Privacy Policy

Who is responsible for your information?

THE TOX LAB MEDIA LTD, trading as The Tox Lab, is the controller of the personal information described in this notice. We are registered in England and Wales, company number 16905178.

Registered office: 27 Anchor Field, Ringmer, Lewes, England, BN8 5QN.

For privacy questions or to exercise your rights, email [email protected] or write to our registered office, marked “Privacy”.

Information we collect and where it comes from

• Shopping and delivery: your name, email, billing and delivery addresses, telephone number where supplied, items and options ordered, discounts, order history and correspondence about delivery, returns or refunds. If you buy a gift for someone else, we receive their delivery details from you. Please only provide details you are entitled to share.
• Payments: payment status, transaction references and information needed to handle refunds or disputes. Card details are entered into Stripe’s payment fields; our shop does not store your full card number or card security code. Stripe may provide limited payment-method information, such as the card brand and last four digits.
• Accounts and messages: account details if you have an account, and the name, email address, enquiry category and message you submit through our contact form or email. Guest checkout is available.
• Website and security: IP address, browser/device information, requested pages, timestamps, diagnostic logs, fraud/security signals and your cookie preference.
• Optional analytics: page visits and interactions, device/browser information and approximate location. Our podcast player can record episode ID, play/pause/seek events, progress, page/referrer and a session identifier when analytics is accepted. Its stored session and visitor identifiers are hashed; this is pseudonymous information, not a guarantee of anonymity.

Most information comes directly from you or your browser. Payment providers, our fulfilment supplier and delivery services also provide payment, fraud-check, dispatch, tracking and delivery updates.

Please do not include identifiable patient information, medical records or other sensitive personal information in general podcast enquiries.

Why we use information and our lawful bases

• Contract: taking payment, fulfilling your order, providing requested account services and handling order enquiries, returns and refunds.
• Legal obligation: keeping accounting and tax records and complying with applicable legal requirements.
• Legitimate interests: operating and securing the website, preventing fraud and misuse, answering general enquiries, maintaining necessary business records and establishing or defending legal claims. Our interests are running a reliable service and protecting customers and the business. We also use gift recipients’ delivery details in our and the purchaser’s legitimate interests in delivering the requested gift.
• Consent: optional analytics cookies and player analytics. You can refuse or withdraw this choice as explained below. Withdrawing consent does not affect processing that was lawful before withdrawal.

We need the required checkout details to accept payment and deliver your order. If you do not provide them, we may be unable to complete the purchase. Optional details and analytics consent are not a condition of buying. Placing an order or contacting us does not automatically subscribe you to marketing emails.

Who receives information?

We share information needed for the relevant service with:

• Two Fifteen: our print-on-demand supplier, which receives order and recipient/delivery details needed to produce, pack and dispatch your merchandise, and the carriers used to deliver it. See Two Fifteen’s privacy policy.
• Stripe: payment processing, payment security, fraud prevention, refunds and disputes. Stripe may act as a processor or an independent controller for particular activities. See Stripe’s privacy policy.
• Website and communications providers: hosting, email, backup and technical support, including Fasthosts, and Cloudflare for website delivery and security.
• Google: analytics and related consent services, subject to the choices and limitations described below. See Google’s privacy policy.
• Professional advisers, regulators and public authorities: where necessary for advice, legal compliance or protecting legal rights.

We limit what we share to what is needed. Suppliers may also have their own legal obligations and retention requirements.

Cookies, browser storage and analytics choices

Essential technologies support the shopping basket, checkout, login where used, security, payment fraud prevention and remembering your privacy choice. WordPress and WooCommerce use session and other functional cookies for these purposes. Payment/security providers may use their own necessary technologies.

Optional Google Analytics helps us understand visits and use of the website. Our player’s optional analytics helps us understand episode use. Analytics storage is denied by default and the player’s analytics events require an accepted analytics choice. Google’s consent tools may still receive basic connection and consent-status signals when analytics is declined; advertising consent remains denied.

To change or withdraw your analytics choice, select “Cookie settings” in the website footer, then “Reject analytics”. You can accept again through the same control. Rejecting removes the player’s saved analytics session identifier and Google Analytics cookies that our website can remove. It does not delete essential shopping, login or security cookies, or information already lawfully collected.

Your preference is saved in this browser using toxlabCookieConsent until changed or cleared. An accepted player session may use toxlabPlayerSession; Google Analytics may use cookies such as _ga and related identifiers. Browser settings can also remove or block cookies/storage, although blocking essential technologies may prevent checkout from working. Choices apply to each browser/device separately.

Playing externally hosted audio or following links to podcast/social platforms can disclose connection information to those services. Their own privacy notices apply.

Processing outside the UK

Some suppliers, including payment, security and analytics providers, operate internationally and may process information outside the UK. Where UK transfer restrictions apply, we require a valid transfer route, such as UK adequacy regulations or appropriate contractual safeguards using the UK International Data Transfer Agreement or UK Addendum to standard contractual clauses, as applicable. Contact us for details of the safeguards relevant to your information or how to obtain a copy. Suppliers’ linked notices explain their own international processing; see also Google’s transfer frameworks.

How long information is kept

Retention depends on the purpose, legal requirements, unresolved complaints/disputes and whether the information is still needed. Records are not all subject to automatic deletion on a fixed date.

• Order, payment and accounting records: generally six years from the end of the company financial year they relate to, with longer retention where required for a legal hold, investigation or unresolved claim.
• General contact enquiries: usually up to 24 months after the matter is resolved, unless an ongoing relationship or legal need justifies longer retention.
• Account information: while needed to provide the account and afterwards only as necessary for security, legal obligations or claims. Closing an account does not require us to erase accounting records we must keep.
• Incomplete/failed orders and technical/security logs: only for the period needed to resolve problems, prevent fraud and support security or legal requirements; their usefulness and sensitivity guide review.
• Analytics: according to the provider’s configured retention settings and, for our own player records, while needed to understand episode performance. We review whether identifiable or pseudonymous records remain necessary and delete or anonymise them when no longer required.

Information in backups is removed as backups are replaced or expire rather than necessarily disappearing immediately from every copy. Access to retained information is restricted to the relevant purpose.

Security and payment checks

We use appropriate technical and organisational measures, access controls and service providers to protect information. No online service can guarantee absolute security. Payment/security providers may use automated checks to detect suspected fraud; these can affect whether a payment succeeds. Contact us if you believe an order or payment has been blocked in error.

Your privacy rights

Depending on the circumstances, you can request access to your information, correction, erasure, restriction of processing or a portable copy of information you supplied where the law provides for this. Some information must be retained to meet legal obligations or protect legal rights.

You can object to processing based on legitimate interests. We will consider your circumstances and stop unless there are overriding lawful grounds. If information is used for direct marketing, you can object to that use at any time.

You can withdraw consent for consent-based processing, including analytics, at any time. To make a request, email [email protected]. We normally respond within one calendar month. We may need proportionate identity checks or clarification; where a lawful extension applies, we will explain it. Requests are normally free.

Complaints and changes

Please contact us if you have a concern. You also have the right to complain directly to the UK Information Commissioner’s Office: ico.org.uk/make-a-complaint/.

We will update this notice when our practices change and publish the latest date here. If we propose a materially different use of your information, we will provide the information and obtain any consent required before that use begins.