sent the alert. We delete restock sign-ups when we stop selling a product, can't restock it or decide not to send alerts for it, or after 2 years, whichever is sooner.
- Customer accounts (where offered): until you ask us to close your account. Your order records are then kept as described above.
- Cookies: for the periods set by each cookie. See section 11.

When we no longer need information, we delete it or make sure it can no longer identify you.

9. Your rights

You have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that's wrong or incomplete;
- ask us to delete your information;
- ask us to restrict how we use your information;
- object to how we use your information where we rely on legitimate interests;
- object to direct marketing at any time. If you do, we'll stop;
- ask us to send the information you gave us to you or to another organisation in a commonly used electronic format (data portability);
- withdraw your consent at any time, where we rely on consent. This doesn't affect anything we did before you withdrew it.

Some of these rights have limits. For example, we can't delete order records that we must keep for HMRC.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

To use any of your rights, email vitaluxe@vitaluxelabs.co.uk or write to us at the address in section 1. It's free. We may need to ask you to confirm your identity. We'll reply within one month. If your request is complex, or you make several requests, we may need up to two more months. If so, we'll tell you within the first month.

10. Complaints

If you're unhappy with how we've used your personal information, please contact us first so we can try to put it right. We'll acknowledge your complaint within 30 days and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113

11. Cookies

Our website uses cookies and similar technologies, provided by Shopify.

- Essential cookies make the website work. For example, they keep items in your basket, run the checkout, keep the site secure and remember your cookie choice. We don't need your consent for these.
- Analytics and marketing cookies help us understand how the site is used and measure our marketing. We only use them if you agree.

When you first visit our site, a cookie banner lets you accept, decline or manage your preferences. Declining doesn't stop you using the site or placing an order. To change your choice later, clear the cookies for vitaluxelabs.co.uk in your browser settings, and the banner will ask you again.

You can find the cookies Shopify uses, and how long they last, at https://www.shopify.com/legal/cookies.

12. Keeping your information secure

Our store runs on Shopify, which encrypts the checkout and payment pages. We limit access to your information to what's needed to run the business. No website or email system can be completely secure, so please don't send payment card details or other sensitive information to us by email.

13. Age

Our website is for adults aged 18 or over, and we don't knowingly collect information about children. If you think a child has given us personal information, please contact us and we'll delete it.

14. Links to other websites

Our website may link to other websites. We're not responsible for how those websites handle your information, so please read their privacy policies.

15. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.