Privacy policy: how Biovanta handles your data

Biovanta Ltd (“we”, “us”) is the data controller for biovanta.store. This notice explains what we collect, why, and how to make us delete it.

What we collect

Account data: email address you use to sign in. We do not collect passwords.
Order data: shipping name, address, phone, items ordered, payment method chosen.
Marketing data: email if you opt in to newsletter or batch updates.
Analytics: events (pages visited, products viewed, items added to cart) tied to a session ID, only once you accept analytics cookies. If you are signed in to your account at the time, the events are also linked to your account. That is what lets us send the batch report for a product you looked at, and only if you have agreed to marketing email. If you don't accept, we still count your visit for statistics without any cookie or stored ID (the page, the site or link that brought you, your country and device type, under a code that changes every day). If you order, we match the order to your visit that day or the day before (UK time) to see which site or link brought you, and keep only that source on the order. We also count, page by page, where people tap and how far down they scroll, with no identifier of any kind, and keep those counts for 90 days. You can opt out of all of this here or with your browser's Global Privacy Control or Do Not Track setting.
Technical data: hashed IP, user agent, country / city derived from headers.
Referral data: referral code if you arrived via a friend's link.
Advertising measurement (cookie-free until you choose Accept all): if you reached us from a Google ad, Google’s tag keeps a record of that ad click in a cookie. When a card payment is confirmed we tell Google the order number and the amount paid, so we can see which ads lead to orders. Until you choose, the tag runs in Google’s cookie-free consent mode: your browser contacts Google with no cookie and no identifier, and nothing about you is stored; Reject turns it off. Google’s tag itself does not send Google your name, email address, delivery address or what you bought; our tracking server, below, does pass order details on.
Ad measurement through our tracking server (cookie-free until you choose Accept all): your browser tells our own tracking server at bhs.biovanta.store when you view a product, change your bag, start checkout, choose delivery and payment, and when a payment is confirmed: the products, prices and quantities, and for a paid order the order number, amount and delivery charge. Only after you choose Accept all does a paid order also carry the email address, phone number, name, town, postcode and country on the order, so that ad platforms can match the order to an ad you saw. Until you choose, the server runs in Google’s cookie-free consent mode: no cookie is set and no identifier is sent, and the platforms are told you have not consented. We run this server with our marketing partner Pralo, on Stape’s servers, and it passes these details to ad platforms such as Google and Meta, which tell us when an ad led to an order. Reject turns it off; withdrawing with Cookie settings returns it to cookie-free mode.
Google Analytics (cookie-free until you choose Accept all): visit statistics go from your browser to Google Analytics (Google Ireland Limited): the pages you view, your device and browser type, your approximate location (worked out from your IP address, which Google Analytics does not store), how you reached us, and the shopping steps: a product viewed, added to or removed from your bag, checkout started, and a confirmed order with its number and amount. We do not send it your name, email address, delivery address or anything you type. Once you choose Accept all it uses the _ga and _ga_<id> cookies to recognise a returning browser, kept up to two years; until you choose it runs cookie-free, with no cookie and no identifier. “Our analytics only” and Reject leave it off. You can withdraw at any time with Cookie settings, below.

Lawful basis

Contract — to fulfil and ship your order.
Legitimate interest — to keep the site secure and prevent fraud (hashed IP address and request headers).
Legitimate interest — to count visits without cookies for statistics, and to see which site or link brought an order (the cookie-free count described above, which you can opt out of).
Consent — for analytics cookies (the cookie banner), and for marketing email (you opt in at checkout, via the newsletter form, or by ticking the box in the chat).
Consent — for Google Ads measurement cookies, given separately with Accept all on the cookie banner (Analytics only leaves Google off).
Consent — for ad measurement through our tracking server, given with Accept all on the cookie banner (Our analytics only leaves it off).
Consent — for Google Analytics, given with Accept all on the cookie banner (Our analytics only leaves it off).

How long we keep it

Order records — 7 years (UK tax law).
Marketing email list — until you unsubscribe.
Analytics events — 13 months, then only as daily totals.
Cookie-free visit counts — 90 days.
Referral click logs — 12 months.

Who we share it with

When you pay by card, your name and email address are shared with our payment provider, Niftipay (NoPayn), so they can take the payment. We never see or store your card details. Our other providers process data on our behalf under data-processing agreements: Supabase (database hosting, EU-West-2), 1984 Hosting (application hosting, Iceland), Cloudflare (content delivery and security, which carries your requests to our servers), Resend (sending your order emails), Sentry (error diagnostics, EU region — personal data is stripped before a report is sent), and Royal Mail (delivery only when an order is shipped). We also use Telegram (your order's dispatch label, with your name and address, and any website chat you ask to hand to a person are passed to our team through it), Listmonk with Amazon SES (sending our newsletter and guide emails), and Porkbun (hosting our orders@ and info@ mailboxes). If you message us through the chat box on this site, the conversation is stored with us and passed to our support team. You can always ask for a person instead of the automatic answers.

Questions you type into the chat box may be answered by Pralo (pralo.ai), our conversational-commerce provider, which processes the text of your message to reply. It does not receive your name, email address or order details from the chat; those are only ever looked up by our own server. Every automatic answer is checked by us before it is shown, and you can always ask for a person instead.

If you choose Accept all, Google (Google Ireland Limited) receives the ad-click and order details described above, along with your IP address and browser details that come with any web request. For that data Google is an independent controller under its own privacy policy (policies.google.com/privacy). We do not use it to show you ads elsewhere: remarketing and ad personalisation are switched off.

If you choose Accept all, our tracking server at bhs.biovanta.store receives the shopping steps and order details described above, along with your IP address and browser details that come with any web request. Pralo (our marketing partner) and Stape (which hosts the server) process them on our behalf. The server passes them to ad platforms such as Google (Google Ireland Limited) and Meta (Meta Platforms Ireland Limited), which use them under their own privacy policies to measure which ads lead to orders.

Cookies

Essential cookies and browser storage keep your basket, checkout and order pages working, and remember your cookie choice. Our analytics runs only after you accept it on the cookie banner. It uses a random visit id and a hashed IP address, so it is pseudonymous rather than anonymous. Without it, we only count your visits the cookie-free way described above; nothing is stored on your device for that, and Google Ads never loads. If you choose not to be counted, one cookie (bv_stats_optout) remembers just that choice. Google Ads measurement is a separate choice: it runs only after Accept all, never after Analytics only. Google’s are the _gcl_au and _gcl_aw cookies and _gcl_ls in browser storage, kept up to 90 days. Ad measurement through our tracking server is part of the same Accept all choice. The server can set its own cookies on this site to recognise a returning browser (such as _fbp, _fbc, _ga and FPID). You can change your mind at any time: reopens the banner. Choosing Reject, or withdrawing, deletes the visit id and the record of how you arrived from this browser, and removes Google’s cookies and storage from this site, stops anything more going to our tracking server, and removes the cookies it set that your browser lets us remove.

Your rights (UK GDPR)

Right to access, rectify or delete your data.
Right to data portability.
Right to withdraw consent at any time (unsubscribe link in every marketing email; Cookie settings above for cookies).
Right to complain to the ICO (ico.org.uk).

Contact

Message us on or email [email protected] with any request. We reply within five UK working days.