Privacy

Privacy Policy

Last updated: 11 August 2026. This policy explains, in plain terms, how Grendova Health Ltd, a company registered in England & Wales / Scotland under Company No. 13584920, with its registered office at 15 St Mary Street, Cardiff, CF10 1AD, Wales ("Grendova", "we", "us", "our"), collects, uses, stores and shares personal information gathered through grendova.world, telephone correspondence, order confirmation calls and courier-based order fulfilment. We are the data controller for the personal information described in this policy for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Scope of this policy

This policy applies to every visitor who browses grendova.world, every person who submits an order request through our online form, every customer we speak to during a confirmation call, and every individual who contacts us by telephone or email regarding Prenatal Complete or any other matter connected with our business. It covers information you give us directly, information generated automatically when you use our website, and limited information we may receive from our delivery partners once a parcel has been dispatched. It does not extend to the practices of third-party websites that may be linked from our pages, including social media platforms, and we encourage you to read the privacy notices of any external site you visit from a link on grendova.world. Where you interact with us purely as a prospective wholesale or trade partner rather than a consumer, a separate arrangement may apply and will be agreed with you directly.

2. Information we collect

When you submit an order request we collect your full name, telephone number, delivery address, and any notes you add to the order form, together with the product and quantity requested. During the confirmation call our customer service team may note the outcome of the call, any change to your order, and your preferred delivery instructions. If your order is dispatched, our courier partner shares limited status information with us, such as attempted delivery, successful delivery and, where relevant, payment-on-delivery confirmation, so that we can keep our own records accurate. If you contact us by email or telephone for any other reason, we keep a record of that correspondence, including your name, contact details and the content of the message, so that we can respond appropriately and refer back to it if you contact us again. Our website also automatically records limited technical information when you visit, including your browser type and version, device type, approximate location derived from your IP address, the pages you view, the time and date of your visit, and the site that referred you to us, none of which is used to build an individual profile of you beyond what is necessary to keep the site secure and functioning correctly.

3. Legal basis for processing

We rely on different lawful bases depending on the purpose of the processing. Where you submit an order request, we process your information to take steps you have requested prior to entering into a contract with us, and, once your order is confirmed by telephone, to perform that contract, in reliance on Article 6(1)(b) UK GDPR. Where we are required to keep financial or delivery records for accounting, tax or consumer-protection purposes, we rely on our legal obligations under Article 6(1)(c) UK GDPR, including obligations arising from the Companies Act 2006 and HM Revenue & Customs record-keeping requirements. Where we analyse aggregated website usage, prevent fraud, or maintain the security and proper functioning of grendova.world, we rely on our legitimate interests under Article 6(1)(f) UK GDPR, having balanced those interests against your rights and freedoms. Where cookies or similar technologies are not strictly necessary for the site to function, for example optional analytics or marketing cookies, we rely on your consent under Article 6(1)(a) UK GDPR and the Privacy and Electronic Communications Regulations 2003 (PECR), and you may withdraw that consent at any time as described in Section 7 below.

4. Retention periods

We do not keep personal information for longer than is necessary for the purposes described in this policy. Order and delivery records, including your name, address, telephone number and order history, are retained for six years from the end of the financial year in which the order was placed, in line with our statutory bookkeeping obligations under the Companies Act 2006 and HMRC guidance on business record retention. Recordings or notes of confirmation telephone calls are retained for twelve months from the date of the call, after which they are securely deleted, unless a longer period is required to resolve an open query, complaint or legal claim. General correspondence, such as emails and contact-form enquiries that do not result in an order, is retained for twenty-four months from the date of the last message in the thread. Website server logs used for security and troubleshooting purposes are retained for ninety days on a rolling basis. Cookie consent records are retained for twelve months, after which your preferences are refreshed and you will be asked to confirm them again the next time you visit.

5. Your rights and how to exercise them

Under UK data protection law you have the right to request access to the personal information we hold about you, to request that inaccurate information be corrected, and to request that we erase your information where it is no longer needed or where you withdraw consent and no other lawful basis applies. You also have the right to object to processing based on our legitimate interests, to request that we restrict processing while a query is resolved, and to request a portable copy of information you provided to us in a structured, commonly used format. Where processing is based on consent, such as optional cookies, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To exercise any of these rights, please write to [email protected] or telephone +44 29 2089 4506 during our office hours of Monday to Friday, 9:00 to 17:30, quoting your name and, where applicable, your order reference so that we can verify your identity before responding. We aim to acknowledge every rights request within five working days and to provide a full response within one calendar month, as required by the UK GDPR, extendable by a further two months for particularly complex requests, in which case we will explain the reason for the delay.

6. Third-party processors we use

We share personal information only with organisations that need it to help us run our business, and only under written contracts that require them to protect your information to the standard required by UK data protection law. Our website is hosted using infrastructure provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, which stores website data in European data centres. Transactional emails, such as order acknowledgements, are sent through Mailgun Technologies, Inc., operating in the European Union through its Irish establishment, and website analytics are processed using Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on an consent basis as described in Section 7. Customer service enquiries are logged using Zendesk International Ltd, 55 Charlemont Place, Saint Kevin's, Dublin, Ireland, and, where an order is dispatched, limited delivery information is shared with our courier partners, principally Yodel Delivery Network Limited, DPD UK Limited and Evri Limited, each of which acts as an independent data controller for the delivery information it holds. None of these organisations is permitted to use your personal information for its own marketing purposes.

7. Cookies we use

Our website uses a small number of cookies, described fully in our separate Cookie Policy, which we summarise here for completeness. Strictly necessary cookies, including a session cookie named grendova_session, support core functions such as form submission and security, and are deleted automatically when you close your browser. A preference cookie named grendova_prefs remembers choices such as your cookie settings for up to twelve months so that you are not asked to repeat them on every visit. With your consent, analytics cookies named _ga and _ga_<container-id>, set by Google Analytics 4, help us understand how the site is used and are retained for up to thirteen months in line with guidance from the Information Commissioner's Office. A consent record cookie named grendova_consent stores the choices you make in our cookie banner for six months, after which you will be asked again. You can change or withdraw your cookie consent at any time using the Cookie Settings link in the footer of every page, or by adjusting your browser settings, although blocking strictly necessary cookies may affect the normal operation of the site.

8. International transfers

We aim to store and process personal information within the United Kingdom and the European Economic Area wherever possible, and the majority of the processors listed in Section 6 hold data on servers located in Ireland or other EU member states. Where a processor we use is based outside the UK or EEA, or where its ultimate parent company is established in a country such as the United States, we ensure that an appropriate safeguard is in place before any transfer takes place, such as reliance on the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or, where applicable, a qualifying data protection framework such as the UK Extension to the EU-US Data Privacy Framework. We carry out an assessment of the protections available in the destination country before agreeing to any such transfer, and we do not transfer personal information internationally for marketing purposes without your explicit consent. If you would like further information about a specific safeguard applicable to your information, you may request it using the contact details in Section 9.

9. Complaints and contact procedure

If you have any concern about how we handle your personal information, we would like the opportunity to resolve it directly, and you should contact us in the first instance at [email protected] or by telephone on +44 29 2089 4506 during office hours of Monday to Friday, 9:00 to 17:30. We will acknowledge your complaint within five working days and aim to provide a substantive response within thirty calendar days, escalating internally to our data protection lead where necessary. If, after receiving our response, you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection, at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, by telephone on 0303 123 1113, or online at ico.org.uk/make-a-complaint. You do not need to contact us before approaching the ICO, although we would appreciate the chance to put things right first.

10. Children's information

Prenatal Complete and grendova.world are intended for use by adults, and we do not knowingly collect personal information from children under the age of thirteen. If we become aware that a child's information has been submitted through our order form without appropriate consent, we will delete that information promptly. If you believe a child has provided personal information to us, please contact us using the details in Section 9 so that we can investigate and take appropriate action.

11. Security measures

We maintain reasonable technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, alteration or disclosure. Our website enforces an encrypted connection using HTTPS with an up-to-date TLS certificate, our hosting environment restricts administrative access to authorised personnel only, and access to order and customer service records is limited to staff who need it to perform their role. We periodically review our security arrangements and update them as our business and the wider threat landscape evolve. No method of transmission over the internet or method of electronic storage is completely secure, and while we strive to protect your personal information, we cannot fully assure absolute security.

12. Marketing communications

We do not send marketing communications unless you have separately opted in to receive them, and submitting an order request or speaking to us on a confirmation call does not automatically enrol you in any marketing programme. Where you have opted in, every marketing message will include a clear and simple way to unsubscribe, and we will action any unsubscribe request within ten working days. We do not sell, rent or otherwise trade your personal information to third parties for their own marketing purposes.

13. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our use of processors, or the law, and the version published on grendova.world is always the current version. Material changes will be highlighted at the top of this page for a reasonable period following publication. We encourage you to review this policy periodically, particularly before placing a new order.

14. Revision and change log

14 January 2025 — initial version of this Privacy Policy published ahead of the grendova.world launch. 3 June 2025 — retention periods reviewed and set out in Section 4 with specific durations for order records, call notes and correspondence. 22 September 2025 — added DPD UK Limited and Evri Limited as courier processors following the expansion of our regional delivery network described in Section 6. 11 August 2026 — clarified cookie names and lifespans in Section 7, added the international transfers section, and confirmed current response-time commitments for rights requests and complaints.