Privacy policy

PRIVACY POLICY

Holt Hydration™

Last updated: 28 August 2026

1. WHO WE ARE

Holt Hydration Ltd is the data controller for the personal information described in this policy. We are a company registered in England and Wales under company number 17373868, with our registered office at 124 City Road, London, EC1V 2NX.

In this policy, "we", "us" and "our" mean Holt Hydration Ltd. "You" means the person whose personal information we hold — usually a customer, a subscriber to our emails, or a visitor to our website.

Contact: privacy@holthydration.com Post: Data Protection, Holt Hydration Ltd, 124 City Road, London, EC1V 2NX ICO registration reference: ZC223624

We are not required to appoint a Data Protection Officer. Privacy questions are handled by our director.

2. WHAT THIS POLICY COVERS

This policy explains how we collect, use, share and protect personal information when you visit our website, buy from us, subscribe, sign up for marketing, enter a promotion, or contact us (together, the "Services"). Our store is hosted on Shopify.

It does not cover third-party websites we link to. If you follow a link away from our site, read that site's own privacy policy.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and we handle marketing messages and cookies in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR).

3. THE PERSONAL INFORMATION WE COLLECT

Category	What it includes
Identity and contact	Name, email address, delivery address, billing address, phone number
Order and transaction	What you bought, order value, order history, subscription frequency and status, returns, refunds, exchanges, cancellations
Payment	Payment method type, the last four digits and expiry of your card, billing address, payment confirmations and transaction references. We never see or store your full card number — payments are processed by Shopify Payments and other providers listed in section 7
Account	Username, password (stored encrypted), saved addresses, preferences and settings
Communications	Emails, contact-form messages, live chat, social media messages, and your marketing preferences
Reviews and content	Product reviews, ratings, photographs and any other content you submit
Technical	IP address, device type, browser, operating system, language, time zone, and unique identifiers set by cookies
Usage	Pages viewed, products viewed, items added to basket or abandoned, links clicked, referring site and search terms, time spent on pages
Promotions	Entries to competitions, giveaways and referral schemes, including the details of anyone you refer
Inferences	Product recommendations, audience segments and similar conclusions we draw from the above

Health information. Our products are food supplements, not medicines, and we do not ask you for health information and do not want it. If you volunteer health details — for example in a support email about an allergy or a medical condition — we will use them only to answer you, will keep them no longer than necessary, and will not use them for marketing or profiling. Please do not send us health information you would rather we did not hold.

4. WHERE WE GET IT

Directly from you — when you order, create an account, subscribe, sign up to emails or SMS, leave a review, enter a promotion, or contact us.
Automatically — from your device and browser through cookies and similar technologies when you use the site (see section 6).
From our service providers — Shopify, our payment providers, our subscription app, our email and analytics providers, and our carriers.
From advertising and social platforms — aggregated campaign data, and matched audience data where you have consented on that platform.
From other people — if someone refers you to us, or buys a gift for you, we receive the details they give us.

5. HOW AND WHY WE USE IT — AND OUR LAWFUL BASIS

Under UK GDPR we must have a lawful basis for every use of your personal information. Ours are set out below.

What we do	Information used	Lawful basis
Take and fulfil your order, arrange delivery, handle returns and refunds	Identity, contact, order, payment	Contract — necessary to perform our contract with you
Manage your account and subscription, take recurring payments, send renewal reminders	Identity, contact, account, order, payment	Contract
Answer your questions and provide customer support	Contact, communications, order	Contract, and legitimate interests (running a responsive business)
Send marketing emails and texts about our products	Identity, contact, order, usage, inferences	Consent, or legitimate interests where you are an existing customer and we are telling you about similar products under the PECR soft opt-in. You can opt out at any time
Show you personalised advertising on other platforms	Technical, usage, inferences	Consent, given through our cookie banner
Measure how the site is used and improve it	Technical, usage	Consent for non-essential analytics cookies; legitimate interests for aggregated, non-cookie measurement
Publish your reviews and use your content in marketing	Reviews and content, identity (first name and initial)	Consent, and our contract terms for content you submit
Run competitions, giveaways and referral schemes	Identity, contact, promotions	Contract (the promotion terms) and consent
Detect and prevent fraud, chargebacks, abuse of our guarantee, and keep the site secure	Identity, order, payment, technical, usage	Legitimate interests (protecting our business and our customers), and legal obligation
Keep accounting and tax records	Identity, order, payment	Legal obligation (Companies Act 2006, HMRC requirements)
Comply with product safety, food law and regulatory obligations, and handle any recall	Identity, contact, order	Legal obligation, and vital interests in a safety recall
Establish, exercise or defend legal claims	Any of the above	Legitimate interests, and legal obligation
Handle a sale, merger or restructuring of our business	Any of the above	Legitimate interests

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and concluded it is not. You can ask us for details of that assessment, and you can object — see section 11.

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not make our earlier use of your information unlawful.

6. COOKIES AND SIMILAR TECHNOLOGIES

6.1 We use cookies, pixels, tags and similar technologies to run the site, remember your basket, understand how the site is used, and — where you agree — to show you relevant advertising.

6.2 Strictly necessary cookies are needed to make the site work (for example to keep items in your basket and to process checkout securely). These do not require your consent.

6.3 Analytics, functional and advertising cookies are only set if you agree through our cookie banner. You can change or withdraw your choices at any time via the cookie settings link in our footer.

6.4 You can also block or delete cookies through your browser settings, though parts of the site may not work properly if you do.

6.5 We honour the Global Privacy Control signal where your browser sends one, and treat it as an objection to advertising cookies for that browser and device. We do not respond to other "Do Not Track" signals, as there is no agreed standard for them.

6.6 You can see which categories of cookies we use, and change or withdraw your choices at any time, through the cookie settings link in our footer.

7. WHO WE SHARE IT WITH

We do not sell your personal information. We share it only as set out below.

Service providers acting on our instructions. These organisations process your information for us under a written contract and cannot use it for their own purposes:

Purpose	Provider	Where
E-commerce platform and hosting	Shopify International Ltd	Ireland / global
Payments	Shopify Payments	Ireland / global
Subscriptions	Appstle Inc.	United States
Email and SMS marketing	Klaviyo Inc.	United States
Product reviews	Judge.me	Global
Fulfilment and warehousing	Hutch Logistics Ltd, Chelmsford	United Kingdom
Delivery	Our carriers, as shown at checkout	United Kingdom
Advertising	Meta Platforms Ireland Ltd	Ireland / United States

Keep this table current. Any app that touches customer data belongs here — adding one and not listing it is the most common way a privacy policy stops being accurate.

Others we may share with:

Professional advisers — accountants, lawyers, insurers, where they need it to advise us.
Regulators and authorities — the ICO, Trading Standards, HMRC, the police or a court, where we are legally required to disclose, or where we need to establish or defend a legal claim.
A buyer of our business — if we sell, merge or reorganise, your information may transfer as part of that transaction. We will tell you if this happens and the buyer will remain bound by this policy.
Promotion partners — if you enter a competition or giveaway we run with a partner, we share what is needed to administer and fulfil it. This is described in the terms of each promotion.

We never share your phone number with third parties for their own marketing.

8. SHOPIFY

Our store is hosted by Shopify, which processes personal information about your use of the Services in order to provide and improve them. Some information is transferred to Shopify and its own providers, which may be outside the UK.

We also use certain Shopify enhanced features that draw on data from your interactions with our store, with other Shopify merchants, and with Shopify itself, to support analytics, product recommendations and advertising. For those features Shopify is responsible as a controller for its own processing, including for responding to requests you make about it. In some circumstances this may count as "sharing" for targeted advertising, and you have the right to opt out.

To read how Shopify uses your information, see the Shopify Consumer Privacy Policy. To exercise rights against Shopify directly, use the Shopify Privacy Portal.

9. SENDING INFORMATION OUTSIDE THE UK

9.1 Some of our providers are based outside the United Kingdom, including in the European Economic Area and the United States.

9.2 Where we transfer personal information out of the UK, we make sure it is protected by one of the following:

the country has UK adequacy regulations (this includes the EEA);
the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses; or
the provider is certified under the UK Extension to the EU–US Data Privacy Framework.

9.3 You can ask us for a copy of the safeguards we use by emailing privacy@holthydration.com.

10. HOW LONG WE KEEP IT

We keep personal information only as long as we need it. Our standard periods:

Information	Retention
Order and transaction records	6 years after the end of the tax year in which the order was placed — required for HMRC and Companies Act purposes
Account details	While your account is active, then 2 years after your last activity
Subscription records	For the life of the subscription, then as per order records above
Marketing consent and opt-out records	Until you withdraw consent, plus 2 years. We keep a permanent suppression record of unsubscribes so that we do not contact you again
Customer support correspondence	2 years from the last message
Reviews and user content	Until you ask us to remove them, or until we stop publishing them
Promotion entries	12 months after the promotion closes; winners' details for 6 years where required
Website analytics data	Up to 26 months
Fraud and abuse records	6 years

Where we no longer need information, we delete it or irreversibly anonymise it. Anonymised data may be kept indefinitely for statistical purposes.

11. YOUR RIGHTS

Under UK GDPR you have the following rights. They are not absolute and exemptions may apply.

Be informed — about how we use your information. That is what this policy is for.
Access — get a copy of the personal information we hold about you.
Rectification — have inaccurate information corrected or incomplete information completed.
Erasure — ask us to delete your information, where we no longer need it. Note that we cannot delete order records we are legally required to keep.
Restriction — ask us to pause our use of your information while a dispute about it is resolved.
Portability — receive the information you gave us in a machine-readable format, or have it sent to another organisation.
Object — object to processing based on legitimate interests. You have an absolute right to object to direct marketing at any time, and we will stop immediately.
Withdraw consent — where we rely on consent, at any time.
Automated decisions — not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect. We do not make such decisions. We do use profiling for marketing and product recommendations, and you can object to that.

How to exercise them. Email privacy@holthydration.com or write to us at the address in section 1. You can unsubscribe from marketing directly using the link in any email or by replying STOP to a text.

What happens next. We will respond within one month. If your request is complex or you have made several, we may extend by a further two months and will tell you why within the first month. We do not charge a fee unless a request is manifestly unfounded or excessive. We may need to verify your identity first. You may use an authorised agent, but we will need written proof of their authority.

We will not treat you differently for exercising any of these rights.

12. MARKETING

12.1 We send marketing emails and texts where you have consented, or where you have bought from us and we are telling you about similar products under the PECR soft opt-in.

12.2 Every marketing message carries a way to opt out — an unsubscribe link in emails, or reply STOP to a text. Consent to marketing is never a condition of buying from us.

12.3 Message frequency varies. Standard network message and data rates may apply to texts.

12.4 Opting out of marketing does not stop service messages — order confirmations, delivery updates, subscription renewal reminders, product safety notices and changes to our terms. We must send these to perform our contract with you.

13. SECURITY

13.1 We use appropriate technical and organisational measures to protect your information, including encryption in transit (HTTPS), restricted staff access, and PCI-DSS-compliant payment processing through Shopify. We do not hold full card numbers.

13.2 No system is perfectly secure and no transmission over the internet is guaranteed safe. Please do not send us sensitive or confidential information over unsecured channels.

13.3 If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours and, where the risk is high, tell you directly without undue delay.

13.4 You are responsible for keeping your account password confidential.

14. CHILDREN

Our products and Services are intended for adults and are not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us their information, contact us at privacy@holthydration.com and we will delete it.

15. THIRD-PARTY LINKS

Our site may link to other websites, and content you post on public or social platforms may be visible to others. We are not responsible for the privacy practices or content of third-party sites, and a link is not an endorsement. Providing your information to a third-party site is at your own risk.

16. CHANGES TO THIS POLICY

We may update this policy to reflect changes in our practices, our providers, or the law. We will post the updated version here and change the "Last updated" date. Where a change is material, we will tell you by email or a notice on the site before it takes effect.

17. HOW TO COMPLAIN

17.1 If you are unhappy with how we have handled your personal information, please tell us first at privacy@holthydration.com — we would like the chance to put it right. We will acknowledge within 5 working days.

17.2 You also have the right to complain to the UK's data protection regulator at any time: