Privacy Policy

1. Scope of this policy

This Privacy Policy explains how Torneva Wellness Ltd ("Torneva", "we", "us" or "our") collects, uses, stores and shares personal data when you visit torneva.info, place an order for Milk Thistle Complex, contact our customer support team, or otherwise interact with us in connection with our pay-on-delivery service. It applies to all visitors, prospective customers and existing customers located in the United Kingdom, and to any personal data we receive by telephone, email or through our website's order form. It does not apply to third-party websites that may be linked from our site, since we have no control over how those operators handle personal data. Where local law provides greater protection than this policy describes, the stricter provision will apply. We encourage you to read this document in full before submitting any personal information to us, and to revisit it periodically, since we may update it as our processing activities evolve.

2. Who we are

The data controller responsible for your personal data is Torneva Wellness Ltd, a company registered in England and Wales under company number 12471839, with its registered office at 88 Bristol Road, Birmingham, B5 7AX. Our VAT registration number is GB 487 3328 44. We can be contacted by telephone on +44 121 389 4304 during our published opening hours of Monday to Friday, 9:00 to 17:30, or by email at [email protected] at any time. We have not appointed a statutory Data Protection Officer, as this is not a legal requirement for a business of our size and processing profile, but a named member of our team is responsible for data protection matters and can be reached using the contact details above. If you are unsure whether a query relates to data protection, please address it to [email protected] and we will route it appropriately.

3. Personal data we collect

When you place an order, we typically collect your full name, telephone number, delivery address, and any notes you provide about delivery instructions or preferences. If you contact us by email, telephone or through a web form, we collect the content of your message together with your contact details and the date and time of contact. Our website automatically records limited technical data about your visit, including your IP address, browser type and version, device type, referring page and the pages you view, gathered through standard server logs and, where you consent, analytics cookies. We do not knowingly collect special category data such as health records, and any reference to dietary preference or wellbeing routine that you volunteer in correspondence is treated as ordinary personal data connected to customer service, not as health data requiring special handling. We do not collect payment card numbers directly, since payment on delivery is collected by the courier at the point of handover.

4. How we collect your data

Most personal data is collected directly from you when you complete the order form on our website, telephone our customer service line, or send us an email. Some technical data is collected automatically through cookies and similar technologies when you browse torneva.info, as described in section 9 below and in our separate Cookie Policy. Occasionally, we may receive limited information from our delivery partners, such as confirmation that a parcel was delivered, refused or returned, which we combine with your order record to manage customer service enquiries. We do not purchase personal data from third-party data brokers, and we do not build customer profiles by combining our data with data purchased from external marketing lists.

5. Legal bases for processing

We rely on contractual necessity, under UK GDPR Article 6(1)(b), to process the personal data needed to accept, confirm, dispatch and support your order, since this data is required to perform the pay-on-delivery contract you enter into with us. We rely on legitimate interests, under Article 6(1)(f), for limited activities such as preventing fraudulent orders, maintaining website security and improving our service through aggregated analysis of enquiries, always balanced against your right to privacy. We rely on consent, under Article 6(1)(a), for optional analytics cookies, and you may withdraw that consent at any time through the Cookie Settings link in our website footer. Where we are legally required to retain financial or tax records, we rely on compliance with a legal obligation under Article 6(1)(c). We do not rely on consent for core order-processing activity, since withdrawing consent for a contract already in progress would not be workable; in that situation you should contact us directly to discuss your order.

6. Purposes of processing

We use your personal data to process and confirm your order, arrange telephone confirmation before dispatch, coordinate delivery with our couriers, and handle any returns or complaints in accordance with our Returns Policy. We use contact details to respond to customer service enquiries and to send order-related communications such as dispatch confirmations. Where you have given consent, we use aggregated, largely anonymised analytics data to understand how visitors use our website, so that we can improve page layout, delivery information and customer experience. We may also process data to comply with accounting, tax and consumer protection obligations under UK law, including retaining records that HM Revenue & Customs may require us to produce. We do not use your data for automated decision-making or profiling that produces legal effects concerning you.

7. Data retention periods

Order and invoice records, including your name, address, telephone number and order value, are retained for six years from the end of the financial year in which the order was placed, in line with our statutory bookkeeping obligations under the Companies Act 2006 and HMRC record-keeping requirements. Customer service correspondence that does not relate to a completed order, such as a general enquiry that did not lead to a purchase, is retained for 24 months from the date of last contact, after which it is deleted or anonymised. Website server logs containing IP addresses are retained for a maximum of 12 months for security and troubleshooting purposes. Cookie consent records are retained for up to 12 months, reflecting the lifespan of the consent cookie itself, after which you will be asked to confirm your preferences again. Where a legal claim, complaint or regulatory enquiry is ongoing, we may retain relevant records for as long as reasonably necessary to resolve that matter, even if it exceeds the periods above.

8. Third-party processors and recipients

We share your name, delivery address and telephone number with the courier network engaged to deliver your order and collect payment on our behalf, since this is necessary to complete delivery and cash or card collection. We use a UK-based website hosting and content delivery provider to operate torneva.info, which processes technical data such as IP addresses as part of delivering our website to your device. Where you consent to analytics cookies, a website analytics provider processes pseudonymised usage data to help us produce visitor statistics; that provider does not use the data to identify you personally for its own purposes. We use an email service provider to send transactional messages, such as order confirmations, and a telephony provider to support our customer service phone line. Each processor is contractually required to protect your data, to use it only for the purposes we specify, and to delete it once it is no longer required. We do not sell personal data to third parties, and we do not share it with other businesses for their own independent marketing purposes.

9. Cookies and similar technologies

Our website uses a small number of cookies, described fully in our separate Cookie Policy, which forms part of this Privacy Policy by reference. Strictly necessary cookies, such as a session cookie used to keep the order form working correctly during your visit, do not require consent and are deleted automatically when you close your browser. A preference cookie named torneva_consent records your cookie choices for up to 12 months, and a second preference cookie named torneva_preferences remembers display settings such as whether you have already seen the consent banner, also for up to 12 months. Where you opt in, an analytics cookie named torneva_analytics is set for a maximum of 13 months to help us understand aggregated visitor behaviour; this cookie does not collect your name, address or order details. You can withdraw or change your cookie consent at any time using the Cookie Settings control available in the website footer, and doing so will not affect the placement of an order already in progress.

10. International data transfers

Our hosting infrastructure and the majority of our service providers are based in the United Kingdom or the European Economic Area, meaning most personal data does not leave the UK or EEA in the ordinary course of business. Where a service provider is located outside the UK, for example if an analytics or email delivery provider operates servers in the United States, we ensure an appropriate safeguard is in place before any transfer occurs, such as reliance on the UK extension to the EU-US Data Privacy Framework or the use of the UK's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. We only transfer the minimum personal data necessary for the provider to perform its function, and we require contractual assurances that data will be protected to a standard equivalent to UK GDPR. We do not transfer personal data to countries where no adequate legal safeguard has been assessed, and we review our list of processors periodically to confirm that transfer safeguards remain valid.

11. Data security measures

We apply administrative, technical and physical safeguards appropriate to the nature of the personal data we hold, including access controls that limit staff access to customer records to those who need it to fulfil their role, encrypted connections between your browser and our website, and regular review of the third-party providers we rely on. Our order-processing systems are protected by passwords and access logging, and we require our processors to maintain comparable security standards under written contract. While we take reasonable steps to protect personal data, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot fully assure absolute security. If we become aware of a personal data breach that poses a risk to your rights and freedoms, we will assess the incident and, where required by law, notify the Information Commissioner's Office within 72 hours and inform affected individuals without undue delay.

12. Your rights under UK GDPR

You have the right to request access to the personal data we hold about you, to ask us to correct inaccurate or incomplete data, and to ask us to erase your data where there is no continuing lawful reason for us to keep it. You have the right to ask us to restrict processing while a dispute about accuracy or lawfulness is resolved, and the right to receive certain data you provided to us in a structured, commonly used, machine-readable format so that you can transfer it elsewhere. You have the right to object to processing based on legitimate interests, and an absolute right to object to direct marketing at any time. Where processing is based on consent, such as analytics cookies, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. None of these rights are absolute, and we will explain to you if a particular right does not apply in your circumstances, for example where we must retain financial records for statutory retention periods.

13. How to exercise your rights

To exercise any of the rights described above, please email [email protected] or write to Torneva Wellness Ltd, 88 Bristol Road, Birmingham, B5 7AX, clearly describing the right you wish to exercise and providing enough information for us to verify your identity. We aim to acknowledge every rights request within 5 working days and to provide a full response within one calendar month, as required by UK GDPR, extending this by a further two months for complex or numerous requests, in which case we will explain the reason for the delay. There is no fee for making a rights request in most circumstances, although we may charge a reasonable administrative fee or decline to act if a request is manifestly unfounded or excessive. We may need to ask you for specific information to confirm your identity before we can act on a request, to ensure that personal data is not disclosed to anyone who does not have the right to receive it.

14. Children's data

Our website and products are intended for adults, and we do not knowingly collect personal data from children under the age of 16 without appropriate parental consent. If you believe a child has provided personal data to us without appropriate consent, please contact us at [email protected] so that we can locate and delete that information promptly. Milk Thistle Complex is formulated and marketed as a food supplement for adult use, and our order form is not designed to be completed by minors. We do not knowingly direct marketing communications toward children.

15. Complaints procedure

If you are unhappy with how we have handled your personal data, please contact us first at [email protected] or by telephone on +44 121 389 4304 during our opening hours of Monday to Friday, 9:00 to 17:30, so that we have the opportunity to resolve your concern directly. We aim to acknowledge a complaint within 5 working days and to provide a substantive response within 30 calendar days, and we will keep you updated if further investigation is needed. If you remain dissatisfied with our response, or if you would prefer to raise the matter independently, you have the right to lodge a complaint with the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, or online at ico.org.uk. Making a complaint to the ICO does not affect your right to seek a remedy through the courts, and you do not need to complain to us before contacting the ICO, although we would welcome the opportunity to help first.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, our service providers or the law. Material changes will be reflected by an updated "last updated" date at the top of this page, and where a change is significant we will consider additional notice, such as a notice on our homepage. We maintain an internal record of revisions: this policy was first published on 3 March 2025; it was updated on 14 September 2025 to add detail about our courier processor and delivery-related data sharing; and it was most recently updated on 11 August 2026 to refine retention periods and to name our analytics cookie explicitly. We encourage you to check this page periodically for the latest version.

17. Contact us

If you have any questions about this Privacy Policy or how we handle personal data, please contact Torneva Wellness Ltd, 88 Bristol Road, Birmingham, B5 7AX, by telephone on +44 121 389 4304, or by email at [email protected], during our opening hours of Monday to Friday, 9:00 to 17:30. We are happy to explain any part of this policy in plainer terms if any wording is unclear, and we treat every enquiry about personal data seriously and confidentially.