Privacy policy


Flebo Ltd
Last updated: 16 July 2026

Introduction

At Flebo Ltd ("Flebo", "we", "us", "our"), we take your privacy seriously. This Privacy Policy explains what personal information we collect about you, why we collect it, how we use it, who we share it with, how long we keep it, and what your rights are.

This policy applies to all personal information collected through our website at www.flebo.co.uk, through your purchases, through your communications with us, and through our social media channels.

We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy or how we handle your data, please contact us at help@flebo.co.uk.

1. The Law That Governs This Policy

We comply with the following legislation:

  • UK General Data Protection Regulation (UK GDPR)
  • Data Protection Act 2018
  • Privacy and Electronic Communications Regulations 2003 (PECR)
  • Data (Use and Access) Act 2025

We are regulated by the Information Commissioner's Office (ICO), the UK's independent data protection authority.

2. Who We Are

Data Controller: Flebo Ltd
Company number: 14400210
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Email: help@flebo.co.uk
Website: www.flebo.co.uk

We do not currently have a Data Protection Officer (DPO) as we do not meet the threshold requiring mandatory appointment under UK GDPR. All data protection enquiries are handled directly by our team and can be directed to help@flebo.co.uk.

3. What Personal Information We Collect

3a. Information You Give Us Directly

  • Identity data: Your full name
  • Contact data: Email address, phone number, delivery address, billing address
  • Payment data: Card details processed securely by our payment processor, never stored by us directly
  • Account data: Username and password if you create an account
  • Communications data: Messages, emails, or enquiries you send us
  • Transaction data: Products purchased, order history, subscription details

3b. Information We Collect Automatically

  • Device data: IP address, browser type and version, operating system, device type
  • Usage data: Pages visited, time spent on pages, links clicked, search terms
  • Cookie data: See our separate Cookie Policy for full details

3c. Information From Third Parties

  • Shopify: Order processing, payment handling, and fraud prevention
  • Royal Mail: Delivery and tracking information
  • Google Analytics: Aggregated, anonymised usage data
  • Meta (Facebook and Instagram): Advertising interaction data, according to your platform privacy settings
  • Klaviyo: Email and SMS marketing profile data
  • TikTok: Advertising interaction data, according to your platform privacy settings

4. Why We Collect Your Information and Our Legal Basis

  • Processing your order and delivering your products.
    Lawful basis: Performance of a contract.
  • Processing payment and preventing fraud.
    Lawful basis: Performance of a contract and legal obligation.
  • Sending order confirmations and customer service communications.
    Lawful basis: Performance of a contract.
  • Managing your account and subscription.
    Lawful basis: Performance of a contract.
  • Sending marketing emails, newsletters, promotional offers, or SMS.
    Lawful basis: Consent. We will only send you marketing communications if you have opted in. You can opt into email and SMS separately and withdraw your consent at any time.
  • Improving our website and understanding how it is used.
    Lawful basis: Legitimate interests.
  • Running targeted advertising campaigns on Meta, Google, and TikTok.
    Lawful basis: Consent, provided through our cookie banner.
  • Complying with legal obligations.
    Lawful basis: Legal obligation.
  • Protecting the safety of our customers and preventing misuse of our returns and guarantee policy.
    Lawful basis: Legitimate interests.

5. Children's Privacy

We take children's privacy particularly seriously. Under the Data (Use and Access) Act 2025, we have a specific duty to apply higher protection standards when our services are likely to be accessed by children.

Although our website sells products including a Kids Multivitamin range, our website itself is not directed at children and is intended for use by adults, parents, and guardians only. We do not knowingly collect personal data directly from children under the age of 13.

If you are a parent or guardian and believe your child has provided personal data to us, please contact us immediately at help@flebo.co.uk and we will delete that information promptly.

6. How We Share Your Personal Information

We do not sell your personal data to third parties. We share your data only in the following circumstances:

  • Shopify, our e-commerce platform: shopify.com/legal/privacy
  • Royal Mail: Delivery and tracking services
  • Google LLC: Analytics and advertising policies.google.com/privacy
  • Meta Platforms, Inc.: Advertising facebook.com/privacy/policy
  • TikTok Inc. and TikTok Technology Limited: Advertising ads.tiktok.com/i18n/official/policy/privacy
  • Klaviyo, Inc.: Email and SMS marketing
  • Our affiliate platform provider: Referral attribution
  • Payment processors: Shopify Payments and underlying payment processors
  • Legal and regulatory authorities: Where required by law
  • Business transfers: We will notify you before your data is transferred as part of an acquisition or merger

7. International Data Transfers

Some of the third-party services we use, including Shopify, Google, Meta, TikTok, and Klaviyo, may transfer and store your personal data outside the United Kingdom.

Where this occurs, we ensure appropriate safeguards are in place, including transfers to countries with UK adequacy decisions, standard contractual clauses approved by the ICO, or binding corporate rules where applicable.

8. How Long We Keep Your Data

  • Order and transaction data: 7 years, in accordance with HMRC requirements
  • Customer account data: Duration of the account plus 2 years
  • Marketing consent records: Until consent is withdrawn, plus 2 years
  • Customer service correspondence: 3 years
  • Website analytics data: Up to 26 months
  • Subscription data: Duration of the subscription plus 2 years
  • Returns and refund records: 3 years

9. How We Keep Your Data Safe

We take the security of your personal data seriously and have put in place appropriate technical and organisational measures.

These measures include:

  • Secure HTTPS encryption
  • PCI DSS-compliant payment processing
  • Restricted staff access on a need-to-know basis

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours as required by UK GDPR and will notify you directly where required.

10. Automated Decision-Making

We use limited automated decision-making through Shopify's fraud prevention tools, such as temporarily blocking IP addresses or flagging payment cards linked to suspicious activity.

These measures do not have a significant legal or similarly significant effect on you.

If you believe you have been incorrectly affected, please contact us at help@flebo.co.uk.

11. Cookies and Tracking Technologies

We use cookies and similar technologies on our website. For full details, please read our separate Cookie Policy.

12. Marketing Communications

We will only send you marketing emails, SMS messages, or promotional communications if you have given us your explicit consent to do so.

You can opt into each marketing channel separately.

You can withdraw your consent and unsubscribe at any time by:

  • Clicking the unsubscribe link in a marketing email or message
  • Emailing us at help@flebo.co.uk
  • Managing your preferences in your account settings

Unsubscribing from marketing does not affect essential transactional communications, such as order confirmations.

13. Your Rights Under UK GDPR

  • Right to be informed: This Privacy Policy fulfils that obligation.
  • Right of access: You can request a copy of your personal data, also known as a Subject Access Request. We respond within one calendar month.
  • Right to rectification: You can ask us to correct inaccurate or incomplete data.
  • Right to erasure: You can ask us to delete your data in certain circumstances.
  • Right to restrict processing.
  • Right to data portability.
  • Right to object: This includes the right to object to direct marketing, which we will always comply with immediately.
  • Rights related to automated decision-making.

To exercise any of these rights, please contact us at help@flebo.co.uk.

We will respond within one calendar month and may need to verify your identity before processing your request.

14. Right to Complain

You have the right to complain directly to us by emailing help@flebo.co.uk.

We will acknowledge your complaint within 30 days, take appropriate steps to resolve it without undue delay, and keep you informed of the progress and outcome.

If you are not satisfied with our response, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

  • Website: ico.org.uk
  • Telephone: 0303 123 1113
  • Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would, however, appreciate the opportunity to address your concerns before you contact the ICO.

15. Third-Party Links

Our website may contain links to third-party websites or platforms.

This Privacy Policy does not apply to those third-party sites, and we encourage you to read their privacy policies before providing any personal data.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we make changes, we will update the date at the top of this policy and notify you directly by email about significant changes where we hold your contact details.

17. Contact Us

Flebo Ltd
Company number: 14400210
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Email: help@flebo.co.uk
Website: www.flebo.co.uk

We aim to respond to all data protection enquiries within 5 working days and will resolve all requests within the legally required timeframe of one calendar month.