Privacy Policy

Last updated: 11-08-2026

1. Who we are

Free From Goods (“we”, “us”, “our”) operates clubpet.uk, where we sell gluten-free and dairy-free food and related products online.

We are the data controller for the personal data described in this policy.

  • Registered address: [ADDRESS]
  • Company number: [IF APPLICABLE]
  • Contact for privacy matters: [PRIVACY EMAIL]
  • ICO registration number: [IF APPLICABLE — UK businesses processing personal data usually need to register with the ICO]

2. What personal data we collect

Information you give us:

  • Name, email address, phone number
  • Billing and delivery addresses
  • Order history and account login details (if you create an account)
  • Any dietary preferences, allergy notes or comments you add to an order or enquiry
  • Correspondence with our customer service team

Information collected automatically:

  • IP address, device type, browser, operating system
  • Pages viewed, time on site, referring website
  • Cookie and similar identifiers (see section 8)

We do not collect payment card details. Payments are processed by [PAYMENT PROVIDER, e.g. Stripe / PayPal / Shopify Payments], who handle your card data under theirown privacy policy.

A note on health-related information

If you tell us about a coeliac diagnosis, allergy or intolerance, that is special category data under UK/EU GDPR and gets extra protection. We only use it where you have given us explicit consent (for example, to answer a product safety question you have asked), and we do not use it for marketing or profiling.

3. Why we use your data, and our legal basis

What we use it for

Legal basis

Processing and delivering your order, including sharing details with our suppliers

Performance of a contract

Managing your account

Responding to allergy or dietary safety questions

Customer service and handling complaints

Performance of a contract

Keeping tax, accounting and VAT records

Performance of a contract / legitimate interests

Marketing emails and newsletters

Legal obligation

Analytics and advertising cookies

Consent

Fraud prevention and site security

Legitimate interests

Improving our product range and website

Legitimate interests

Responding to allergy or dietary safety questions

Explicit consent (special category data)

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights. You can object at any time (see section 7).

4. Marketing

We will only send you marketing emails if you have opted in, or if you have bought from us before and we are marketing similar gluten-free or dairy-free products (the “soft opt-in”).

Every marketing email includes an unsubscribe link, and you can opt out at any time by emailing [PRIVACY EMAIL]. Opting out of marketing will not stop transactional emails such as order confirmations and delivery updates.

5. Who we share your data with

Because we operate a dropshipping model, your name and delivery address are passed to the supplier or manufacturer who fulfils your order, so they can ship it directly to you. They act as our processor and may only use your data to fulfil the order.

We also share data with:

  • Payment providers: [PROVIDER]
  • Website / e-commerce platform: [e.g. Shopify, WooCommerce]
  • Shipping and courier partners: [e.g. Royal Mail, DPD, Evri]
  • Email marketing platform: [e.g. Mailchimp, Klaviyo]
  • Analytics providers: [e.g. Google Analytics]
  • Advertising platforms: [e.g. Meta, Google Ads] — where you have consented to advertising cookies
  • Professional advisers, accountants and, where legally required, regulators or law enforcement

We do not sell your personal data.

6. International transfers

Some of our suppliers and service providers are based outside the UK/EEA — [e.g. in the United States and China]. Where we transfer your personal data outside the UK/EEA, we rely on one of the following safeguards:

  • an adequacy decision by the UK Government or European Commission; or
  • Standard Contractual Clauses (plus the UK International Data Transfer Addendum where relevant), together with a transfer risk assessment.

You can request a copy of the relevant safeguards by contacting us.

7. How long we keep your data

  • Order and transaction records: 6 years from the end of the relevant tax year (legal requirement)Account data: for as long as your account is active, plus [X] months
  • Marketing contacts: until you unsubscribe, or after [X] years of no engagement
  • Analytics data: [X] months
  • Customer service correspondence: [X] years

8. Your rights

Under UK and EU GDPR you have the right to:

  • Access a copy of the personal data we hold about you
  • Rectify inaccurate or incomplete data
  • Erasure (“right to be forgotten”) in certain circumstances
  • Restrict processing in certain circumstances
  • Data portability — receive your data in a machine-readable format
  • Object to processing based on legitimate interests, and to direct marketing at any time
  • Withdraw consent at any time, where we rely on consent
  • Not be subject to solely automated decision-making with legal or similarly significant effects (we do not do this)

To exercise any of these, email [PRIVACY EMAIL]. We will respond within one month.

If you are unhappy with how we handle your data, you can complain to:

  • UK: the Information Commissioner’s Office — ico.org.uk
  • EU: your local supervisory authority

9. Cookies

We use:

  • Strictly necessary cookies — required for the site, basket and checkout to work. These do not need your consent.
  • Analytics cookies — [e.g. Google Analytics], to understand how visitors use the site.
  • Advertising cookies — [e.g. Meta Pixel, Google Ads], to show you relevant ads and measure their performance.

Analytics and advertising cookies are only set after you consent via our cookie banner. You can change or withdraw your preferences at any time via [COOKIE SETTINGS LINK].

Full details are in our Cookie Policy.

10. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), access controls, and contracts with our processors. No system is completely secure, but we will notify you and the relevant regulator of a personal data breach where we are required to do so.

11. Children

Our website is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us with personal data, please contact us.

12. Changes to this policy

We may update this policy from time to time. We will post the new version here and update the “last updated” date. If the changes are significant, we will let you know by email or a notice on the site.

13. Contact

Clubpet 

[ADDRESS] [PRIVACY EMAIL]