Biovanta Ltd (“we”, “us”) is the data controller for biovanta.store. This notice explains what we collect, why, and how to make us delete it.
What we collect
- Account data: email address you use to sign in. We do not collect passwords.
- Order data: shipping name, address, phone, items ordered, payment method chosen.
- Marketing data: email if you opt in to newsletter or batch updates.
- Analytics: anonymised events (pages visited, products viewed, items added to cart) tied to a session ID.
- Technical data: hashed IP, user agent, country / city derived from headers.
- Referral data: referral code if you arrived via a friend's link.
Lawful basis
- Contract — to fulfil and ship your order.
- Legitimate interest — to keep the site secure, prevent fraud, and improve UX with anonymised analytics.
- Consent — for marketing email (you opt in at checkout or via the newsletter form).
How long we keep it
- Order records — 7 years (UK tax law).
- Marketing email list — until you unsubscribe.
- Anonymous analytics events — 90 days.
- Referral click logs — 12 months.
Who we share it with
When you pay by card, your name and email address are shared with our payment provider, Niftipay (NoPayn), so they can take the payment. We never see or store your card details. Our other providers process data on our behalf under data-processing agreements: Supabase (database hosting, EU-West-2), 1984 Hosting (application hosting, Iceland), Cloudflare (content delivery and security, which carries your requests to our servers), Resend (sending your order emails), Sentry (error diagnostics, EU region — personal data is stripped before a report is sent), and Royal Mail (delivery only when an order is shipped). If you message us through the chat box on this site, that conversation is relayed to our support team over Telegram. When you place an order, we may pass your email address and that order's number, items and total to Trustpilot, which sends a single invitation to review our service; the invitation carries its own opt-out link, and Trustpilot processes it under its own privacy policy.
Your rights (UK GDPR)
- Right to access, rectify or delete your data.
- Right to data portability.
- Right to withdraw consent at any time (unsubscribe link in every marketing email).
- Right to complain to the ICO (ico.org.uk).
Contact
Message us on or email [email protected] with any request. We reply within five UK working days.