Food supplement. Not a medicine. Sold by Grendova Health Ltd, Cardiff, UK.
Food supplement. Not a medicine. Sold by Grendova Health Ltd, Cardiff, United Kingdom.
GrendovaMenu

Privacy

Privacy Policy

Last updated: 11 August 2026. This policy explains, in plain terms, how Grendova Health Ltd, a company registered in England & Wales / Scotland under Company No. 13584920, with its registered office at 15 St Mary Street, Cardiff, CF10 1AD, Wales ("Grendova", "we", "us", "our"), collects, uses, stores and shares personal information gathered through grendova.info, telephone correspondence, order confirmation calls and courier-based order fulfilment. We are the data controller for the personal information described in this policy for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Scope of this policy

5. Your rights and how to exercise them

Under UK data protection law you have the right to request access to the personal information we hold about you, to request that inaccurate information be corrected, and to request that we erase your information where it is no longer needed or where you withdraw consent and no other lawful basis applies. You also have the right to object to processing based on our legitimate interests, to request that we restrict processing while a query is resolved, and to request a portable copy of information you provided to us in a structured, commonly used format. Where processing is based on consent, such as optional cookies, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To exercise any of these rights, please write to [email protected] or telephone +44 29 2089 4506 during our office hours of Monday to Friday, 9:00 to 17:30, quoting your name and, where applicable, your order reference so that we can verify your identity before responding. We aim to acknowledge every rights request within five working days and to provide a full response within one calendar month, as required by the UK GDPR, extendable by a further two months for particularly complex requests, in which case we will explain the reason for the delay.

6. Third-party processors we use

We share personal information only with organisations that need it to help us run our business, and only under written contracts that require them to protect your information to the standard required by UK data protection law. Our website is hosted using infrastructure provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, which stores website data in European data centres. Transactional emails, such as order acknowledgements, are sent through Mailgun Technologies, Inc., operating in the European Union through its Irish establishment, and website analytics are processed using Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on an consent basis as described in Section 7. Customer service enquiries are logged using Zendesk International Ltd, 55 Charlemont Place, Saint Kevin's, Dublin, Ireland, and, where an order is dispatched, limited delivery information is shared with our courier partners, principally Yodel Delivery Network Limited, DPD UK Limited and Evri Limited, each of which acts as an independent data controller for the delivery information it holds. None of these organisations is permitted to use your personal information for its own marketing purposes.

7. Cookies we use

Our website uses a small number of cookies, described fully in our separate Cookie Policy, which we summarise here for completeness. Strictly necessary cookies, including a session cookie named grendova_session, support core functions such as form submission and security, and are deleted automatically when you close your browser. A preference cookie named grendova_prefs remembers choices such as your cookie settings for up to twelve months so that you are not asked to repeat them on every visit. With your consent, analytics cookies named _ga and _ga_<container-id>, set by Google Analytics 4, help us understand how the site is used and are retained for up to thirteen months in line with guidance from the Information Commissioner's Office. A consent record cookie named grendova_consent stores the choices you make in our cookie banner for six months, after which you will be asked again. You can change or withdraw your cookie consent at any time using the Cookie Settings link in the footer of every page, or by adjusting your browser settings, although blocking strictly necessary cookies may affect the normal operation of the site.

8. International transfers

We aim to store and process personal information within the United Kingdom and the European Economic Area wherever possible, and the majority of the processors listed in Section 6 hold data on servers located in Ireland or other EU member states. Where a processor we use is based outside the UK or EEA, or where its ultimate parent company is established in a country such as the United States, we ensure that an appropriate safeguard is in place before any transfer takes place, such as reliance on the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or, where applicable, a qualifying data protection framework such as the UK Extension to the EU-US Data Privacy Framework. We carry out an assessment of the protections available in the destination country before agreeing to any such transfer, and we do not transfer personal information internationally for marketing purposes without your explicit consent. If you would like further information about a specific safeguard applicable to your information, you may request it using the contact details in Section 9.

9. Complaints and contact procedure

If you have any concern about how we handle your personal information, we would like the opportunity to resolve it directly, and you should contact us in the first instance at [email protected] or by telephone on +44 29 2089 4506 during office hours of Monday to Friday, 9:00 to 17:30. We will acknowledge your complaint within five working days and aim to provide a substantive response within thirty calendar days, escalating internally to our data protection lead where necessary. If, after receiving our response, you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection, at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, by telephone on 0303 123 1113, or online at ico.org.uk/make-a-complaint. You do not need to contact us before approaching the ICO, although we would appreciate the chance to put things right first.

10. Children's information

Prenatal Complete and grendova.world are intended for use by adults, and we do not knowingly collect personal information from children under the age of thirteen. If we become aware that a child's information has been submitted through our order form without appropriate consent, we will delete that information promptly. If you believe a child has provided personal information to us, please contact us using the details in Section 9 so that we can investigate and take appropriate action.

11. Security measures

We maintain reasonable technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, alteration or disclosure. Our website enforces an encrypted connection using HTTPS with an up-to-date TLS certificate, our hosting environment restricts administrative access to authorised personnel only, and access to order and customer service records is limited to staff who need it to perform their role. We periodically review our security arrangements and update them as our business and the wider threat landscape evolve. No method of transmission over the internet or method of electronic storage is completely secure, and while we strive to protect your personal information, we cannot fully assure absolute security.

12. Marketing communications

We do not send marketing communications unless you have separately opted in to receive them, and submitting an order request or speaking to us on a confirmation call does not automatically enrol you in any marketing programme. Where you have opted in, every marketing message will include a clear and simple way to unsubscribe, and we will action any unsubscribe request within ten working days. We do not sell, rent or otherwise trade your personal information to third parties for their own marketing purposes.

13. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our use of processors, or the law, and the version published on grendova.world is always the current version. Material changes will be highlighted at the top of this page for a reasonable period following publication. We encourage you to review this policy periodically, particularly before placing a new order.

14. Revision and change log

14 January 2025 — initial version of this Privacy Policy published ahead of the grendova.world launch. 3 June 2025 — retention periods reviewed and set out in Section 4 with specific durations for order records, call notes and correspondence. 22 September 2025 — added DPD UK Limited and Evri Limited as courier processors following the expansion of our regional delivery network described in Section 6. 11 August 2026 — clarified cookie names and lifespans in Section 7, added the international transfers section, and confirmed current response-time commitments for rights requests and complaints.