Privacy Policy
This policy explains how Astra Labs collects, uses, stores and protects personal information when you browse our website, create an account, place an order or contact our support team.
Secure processing
Personal information is used only where it is needed to operate, secure and support our website and services.
Order fulfilment
We use order and delivery information to process payments, dispatch purchases and provide customer support.
Your choices
You can manage marketing preferences, control optional cookies and exercise your data protection rights.
Who we are
Astra Labs operates the website at astralabs.co.uk and is responsible for deciding how personal information collected through the website is used.
In data protection terminology, Astra Labs acts as the data controller for the personal information described in this policy.
Privacy enquiries can be sent to [email protected].
Information we collect
The information we collect depends on how you interact with Astra Labs. It may include the following categories.
Your name, email address, telephone number, billing address and delivery address.
Products ordered, order value, discounts, delivery method, order status, tracking information and purchase history.
Login details, account preferences, saved addresses and information associated with your customer account.
Payment status, payment reference, payment method and transaction information received from payment providers.
Emails, contact form submissions, support enquiries, complaints, returns information and other messages sent to us.
IP address, browser type, device information, operating system, website activity, security logs and cookie identifiers.
Whether you have agreed to receive marketing and information about when or how you subscribed or unsubscribed.
Product reviews, display names, ratings, photographs or other feedback that you choose to submit.
Please do not send medical information. Astra Labs does not require health records, medical history, dosing information or other sensitive health data to process an order.
How we collect information
We may collect personal information:
- when you place an order or create a customer account;
- when you contact us by email or through the website;
- when you subscribe to marketing communications;
- when you submit a review, complaint or support request;
- automatically through cookies, server logs and website security technologies; and
- from payment providers, banks, delivery partners and other services involved in completing your transaction.
How and why we use your information
We use personal information only where we have a valid reason and lawful basis to do so.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Processing and fulfilling orders | Identity, contact, delivery, order and payment information | Performance of a contract and steps requested before entering into a contract |
| Taking and confirming payments | Payment references, transaction status and order information | Performance of a contract |
| Providing delivery and tracking | Name, delivery address, contact details and order reference | Performance of a contract |
| Customer service and complaint handling | Contact details, communications, order history and evidence supplied by you | Performance of a contract and our legitimate interest in providing customer support |
| Preventing fraud and protecting the website | Account, transaction, device, IP address and security log information | Our legitimate interests in protecting customers, payments and business systems |
| Maintaining accounting and tax records | Order, payment, invoice, refund and transaction information | Compliance with legal obligations |
| Managing optional analytics technologies | Cookie identifiers, device information and website activity | Your consent, where consent is required |
| Sending marketing communications | Name, email address, purchase history and marketing preferences | Consent or another basis permitted under applicable electronic marketing rules |
| Establishing or defending legal claims | Relevant order, payment, communication and account information | Our legitimate interests and compliance with legal obligations |
Who we share information with
We do not sell personal information. We may share limited information with trusted organisations where necessary to operate the website, fulfil orders or comply with the law.
These organisations may include:
- payment service providers, banks and payment verification services;
- Royal Mail and other delivery or courier providers selected for an order;
- website hosting, WooCommerce, technical support and security service providers;
- email, customer support and communication service providers;
- accountants, insurers, legal advisers and other professional advisers;
- regulators, courts, law enforcement agencies or public authorities where disclosure is legally required; and
- a purchaser or adviser involved in a genuine business restructuring, sale or transfer.
Service providers are permitted to use personal information only for the services they provide to us and subject to appropriate confidentiality and data protection obligations.
Payments
Payments may be processed by third-party payment providers, banks or open-banking services. These organisations may collect information directly from you and process it under their own privacy policies.
Astra Labs normally receives confirmation of whether a payment was successful, together with a payment reference and limited transaction information. We do not receive or store your full online banking login credentials.
Payment providers may carry out fraud prevention, identity, account-ownership or regulatory checks where required.
Cookies and similar technologies
Our website uses cookies and similar technologies to operate the shopping basket, remember preferences, secure accounts, process checkout and understand website performance.
Essential cookies
Essential cookies are required for functions such as the shopping basket, checkout, account login, security and remembering your privacy choices. These technologies cannot always be disabled without affecting website functionality.
Optional cookies
Analytics, advertising or other non-essential technologies will be used only where the required consent has been provided. You can refuse optional cookies or change your preferences using the cookie controls available on the website.
Clearing browser storage or using a different device may require you to set your cookie preferences again.
International data transfers
Some website, payment, email, hosting or technical service providers may process information outside the United Kingdom or allow support personnel outside the United Kingdom to access it.
Where personal information is transferred internationally, we take steps designed to ensure that an appropriate level of protection is in place. This may include using UK adequacy regulations, contractual safeguards or other transfer mechanisms permitted by UK data protection law.
How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected.
Order, invoice, payment, refund and accounting information may normally be retained for at least six years where required for tax, VAT, accounting, legal or regulatory purposes.
Customer support messages, account information, technical logs and marketing records are retained only for as long as needed to provide support, maintain security, resolve disputes, demonstrate consent or meet legal obligations.
Information may be kept for longer where a complaint, chargeback, investigation or legal claim is ongoing or reasonably anticipated.
How we protect information
We use proportionate technical and organisational safeguards designed to protect personal information from unauthorised access, loss, misuse, alteration or disclosure.
These safeguards may include:
- encrypted website connections;
- restricted administrative access;
- account authentication and access controls;
- website monitoring, backups and security logging;
- payment processing through specialist providers; and
- procedures for handling suspected personal data incidents.
No online service can guarantee absolute security. Customers should use a strong, unique password and must not share their account login details with anyone else.
Your data protection rights
Depending on the circumstances and the lawful basis used, you may have the following rights.
Ask for confirmation of whether we hold your personal information and request a copy.
Ask us to correct personal information that is inaccurate or incomplete.
Ask us to delete personal information in certain circumstances.
Ask us to limit how personal information is used in certain circumstances.
Object to processing based on legitimate interests or to direct marketing.
Request eligible information in a structured, commonly used and machine-readable format.
Withdraw consent at any time where processing is based on your consent.
Raise a concern with us or complain to the Information Commissioner’s Office.
Making a request
To exercise a data protection right, email [email protected]. Please clearly explain your request and provide enough information for us to identify the relevant records.
We may request reasonable evidence of identity before releasing or changing personal information. We will normally respond without undue delay and within one month, subject to any lawful extension or exemption.
Complaining to the ICO
You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s independent data protection regulator.
Visit ico.org.uk/make-a-complaint for further information.
Marketing communications
Service messages relating to an order, account, payment, security issue or delivery are not marketing and may be sent where necessary to provide the service requested.
Promotional emails will be sent only where permitted by applicable law. Every marketing email will provide a method of unsubscribing.
You can withdraw from marketing at any time by using the unsubscribe link in an email or contacting [email protected].
We may retain a minimal suppression record after you unsubscribe so that we can respect your preference and avoid sending further marketing.
Children’s privacy
Astra Labs is not intended for children, and we do not knowingly seek to collect personal information from anyone under the age of 18.
Anyone who believes that a child has provided personal information through the website should contact us so that the information can be reviewed and, where appropriate, deleted.
Changes to this policy
We may update this privacy policy when our services, providers, website features or legal obligations change.
The latest version will always be published on this page. Material changes may also be communicated through the website or by email where appropriate.
Privacy enquiries
Contact Astra Labs to ask a question, exercise a data protection right or raise a concern about how your information has been used.
Email [email protected]