Privacy policy

Last updated: 17 July 2026

Creatonics Ltd respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and share your personal data when you:

visit or interact with creatonics.com;
create or use an account;
place an order;
purchase or manage a subscription;
subscribe to marketing communications;
contact our customer-service team;
submit a review, testimonial or other content;
participate in a promotion, survey or competition; or
otherwise interact with Creatonics.

It also explains your rights under applicable data-protection law.

Where this Privacy Policy conflicts with our Terms and Conditions in relation to the collection or use of personal data, this Privacy Policy will apply.

1. ABOUT US

1.1 Creatonics Ltd is the controller responsible for the personal data described in this Privacy Policy.

1.2 References in this Privacy Policy to “Creatonics”, “we”, “us” or “our” mean Creatonics Ltd.

1.3 Creatonics Ltd is registered in England and Wales under company number 16756725.

1.4 Our registered office is:

Creatonics Ltd
Bristol Office Hub
195–197 Whiteladies Road
Bristol
England
BS8 2SB

1.5 You can contact us about this Privacy Policy or the way we use your personal data by emailing hello@creatonics.com.

1.6 Our ecommerce store is hosted using Shopify. Further information about Shopify is provided in section 10.

2. SCOPE OF THIS PRIVACY POLICY

2.1 This Privacy Policy applies to personal data processed by Creatonics in connection with:

a. creatonics.com and its associated pages;

b. our online store;

c. customer accounts;

d. orders and subscriptions;

e. customer support and complaints;

f. marketing and advertising;

g. reviews, testimonials and user-submitted content; and

h. our other interactions with customers and Website users.

2.2 Our Products are currently delivered only to addresses within the United Kingdom. However, this Privacy Policy also applies if you access the Website from elsewhere.

2.3 The Website may contain links to websites or services operated by other organisations. Their processing of personal data is governed by their own privacy policies rather than this Privacy Policy.

3. WHAT IS PERSONAL DATA?

3.1 “Personal data” means information relating to an identified or identifiable individual.

3.2 Personal data does not include information that has been irreversibly anonymised so that no individual can reasonably be identified from it.

3.3 We may combine information collected from different sources. The combined information will be treated as personal data where it can identify or reasonably be linked to an individual.

4. PERSONAL DATA WE COLLECT

The personal data we collect depends on how you interact with us.

4.1 Identity and contact data

This may include:

a. your name;

b. title;

c. date of birth or confirmation that you are at least 18, where relevant;

d. billing address;

e. delivery address;

f. email address; and

g. telephone number.

4.2 Account data

This may include:

a. your username or account identifier;

b. password or other authentication information;

c. saved addresses;

d. preferences and settings;

e. subscription-management information; and

f. account history.

Passwords may be stored in an encrypted or otherwise protected form by Shopify or another service provider. We do not normally have access to your unencrypted password.

4.3 Order and transaction data

This may include:

a. Products viewed, selected or added to your basket;

b. Products ordered;

c. order number;

d. order value;

e. subscription selection and renewal frequency;

f. discount codes, promotions or gifts applied;

g. payment status;

h. delivery method;

i. delivery tracking information;

j. returns, refunds, replacements and cancellations;

k. previous orders and subscriptions; and

l. communications concerning a transaction.

4.4 Payment data

Payment information may include:

a. payment method;

b. payment-card type;

c. the final digits of a payment card;

d. billing information;

e. payment authorisation and status;

f. transaction reference numbers; and

g. fraud-screening information.

Full card details are generally submitted directly to Shopify, Shopify Payments or another authorised payment provider. Creatonics does not normally receive or store your complete payment-card number or security code.

4.5 Communications and customer-service data

This includes information you provide when you:

a. contact us by email or through the Website;

b. make an enquiry;

c. request assistance;

d. make a complaint;

e. request a return, refund or replacement;

f. exercise a data-protection right; or

g. communicate with us through social media.

This may include the content of your communication, attachments, photographs, order details and our response.

4.6 Product-safety and adverse-reaction information

If you contact us about a potential adverse reaction, allergy, Product-safety concern or other health-related matter, you may choose to provide information about:

a. your health;

b. symptoms or reactions;

c. medication;

d. allergies or intolerances;

e. Product use;

f. Product batch information; and

g. relevant healthcare treatment.

Health information is special-category personal data and receives additional legal protection. Section 8 explains how we handle this information.

4.7 Reviews and user-submitted content

This may include:

a. written reviews;

b. ratings;

c. testimonials;

d. photographs;

e. videos;

f. social-media content;

g. survey responses; and

h. other feedback or submissions.

Where you publish content publicly, your name, username, image or other information associated with the content may also be visible to other people.

4.8 Marketing and preference data

This may include:

a. whether you have subscribed to marketing;

b. the date and method by which you subscribed;

c. your communication preferences;

d. your areas of interest;

e. whether you opened or interacted with a marketing communication;

f. your unsubscribe or objection history; and

g. your cookie and advertising preferences.

4.9 Device and technical data

When you use the Website, we or our service providers may collect:

a. internet protocol address;

b. browser type and version;

c. device type;

d. operating system;

e. device identifiers;

f. screen size and display settings;

g. language and time-zone settings;

h. network and connection information;

i. cookie identifiers; and

j. security and authentication information.

4.10 Website usage data

This may include information about:

a. pages and Products viewed;

b. links selected;

c. searches performed;

d. referral source;

e. time spent on pages;

f. navigation through the Website;

g. items placed in or removed from a basket;

h. checkout activity;

i. Website errors; and

j. interaction with advertisements or marketing content.

Non-essential usage and advertising data will be collected only where permitted by law and, where required, after you have made the relevant choice through our cookie controls.

4.11 Fraud, security and compliance data

This may include:

a. account-login activity;

b. suspected fraudulent transactions;

c. IP address;

d. device and network indicators;

e. payment risk indicators;

f. records of breaches of our Terms;

g. chargeback information; and

h. information required to investigate illegal, unsafe or malicious activity.

4.12 Promotion, competition and referral information

Where we offer these features, this may include:

a. competition entries;

b. referral codes;

c. information about a referring customer;

d. promotional eligibility;

e. prize or reward information; and

f. information supplied when participating.

We will provide additional terms or privacy information where necessary.

5. HOW WE COLLECT PERSONAL DATA

5.1 We collect personal data directly from you when you:

a. browse or use the Website;

b. create an Account;

c. place an Order;

d. purchase or manage a Subscription;

e. communicate with us;

f. subscribe to marketing;

g. submit a review or other content;

h. complete a form, questionnaire or survey; or

i. participate in a promotion or competition.

5.2 We may collect personal data automatically through:

a. cookies;

b. pixels;

c. tags;

d. scripts;

e. software development kits;

f. local storage;

g. server logs; and

h. other storage or access technologies.

5.3 We may receive personal data from service providers and third parties, including:

a. Shopify;

b. payment processors;

c. delivery and fulfilment providers;

d. subscription-management providers;

e. fraud-prevention services;

f. analytics providers;

g. advertising and social-media platforms, where permitted;

h. customer-support and communications providers;

i. review, referral or promotion providers, where used; and

j. people who refer you to us or purchase a Product for delivery to you.

5.4 Where another person provides us with your personal data, that person is responsible for ensuring that they are permitted to provide it.

6. HOW AND WHY WE USE PERSONAL DATA

We must have a lawful basis for each purpose for which we process personal data. The lawful bases on which we principally rely are:

contract, where processing is necessary to enter into or perform a contract with you;
legal obligation, where processing is necessary to comply with the law;
legitimate interests, where processing is necessary for our legitimate business interests or those of another organisation and those interests are not overridden by your rights;
consent, where you have given a clear choice for a specific purpose; and
in limited circumstances, other lawful bases permitted by data-protection law.

6.1 Providing and operating the Website

We use technical, device and usage data to:

a. display and operate the Website;

b. maintain Website functionality;

c. remember baskets and essential preferences;

d. authenticate users;

e. diagnose faults;

f. maintain security; and

g. provide features you request.

Our lawful bases are:

performance of a contract or steps requested before entering a contract;
our legitimate interests in operating a functional and secure ecommerce website; and
consent where required for non-essential cookies or similar technologies.

6.2 Creating and managing Accounts

We use identity, contact and Account data to:

a. create your Account;

b. allow you to sign in;

c. save preferences;

d. display order and subscription history;

e. manage security; and

f. provide Account features.

Our lawful bases are performance of a contract and our legitimate interests in administering Accounts and protecting them against unauthorised use.

6.3 Processing Orders

We use identity, contact, transaction, payment and delivery data to:

a. accept and process Orders;

b. take or arrange payment;

c. issue confirmations and receipts;

d. arrange fulfilment and delivery;

e. provide tracking information;

f. process cancellations, returns, refunds and replacements; and

g. communicate about the Order.

Our lawful bases are:

performance of a contract;
compliance with legal obligations, including consumer, accounting and tax requirements; and
our legitimate interests in administering transactions and resolving issues.

6.4 Administering Subscriptions

We use Account, payment, transaction and contact data to:

a. create and manage Subscriptions;

b. generate recurring Orders;

c. take recurring payments;

d. send renewal reminders;

e. process pauses, skips, amendments or cancellations;

f. manage failed payments; and

g. communicate material Subscription changes.

Our lawful bases are performance of a contract, compliance with legal obligations and our legitimate interests in administering the Subscription service.

6.5 Customer service, returns and complaints

We use contact, transaction and communications data to:

a. respond to questions;

b. provide customer support;

c. investigate complaints;

d. process returns, refunds and replacements;

e. resolve delivery or payment disputes;

f. maintain records of the issue and outcome; and

g. improve our customer service.

Our lawful bases are:

performance of a contract;
compliance with consumer and data-protection law;
our legitimate interests in responding to customers, resolving disputes and improving our services; and
where relevant, the establishment, exercise or defence of legal claims.

6.6 Product safety and adverse-reaction reports

We may use information supplied in connection with a Product-safety concern or adverse reaction to:

a. investigate the report;

b. identify the relevant Product or batch;

c. communicate with you;

d. assess whether corrective action is necessary;

e. maintain safety and quality records;

f. notify manufacturers, professional advisers, insurers or authorities where appropriate; and

g. establish, exercise or defend legal claims.

Our lawful bases for ordinary personal data may include legal obligation, legitimate interests and legal claims.

Where this involves health or other special-category data, the additional conditions described in section 8 apply.

6.7 Preventing fraud and protecting security

We use transaction, Account, device and technical data to:

a. verify payments and Accounts;

b. detect or prevent fraud;

c. investigate suspicious activity;

d. prevent misuse of promotions;

e. protect customers and staff;

f. secure the Website and our systems; and

g. enforce our Terms and Conditions.

Our lawful bases are our legitimate interests in preventing fraud and maintaining security, compliance with legal obligations and, where relevant, the recognised legitimate interests permitted by law for preventing, detecting or investigating crime.

6.8 Business administration and record keeping

We use relevant data to:

a. maintain financial and accounting records;

b. administer our business;

c. manage suppliers and service providers;

d. conduct audits;

e. obtain legal, financial or insurance advice;

f. manage disputes and legal claims; and

g. demonstrate compliance.

Our lawful bases are legal obligation and our legitimate interests in operating and protecting our business.

6.9 Analytics and service improvement

Where permitted, we use Website, transaction, device and communications data to:

a. understand how the Website is used;

b. measure Website performance;

c. identify errors or usability problems;

d. understand customer preferences;

e. assess Product and campaign performance;

f. improve Products, content and customer experience; and

g. produce aggregated statistics.

Our lawful bases are:

consent where required for analytics cookies or similar technologies; and
our legitimate interests in analysing and improving our business where consent is not legally required.

Where possible, we use aggregated or anonymised information for these purposes.

6.10 Direct marketing

We may use your contact details and marketing preferences to send information about:

a. Creatonics Products;

b. new Product launches;

c. promotions and discounts;

d. educational content;

e. relevant events; and

f. other Creatonics news.

For email or text marketing to individuals, we rely on:

your consent; or
the existing-customer “soft opt-in” where legally available, provided that we collected your details during a sale or genuine sales negotiation, market only our own similar Products and gave you a clear opportunity to opt out when collecting your details and in every subsequent message.

Our UK GDPR lawful basis may be consent or our legitimate interests in promoting our Products, depending on the circumstances.

You may object to direct marketing at any time.

6.11 Online advertising and personalisation

If you consent to relevant cookies or tracking technologies, we and our advertising partners may use device, usage, transaction and marketing data to:

a. measure advertising performance;

b. understand whether an advertisement led to a Website visit or purchase;

c. create or use advertising audiences;

d. show advertisements that may be more relevant to you;

e. limit repeated advertisements; and

f. personalise parts of the Website.

The providers and technologies currently used will be identified in our Cookie Policy and cookie-management interface.

Our lawful basis is consent where required. You may withdraw your consent through the Website’s cookie settings.

6.12 Reviews, testimonials and user-submitted content

We use content you submit to:

a. publish or moderate reviews;

b. respond to feedback;

c. improve Products and services;

d. investigate authenticity or misuse; and

e. promote Creatonics, where permitted by our Terms and applicable law.

Our lawful bases are performance of a contract where applicable, our legitimate interests in obtaining and displaying genuine feedback and your consent where required for particular promotional use.

6.13 Promotions, competitions and surveys

Where you choose to participate, we may process your information to:

a. administer the activity;

b. confirm eligibility;

c. select or contact winners;

d. provide rewards;

e. analyse responses; and

f. comply with the relevant terms.

Our lawful basis will normally be performance of the applicable terms, consent or our legitimate interests in administering and assessing the activity.

6.14 Legal and regulatory purposes

We may process or disclose personal data to:

a. comply with applicable laws;

b. respond to courts, regulators, law-enforcement bodies or public authorities;

c. investigate suspected offences;

d. enforce our Terms and policies;

e. protect our rights or those of others; and

f. establish, exercise or defend legal claims.

Our lawful bases are legal obligation, legitimate interests, recognised legitimate interests where applicable and legal claims.

6.15 Business transactions

If Creatonics is involved in a merger, investment, financing, reorganisation, sale or transfer of all or part of its business, relevant personal data may be disclosed to professional advisers, potential purchasers, investors or counterparties.

Our lawful basis is our legitimate interests in considering and carrying out a legitimate business transaction, subject to appropriate confidentiality and data-protection safeguards.

7. WHEN YOU MUST PROVIDE PERSONAL DATA

7.1 Certain information is required to enter into or perform a contract with you.

7.2 For example, we ordinarily need your:

a. name;

b. email address;

c. delivery address;

d. billing information; and

e. payment authorisation

to accept, deliver and administer an Order.

7.3 If you do not provide required information, we may be unable to:

a. create your Account;

b. process an Order;

c. establish or renew a Subscription;

d. deliver Products;

e. issue a refund; or

f. respond fully to a request.

7.4 Where providing information is optional, we will try to make this clear.

8. HEALTH AND OTHER SPECIAL-CATEGORY DATA

8.1 We do not ordinarily require health information in order to sell our Products.

8.2 However, you may voluntarily provide health information when:

a. reporting an adverse reaction;

b. asking whether a Product may be suitable for you;

c. making a safety complaint;

d. seeking a refund or replacement connected with a reaction; or

e. communicating with us about another health-related concern.

8.3 Please do not send more health information than is reasonably necessary.

8.4 Where we process health or other special-category data, we will do so only where both:

a. an ordinary lawful basis under data-protection law applies; and

b. an additional special-category condition applies.

8.5 Depending on the circumstances, the special-category condition may be:

a. your explicit consent;

b. processing necessary to establish, exercise or defend legal claims;

c. processing necessary to protect vital interests where you are unable to consent; or

d. another condition permitted by law.

8.6 We will limit access to this information and will not use health information to send targeted marketing without appropriate consent.

8.7 Information on our Website is not a substitute for professional medical advice. Please do not submit urgent medical enquiries through customer-service channels.

9. COOKIES AND SIMILAR TECHNOLOGIES

9.1 We and our service providers use cookies and related storage or access technologies to operate and understand the Website.

9.2 These technologies may include:

a. cookies;

b. pixels;

c. tags;

d. scripts;

e. local storage;

f. software development kits;

g. link-tracking technologies; and

h. similar identifiers.

9.3 Some technologies are necessary to:

a. operate the Website;

b. maintain security;

c. remember a basket;

d. process checkout;

e. authenticate an Account;

f. remember privacy choices; or

g. provide a feature requested by you.

9.4 Other technologies may be used for:

a. analytics;

b. personalisation;

c. advertising;

d. campaign measurement; or

e. social-media functionality.

9.5 Where consent is legally required, we will not use non-essential technologies unless and until you give the relevant consent.

9.6 You may accept, reject or adjust non-essential technologies using our cookie-management tool.

9.7 Withdrawing consent will not affect the lawfulness of processing that took place before consent was withdrawn.

9.8 Further information about the cookies and technologies used, their providers, purposes and durations is available in our Cookie Policy:

[INSERT COOKIE POLICY URL]

10. OUR RELATIONSHIP WITH SHOPIFY

10.1 Our Website and online store are hosted using Shopify.

10.2 Shopify processes personal data to provide services including:

a. Website hosting;

b. checkout functionality;

c. Account and order administration;

d. payment and fraud-prevention functionality;

e. security;

f. analytics and reporting; and

g. ecommerce infrastructure.

10.3 For much of this processing, Creatonics is the controller and Shopify acts as our processor, processing customer data on our instructions.

10.4 Shopify may also process certain personal data as a separate controller, including in connection with:

a. Shop;

b. Shop Pay;

c. Shopify consumer services;

d. Shopify’s security, fraud-prevention and platform-improvement activities; and

e. enhanced Shopify services that may combine interactions across Shopify, Creatonics and other Shopify merchants.

10.5 Where Shopify acts as a separate controller, Shopify determines its own purposes and lawful bases and is responsible for its own processing.

10.6 Shopify’s processing as a separate controller is described in the Shopify Consumer Privacy Policy:

https://www.shopify.com/uk/legal/privacy/consumers

10.7 Depending on the Shopify settings and services enabled on our store, Shopify may process information about your interactions with Creatonics alongside information concerning your interactions with Shopify or other merchants.

10.8 Where consent is required for Shopify-enabled analytics, personalisation or targeted advertising, we will request that consent through the Website’s privacy controls.

10.9 Personal data relating to UK customers may initially be processed by Shopify International Limited in Ireland and may also be processed by Shopify group companies and approved subprocessors in other countries.

11. WHO WE SHARE PERSONAL DATA WITH

11.1 We may share personal data with organisations that help us operate our business and fulfil our obligations.

11.2 These recipients may include the following categories.

11.2.1 Ecommerce and hosting providers

Including Shopify and providers supporting the operation, security and maintenance of the Website.

11.2.2 Payment providers

To authorise payments, process refunds, prevent fraud and manage disputes or chargebacks.

11.2.3 Fulfilment and delivery providers

Including warehouses, fulfilment providers, postal operators, couriers and delivery-management services.

We provide only the information reasonably necessary to deliver and administer your Order.

11.2.4 Subscription and Account providers

Where used, these providers help us administer recurring Orders, payment schedules, Account access, Subscription amendments and cancellation.

11.2.5 Communications and customer-support providers

These providers may help us manage email, customer-service communications, transactional notifications, helpdesk systems or other communications.

11.2.6 Analytics and technology providers

These providers may help us monitor Website performance, understand usage, identify errors or improve our services.

Non-essential analytics technologies are used only where permitted and, where required, with your consent.

11.2.7 Advertising and social-media partners

Where you have made the relevant privacy choice, we may share or make data available to advertising and social-media providers for campaign measurement, audience creation, personalisation or targeted advertising.

11.2.8 Review, referral, loyalty and promotion providers

Where these services are offered, providers may process data to collect reviews, administer referrals, manage rewards or operate promotions.

11.2.9 Manufacturers and product-safety partners

Where necessary to investigate a quality, batch, adverse-reaction or Product-safety matter, we may share relevant information with the manufacturer, laboratory, quality adviser or other appropriate specialist.

We will limit the information to what is reasonably necessary.

11.2.10 Professional advisers and insurers

Including accountants, auditors, lawyers, consultants, banks and insurers where reasonably necessary for business administration, advice, claims or compliance.

11.2.11 Public authorities and legal recipients

Including courts, regulators, tax authorities, law-enforcement bodies and other public authorities where disclosure is required or permitted by law.

11.2.12 Corporate transaction recipients

Potential investors, purchasers, lenders, counterparties and their advisers in connection with a proposed or completed business transaction.

11.3 Service providers acting on our behalf are required to process personal data only for the relevant services and to protect it appropriately.

11.4 Some third parties, such as payment providers, social-media platforms or Shopify in certain circumstances, act as separate controllers. Their own privacy policies apply to their independent processing.

11.5 We do not sell or rent your personal data to third parties for money.

12. INTERNATIONAL TRANSFERS

12.1 Some of our service providers, including Shopify and its subprocessors, may process personal data outside the United Kingdom.

12.2 A country outside the United Kingdom may not provide the same level of statutory data protection as the United Kingdom.

12.3 Where a restricted international transfer takes place, we will use a lawful transfer mechanism where required.

12.4 Depending on the recipient and destination, this may include:

a. UK adequacy regulations;

b. the UK International Data Transfer Agreement;

c. the UK Addendum to the European Commission’s Standard Contractual Clauses;

d. other approved contractual safeguards;

e. binding corporate rules; or

f. another mechanism permitted by applicable law.

12.5 Where required, we or the relevant provider will assess whether supplementary protections are needed.

12.6 You may contact us at hello@creatonics.com for further information about the safeguards used for relevant transfers.

13. HOW LONG WE KEEP PERSONAL DATA

13.1 We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, regulatory, security and dispute-resolution requirements.

13.2 When determining a retention period, we consider:

a. the amount and nature of the data;

b. the sensitivity of the data;

c. the purpose of processing;

d. the risk of harm from unauthorised use or disclosure;

e. whether the purpose can be achieved in another way;

f. applicable legal and regulatory requirements; and

g. relevant limitation periods for legal claims.

13.3 Our usual retention approach is as follows.

13.3.1 Order, Subscription and financial records

We normally retain core transaction, payment, invoice, refund and Subscription records for up to six years after the end of the relevant transaction or customer relationship.

We may retain them for longer where required by law or in connection with an ongoing dispute, investigation or claim.

13.3.2 Account information

We retain Account information while the Account remains active.

After closure, Account-only information will be deleted or anonymised within a reasonable period, except where it forms part of transaction, fraud, complaint or legal records that must be retained.

13.3.3 Customer-service and complaint records

Routine enquiries may normally be retained for up to two years after resolution.

Records concerning Orders, complaints, refunds, legal issues or potential claims may be retained for up to six years after resolution or for longer where reasonably required.

13.3.4 Product-safety and adverse-reaction records

These records will be retained for as long as reasonably necessary to investigate the matter, meet Product-safety or legal obligations, manage insurance and legal claims and protect customers.

13.3.5 Marketing information

We retain marketing-contact information while you remain subscribed or while we have another lawful basis to send marketing.

When you unsubscribe or object, we may retain limited information on a suppression list to ensure that we respect your preference.

13.3.6 Cookie and analytics information

Retention periods differ between technologies and providers and are described in our Cookie Policy or cookie-management interface.

13.3.7 Reviews and submitted content

Published reviews or content may be retained while they remain relevant and available on the Website.

Associated records may be retained for a reasonable period after removal to address authenticity, moderation, legal or compliance issues.

13.3.8 Fraud and security records

We retain fraud and security records for as long as reasonably necessary to prevent repeat abuse, investigate incidents, protect our systems and establish or defend claims.

13.4 At the end of the applicable retention period, personal data will be deleted, anonymised or otherwise securely removed, unless continued retention is lawfully required.

13.5 Anonymised information that can no longer identify you may be retained and used for statistical, research or business-analysis purposes.

14. HOW WE PROTECT PERSONAL DATA

14.1 We use appropriate technical and organisational measures designed to protect personal data against:

a. unauthorised access;

b. unlawful use;

c. accidental loss;

d. alteration;

e. disclosure;

f. destruction; and

g. damage.

14.2 Measures may include, where appropriate:

a. access controls;

b. authentication;

c. encryption in transit or at rest;

d. secure service providers;

e. staff-access restrictions;

f. contractual confidentiality requirements;

g. backups;

h. monitoring; and

i. incident-response procedures.

14.3 Access to personal data is limited to people and service providers who reasonably need it for their role.

14.4 No internet transmission or storage system can be guaranteed to be completely secure. You should avoid sending unnecessary sensitive information through unsecured communications.

14.5 You are responsible for keeping your Account password confidential and for notifying us promptly if you suspect unauthorised access.

14.6 If a personal-data breach occurs, we will assess and respond to it in accordance with applicable law, including notifying the Information Commissioner’s Office and affected individuals where legally required.

15. CHILDREN’S DATA

15.1 The Website, Accounts, Orders and Subscriptions are intended for individuals aged 18 or over.

15.2 We do not knowingly collect personal data from children under 18 through the ordinary operation of the Website.

15.3 If you believe that a child has provided personal data to us, contact us at hello@creatonics.com.

15.4 Where appropriate, we will take reasonable steps to delete the information, unless we have a lawful reason to retain it.

16. AUTOMATED PROCESSING AND PROFILING

16.1 We and our service providers may use automated systems to:

a. assess payment risk;

b. identify suspected fraud;

c. detect security threats;

d. recommend Products or content;

e. measure marketing performance; or

f. create advertising audiences where you have consented.

16.2 Fraud or payment systems may automatically flag or decline a transaction. Some decisions may be made by the relevant payment provider under its own privacy policy.

16.3 We do not intend to make solely automated decisions that produce legal or similarly significant effects without applying the safeguards required by law.

16.4 Where applicable, those safeguards may include:

a. giving you information about the decision;

b. allowing you to express your point of view;

c. allowing you to contest the decision; and

d. arranging appropriate human review.

16.5 You may contact us at hello@creatonics.com if you believe a significant decision concerning you was made solely through automated processing.

17. YOUR DATA-PROTECTION RIGHTS

Depending on the circumstances, you may have the following rights.

17.1 Right to be informed

You have the right to receive clear information about how your personal data is collected and used.

17.2 Right of access

You may request confirmation that we process your personal data and ask for a copy of that data.

17.3 Right to rectification

You may ask us to correct personal data that is inaccurate or complete information that is incomplete.

17.4 Right to erasure

You may ask us to delete personal data in certain circumstances.

This right does not apply where continued processing is necessary, for example to comply with a legal obligation or establish, exercise or defend a legal claim.

17.5 Right to restrict processing

You may ask us to restrict the use of your personal data in certain circumstances, including while accuracy or an objection is being considered.

17.6 Right to data portability

Where processing is automated and based on consent or contract, you may have the right to receive personal data you supplied in a structured, commonly used and machine-readable format or ask us to transfer it to another controller where technically feasible.

17.7 Right to object

You may object to processing based on legitimate interests or public-interest grounds where your particular circumstances justify the objection.

We may continue processing where we can demonstrate compelling legitimate grounds or where processing is required for legal claims.

17.8 Absolute right to object to direct marketing

You may object to direct marketing at any time.

Once you object, we will stop using your personal data for that marketing, including related profiling.

17.9 Right to withdraw consent

Where we rely on consent, you may withdraw it at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

17.10 Rights concerning automated decisions

You may have rights relating to certain decisions made solely by automated means that produce legal or similarly significant effects.

17.11 Right to complain

You have the right to complain to us and to the Information Commissioner’s Office about our use of your personal data.

17.12 These rights are not absolute and may be subject to legal conditions, limitations and exemptions.

18. HOW TO EXERCISE YOUR RIGHTS

18.1 You may exercise a data-protection right by emailing hello@creatonics.com.

18.2 Please explain:

a. the right you wish to exercise;

b. the information or processing concerned; and

c. any details that will help us identify the relevant records.

18.3 We may request reasonable proof of identity before responding. This is intended to prevent personal data from being disclosed to an unauthorised person.

18.4 If another person makes a request for you, we may ask for evidence that they are authorised to act on your behalf.

18.5 You will not normally be charged a fee.

18.6 We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, particularly if it is repetitive, where permitted by law.

18.7 We normally respond without undue delay and within one month.

18.8 Where a request is complex or multiple requests have been made, the response period may be extended by up to two further months. If so, we will inform you within the initial one-month period and explain the reason.

19. MARKETING CHOICES

19.1 You can unsubscribe from marketing emails using the unsubscribe link included in the message.

19.2 Where SMS marketing is offered, you can follow the opt-out instructions in the message or contact us.

19.3 You may also email hello@creatonics.com to change your marketing preferences.

19.4 Opting out of marketing will not prevent us from sending necessary non-marketing communications, including:

a. Order confirmations;

b. delivery updates;

c. Subscription reminders;

d. payment notifications;

e. service or security notices;

f. responses to enquiries; and

g. legally required communications.

19.5 You can adjust advertising and analytics choices through the Website’s cookie settings.

19.6 We may retain your email address or other limited information on a suppression list after you opt out so that we do not contact you again contrary to your preference.

20. DATA-PROTECTION COMPLAINTS

20.1 If you are concerned about how we have collected, used, stored or shared your personal data, you may submit a data-protection complaint to:

Email: hello@creatonics.com

Please use the subject line “Data Protection Complaint” where possible.

20.2 Your complaint should include:

a. your name and contact details;

b. a description of your concern;

c. the personal data or processing involved;

d. relevant dates;

e. any steps already taken; and

f. copies of relevant communications or evidence.

20.3 We will acknowledge a data-protection complaint within 30 days of receiving it.

20.4 We will, without undue delay:

a. take appropriate steps to investigate;

b. make reasonable enquiries;

c. keep you informed about the progress of the complaint; and

d. tell you the outcome.

20.5 We may ask for further information or proof of identity where reasonably necessary.

20.6 You may also complain to the UK supervisory authority:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Further information is available through the Information Commissioner’s Office website:

https://ico.org.uk/make-a-complaint/

20.7 You do not have to complain to us before contacting the Information Commissioner’s Office, although giving us the opportunity to resolve the issue may allow it to be addressed more quickly.

21. THIRD-PARTY WEBSITES AND SOCIAL MEDIA

21.1 The Website may contain links, widgets or integrations connected to third-party websites and services.

21.2 Selecting a third-party link or using an integration may allow that third party to collect or receive information about you.

21.3 We do not control third-party websites and are not responsible for their privacy practices.

21.4 You should review the privacy policy of the relevant third party before providing information or using its services.

21.5 Information you publish on social media or another public platform may be visible to other people and may be used according to that platform’s terms and privacy policy.

21.6 Our inclusion of a link or integration does not necessarily mean that we endorse the third party or its privacy practices.

22. CHANGES TO THIS PRIVACY POLICY

22.1 We may update this Privacy Policy from time to time to reflect:

a. changes to our Products, Website or business practices;

b. changes to Shopify or other service providers;

c. new technologies or features;

d. changes in applicable law or regulatory guidance; or

e. improvements to clarity and transparency.

22.2 The updated version will be published on the Website and the “Last updated” date will be revised.

22.3 Where a change is material, we will provide additional notice where required, such as through the Website, your Account or email.

22.4 We encourage you to review this Privacy Policy periodically.

23. CONTACT US

Questions, requests or complaints concerning this Privacy Policy or our use of personal data should be sent to:

Creatonics Ltd

Email: hello@creatonics.com

Registered office:
Bristol Office Hub
195–197 Whiteladies Road
Bristol
England
BS8 2SB

Company registration number: 16756725

For the purposes of applicable data-protection law, Creatonics Ltd is the controller of the personal data described in this Privacy Policy.