Privacy notice

Who is responsible for your data

First72 Ltd (company number [company number], registered office [registered office address]) is the controller of your personal data. We are registered with the Information Commissioner's Office under number [ICO registration number]. Contact us about privacy at [support email].

What we collect

• Order details: name, delivery address, email, phone number, the kits you bought and the order value
• Payment details: processed by Stripe; we receive only a confirmation, the last four digits and card type, never your full card number
• Customer service messages you send us by email, live chat or social media, and the page you started a chat from
• Waitlist and newsletter sign-ups: your email address, which kit you are waiting for, and whether you agreed to marketing emails
• Security data: a scrambled (hashed) form of your IP address, used only to stop spam and repeated attacks on our forms and chat. We never store the IP address itself
• Website data: pages visited and device information, collected by cookies only where you have agreed (see our cookie policy)

Why we use it, and our lawful basis

• To process, deliver and support your order (performance of a contract)
• To tell you when a kit you joined the waitlist for is available, because you asked us to (your request and consent)
• To answer your questions in live chat and by email (legitimate interests, or steps before a contract if you are about to buy)
• To keep accounting and tax records (legal obligation)
• To contact you about a product recall or a safety issue with your kit (legitimate interests and legal obligation under product safety law)
• To remind you before items in your kit expire, if you ticked the box to receive reminders or bought from us and did not opt out (legitimate interests; you can stop at any time)
• To send marketing emails, only where you have consented or, for existing customers, about similar products with an easy opt-out in every email (consent, or the soft opt-in under PECR)
• To prevent fraud and keep our website secure (legitimate interests)

Who we share it with

We share data only with service providers who act on our instructions and protect it:

• Stripe (payments)
• Our courier (to deliver your parcel: name, address, phone number)
• postcodes.io (to check that your postcode exists; we send the postcode only)
• Vercel (website hosting)
• Neon (our order database, hosted in the EU or UK)
• Resend (sends order, dispatch and refund emails)
• Microsoft 365 (our mailbox for customer service)
• Our email marketing provider (only if you have signed up)
• Our accountants and professional advisers, and public authorities where the law requires it

We never sell your personal data.

International transfers

Some providers (for example Stripe, Vercel, Resend and Microsoft) may process data in the United States. Where this happens, the transfer is protected by the UK Extension to the EU-US Data Privacy Framework or by the UK International Data Transfer Agreement or Addendum.

How long we keep it

• Order and accounting records: 6 years after the end of the financial year, as required by UK tax and company law
• Recall and batch records: for the shelf life of the kit plus 2 years, so we can contact you about safety issues
• Marketing: until you unsubscribe
• Customer service messages and live chat: 2 years after the issue is closed
• Waitlist: until 12 months after we tell you the kit is available, or sooner if you ask us to remove you
• Security data (hashed IP): normally deleted within 24 hours

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its use, to data portability, and to withdraw consent at any time. To use any of these rights, email us. We will reply within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve it first.

Automated decisions

We do not make decisions about you by automated means that have legal or similarly significant effects. If we add an automated assistant to live chat, its replies will be clearly labelled and a person from our team can always take over.

Children

Our website and products are not aimed at children under 18, and we do not knowingly collect their data.

Security

We use encrypted connections (HTTPS), trusted payment providers and access controls to protect your data.