Privacy notice

Who this notice is about

New You Vitamins is the storefront name. The legal entity behind the brand and the identity of the data controller have not been confirmed here. The verified contact for privacy questions is new-you-vitamins@polsia.app.

Information used by the storefront

• Account details: name, email address and password credential when you create an account; sign-in sessions are also used to provide account access. The session model has optional IP-address and browser user-agent fields, but whether the current flow populates them needs confirmation.
• Order and delivery details: the name and address entered at checkout, selected products and quantities, prices, discounts, shipping charge, order status, payment references and relevant dates. Orders are associated with your account or, for guest checkout, a browser-held checkout token.
• Saved repeat-delivery preference: if you sign in and save one, the selected product identifiers and delivery address are stored with your account. The current page saves a preference only; subscription payments are unavailable.
• Messages you send: if you email our support address, we receive the sender details and message you choose to include.
• Site visit signal, if enabled: the deployment may load an analytics beacon. When it does, the browser creates a random visitor identifier and sends it with the deployment analytics slug to the configured Polsia API endpoint.

How the information is used

The site uses account details for sign-in and account features; order and address details to calculate checkout totals, create an order record and show verified paid orders; saved preferences to display and update your repeat-delivery selection; and messages to respond to the enquiry you send. If enabled, the visitor signal is used for site analytics. The business has not yet confirmed the lawful basis it relies on for each of these purposes. That legal basis must be confirmed before this notice is complete.

Checkout and payment

The current storefront integration creates a hosted checkout link through Square Sandbox. It sends Square the GBP payment total and a New You Vitamins order label. The app stores Square reference identifiers and the payment-verification result with the order; its order record does not contain card numbers. The live production payment arrangement and Square’s applicable privacy and transfer details still need confirmation.

Cookies and browser storage

• Sign-in uses an authentication session cookie. Guest checkout uses an HttpOnlypolsia_guest_checkoutcookie that expires after 30 days.
• The basket is saved in browser local storage until it is cleared. If analytics is enabled, the random visitor identifier is also saved in local storage; the app code does not set an expiry for it.
• The site’s analytics consent and opt-out arrangements need confirmation. No additional analytics or advertising cookies have been verified in the storefront code reviewed for this notice.

Service providers, transfers and retention

Order totals and an order label are sent to Square in the configured checkout environment to create hosted checkout. If analytics is enabled, the visitor signal goes to the configured Polsia API endpoint. Account, order and saved-preference records are kept in the app database. The full list of providers with access, where their systems process or store information, any international transfers and safeguards, and retention periods for database and support records have not been confirmed. We will update this section when those details are verified.

Your data-protection rights

Depending on the circumstances, UK data-protection law may give you rights to request access to, correction or deletion of your information, restriction of or objection to its use, or a copy in a portable format. Where consent is the lawful basis, you may withdraw it. To make a request or raise a concern, email new-you-vitamins@polsia.app. You can also complain to the Information Commissioner’s Office (ICO). The business’s procedure and response arrangements for these requests still need confirmation.

Further information

The ICO explains what privacy information organisations should provide in its right-to-be-informed guidance.