Privacy notice
What personal data we collect, why we hold it, how long for, and what you can make us do about it.
01Who controls your data
The data controller is COGENT, the operator of cogentnootropics.co.uk. Our registered details are on the contact page. For anything about your personal data, email hello@cogentnootropics.co.uk.
This notice explains how we handle personal data under the UK GDPR and the Data Protection Act 2018.
02What we collect
When you order
- Name, delivery address, billing address, email address, phone number
- Order contents, order value and order history
- Payment confirmation from our payment processor. We never see or store your full card number
When you sign up for batch notifications
- Your email address, and the date you signed up
When you contact us
- Your name, email address and whatever you put in the message
Automatically
- Limited technical data about your visit. See the cookie notice.
We do not ask for, and do not want, information about your health. Please don't send us medical details, because we're not able to advise on them and we'd rather not hold them.
03Why we hold it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Taking, fulfilling and delivering your order | Performance of a contract |
| Handling returns, refunds and complaints | Performance of a contract |
| Keeping accounting and tax records | Legal obligation |
| Batch traceability and product safety records | Legal obligation |
| Sending batch notification emails | Consent |
| Keeping the site secure and preventing fraud | Legitimate interests |
Where we rely on consent, you can withdraw it at any time and we'll stop. Withdrawing consent doesn't affect anything we did before you withdrew it.
04Who else sees it
We share personal data only with the suppliers who need it to do their job for us:
- Payment processing, to take payment and handle refunds
- Delivery, name, address and phone number so the courier can deliver
- Email, to send order confirmations and, if you've opted in, batch notices
- Hosting, the infrastructure this site runs on
- Accounting, for statutory records
Those suppliers are currently Stripe (payments), Royal Mail and our label provider (delivery), Resend (email), Vercel and Neon (hosting and database, UK and EU regions), and Google (analytics, under the choice you make on the cookie bar). Where a supplier processes data outside the UK, it does so under the UK International Data Transfer Agreement or an adequacy decision.
We do not sell personal data. We do not share it for anyone else's marketing.
05How long we keep it
- Order and transaction records: six years from the end of the relevant financial year, as HMRC requires
- Batch and traceability records: as required for product safety
- Batch notification sign-ups: until you unsubscribe, or after two years of no engagement
- Contact messages: two years from the last message in the thread
06Your rights
Under UK data protection law you can ask us to:
- Give you a copy of the personal data we hold about you
- Correct anything inaccurate
- Erase data we no longer have a reason to keep
- Restrict how we use it while a dispute is resolved
- Transfer it to you or another provider in a portable format
- Stop processing carried out on the basis of legitimate interests
- Stop sending marketing, at any time and without giving a reason
Make a request through the contact page. We respond within one month. There's no charge unless a request is manifestly unfounded or excessive.
07If you're not happy
Tell us first and we'll try to put it right. If you're still not satisfied you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
Complaining to us first isn't a requirement. You can go straight to the ICO if you prefer.