Privacy & Cookie Policy

Cyperlux recognises the vital importance of safeguarding the privacy and confidentiality of our customers' and visitors' personal information. We structure our data handling practices in strict compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

By accessing our website, subscribing, or purchasing Cyperlux kits, you acknowledge and agree that your personal information is collected and processed in accordance with this Privacy Policy.

We collect only the information strictly necessary to process and deliver your orders, maintain transaction security, and provide exceptional customer support:

• Identification and Contact Details: Full name, email address, telephone/mobile number for delivery status updates and dispatch tracking notifications.
• Delivery Address Details: Full UK delivery address (house/flat number, building name, street, locality, city/town, and valid UK postcode).
• Payment and Financial Data: Credit card, debit card, and transaction data are processed directly through secure, accredited payment gateways compliant with Level 1 PCI-DSS standards. Cyperlux does not store sensitive card numbers or security codes on its servers.
• Device and Browsing Data: IP address, timestamp of access, device type, browser version, operating system, and approximate geographical location for security purposes, anti-fraud screening, and platform performance optimisation.

The processing of your data relies upon lawful bases established under Article 6 of the UK GDPR:

Cookies are small text files placed on your device to remember preferences, analyse traffic patterns, and personalise your browsing experience:

• Strictly Necessary Cookies: Essential for page navigation, session management, shopping basket functionality, and site security. These cannot be switched off without impairing essential website operations.
• Analytical and Performance Cookies: Utilised by privacy-respecting analytics tools (such as Google Analytics) to understand in aggregate how visitors engage with the store, assisting us in improving page speed and layout.
• Marketing & Targeting Cookies: Measurement pixels (such as Meta Pixel and Google Ads) that help display relevant advertisements to individuals interested in botanical skincare and hair inhibition treatments.

You can manage or block cookies at any time via your browser settings (Chrome, Safari, Firefox, Edge, etc.). Please note that disabling certain essential cookies may affect your browsing experience and shopping basket behaviour.

Cyperlux never sells, rents, or trades personal data or customer lists to third-party marketing companies. Data is shared solely with trusted service providers essential to fulfilling your order:

• Courier and Postal Partners: We share your recipient name, delivery address, phone number, and email with Royal Mail or appointed couriers so they can deliver your parcel and provide delivery notifications.
• Payment Gateways & Fraud Prevention: Financial transaction data transmitted securely via encrypted protocols to authenticate and clear payments.
• Invoicing and Fulfilment Systems: To process order packaging and generate compliant purchase records and VAT receipts.
• Statutory Authorities: If legally compelled by a court order, regulatory mandate, or applicable UK law.

We implement robust technical and organisational security measures to safeguard your data against accidental loss, unauthorised access, misuse, or alteration:

• SSL/TLS Encryption: All communications between your browser and our servers are encrypted using high-grade 256-bit SSL/TLS protocol (HTTPS).
• PCI-DSS Compliance: Card processing is managed by certified PCI-DSS compliant payment facilitators.
• Restricted Access Control: Only authorised personnel bound by strict non-disclosure obligations have access to operational data relevant to their specific roles.

Personal data will only be retained for as long as necessary to fulfill the purposes for which it was collected, including meeting statutory, tax, legal, and accounting requirements (for instance, UK HMRC records retention guidelines).

Once the retention period expires or when personal data is no longer needed, it is securely destroyed or permanently anonymised.

Under the UK General Data Protection Regulation and Data Protection Act 2018, you possess comprehensive statutory rights regarding your personal information, which you may exercise free of charge:

• Right of Access: Request confirmation of processing and obtain a copy of your personal data.
• Right to Rectification: Request correction of inaccurate, incomplete, or outdated information.
• Right to Erasure ('Right to be Forgotten'): Request deletion of your data when it is no longer required for its original purpose.
• Right to Restriction of Processing: Request temporary suspension of data processing in certain circumstances.
• Right to Data Portability: Receive your data in a structured, commonly used, and machine-readable format.
• Right to Object: Object at any time to processing based on legitimate interests or direct marketing communications.
• Right to Withdraw Consent: Withdraw your consent at any time where processing was based on consent.
• Right to Lodge a Complaint: Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled improperly.

To exercise any of your statutory data rights or ask questions regarding this Privacy Policy, please contact our Data Protection Officer directly:

This Privacy Policy may be updated periodically to reflect changes in our operational procedures, technological improvements, or legal obligations under UK data protection legislation. Whenever material amendments occur, the revision date at the top of this document will be updated accordingly. We encourage you to review this page periodically.