Privacy Notice
How MED ADVANCE LTD (trading as Energelbo) collects and uses your personal data, under the UK GDPR and the Data Protection Act 2018.
1. Who is responsible for your data
The data controller is MED ADVANCE LTD, trading as Energelbo, Company No. 14640132, 19 Wicket Drive, Birmingham, England, B16 0ND. Contact us about data protection at hello@organicenergelbo.shop.
2. What we collect
- When you place an order: your name, email address, phone number (if given), delivery address, the products you ordered, order notes, and the date and time of the order.
- When you contact us: your name, email address and the content of your message.
- Technical data: your IP address and browser user-agent are recorded with each order and message to help detect abuse. Our hosting provider's server logs also record IP addresses and pages requested.
- Attribution data: if you arrive from an advert, the campaign parameters in the link (utm_*, oppref, clickid) are held in your browser's session storage for the length of your visit and attached to your order so we know which advert led to it. They are not stored in a persistent cookie unless you accept advertising cookies.
- Cookies: see our Cookie Policy. Analytics and advertising cookies are set only if you accept them.
We do not collect card or bank details. Payment is taken by our payment provider through a link we email you; their privacy notice applies to that step.
3. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Processing your order, sending the payment link, dispatching and tracking delivery, handling returns | Performance of a contract with you |
| Keeping order records for accounting and tax | Legal obligation |
| Answering your messages and complaints | Our legitimate interest in running the business and responding to you |
| Detecting fraud and abuse (IP address, honeypot fields) | Our legitimate interest in keeping the site secure |
| Emailing you about new products | Your consent (the separate opt-in box at checkout). You can withdraw it at any time. |
| Analytics and advertising measurement cookies | Your consent, given through the cookie banner |
4. Who we share it with
- Hosting provider: [HOSTING PROVIDER] — stores the website, order records and server logs.
- Email provider: delivers our order confirmations, payment links and replies.
- Royal Mail: receives your name and delivery address to deliver your parcel.
- Payment provider (Stripe or PayPal): receives your name, email and order amount when we create your payment link. They process your card details under their own privacy notice.
- OpenAI (advertising platform): only if you accept advertising cookies, their pixel receives information about your visit and order value so the effectiveness of advertising can be measured.
- Analytics provider: only if you accept analytics cookies.
- Professional advisers, and authorities where the law requires it.
We do not sell your personal data.
5. International transfers
We aim to keep your data in the UK. Where a provider we use (for example an email, payment, analytics or advertising provider) processes data outside the UK, the transfer is protected by the UK's adequacy regulations or by the International Data Transfer Agreement / Addendum approved by the ICO.
6. How long we keep it
- Order records, including your name, address and what you bought: 6 years from the end of the financial year of the order, to meet accounting and tax requirements.
- Messages sent through the contact form: 12 months after the last reply.
- Marketing consent: until you withdraw it. Unsubscribe requests are kept so we don't email you again.
- Cookie consent record: 12 months.
- Server logs: [HOSTING PROVIDER]'s standard retention, typically 30 days.
7. Your rights
Under the UK GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased where there is no good reason for us to keep it; restrict or object to how we use it; receive the data you gave us in a portable format; and withdraw consent at any time where consent is the basis. To exercise any of these, email hello@organicenergelbo.shop. We respond within one month.
8. Complaints
If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, or 0303 123 1113.
9. Children
This site is intended for adults aged 18 and over. We do not knowingly collect data from children.
10. Changes to this notice
We may update this notice from time to time. The date below shows when it was last changed.
Last updated: 8 September 2026