Privacy Policy

PurePeps is a trading name of PUREPEP LTD, a company registered in England and Wales under company number 17338339.

You can contact us by email at hello@purepeps.uk or through the contact form on our website.

PUREPEP LTD (trading as PurePeps), company number 17338339, is the controller for personal data collected through this website.

Fena Pay is a separate and independent controller for the personal data it processes in order to provide its regulated payment-initiation services. For Pay by Bank, only the information necessary to create, process and reconcile the payment is shared, such as your name, the payment amount, the payment reference and the order identifier, together with any contact or transaction information actually required by the payment flow.

Fena processes the payment instruction and redirects you to your bank or banking app to authorise it. Fena does not provide PurePeps with your online-banking login credentials, and PurePeps never sees or stores them. Fena's privacy policy is available at https://www.fena.co/privacy-policy/.

Fena states that its data is stored in Europe, including the United Kingdom. Where any personal data is nevertheless processed outside the United Kingdom, the safeguards described in the international transfers section below apply.

Information you give us: name, email address, telephone number (optional), company or institution (optional), delivery address, order and basket contents, and consent choices such as research-use acknowledgement, terms acceptance and optional marketing preferences.

Information collected automatically: a hashed form of your IP address, a truncated user-agent string, and analytics events where you have consented to analytics cookies. A hashed IP address may still be personal data; we use it only for security, abuse prevention and rate limiting.

To process and deliver your orders, including arranging delivery and providing customer service.

To respond to enquiries and messages you send through the website or by email.

To keep records for tax, accounting and other legal obligations.

To protect the website, our customers, our systems and our business from fraud, misuse, unauthorised access and disruption.

Checkout information such as your name, delivery address, email address, order contents and payment-related references is required to enter into and perform the sales contract with you. Without it we cannot accept or fulfil an order.

Where processing is required by law, for example tax and accounting records, our legal basis is compliance with a legal obligation.

Security and abuse-prevention processing is carried out on the basis of our legitimate interests, namely protecting the website, customers, systems and business from fraud, misuse, unauthorised access and disruption. This processing is limited to what is necessary and is balanced against your rights and freedoms.

Marketing emails are sent only where you have given specific, optional consent. Marketing consent is not required to place an order.

We send marketing emails only with your specific, optional consent given at checkout or elsewhere on the site.

You can withdraw consent at any time using the unsubscribe link in any marketing email or by emailing hello@purepeps.uk.

We stop marketing promptly on withdrawal. We keep a minimal suppression record where necessary so that your preference continues to be respected.

Lovable: website and application platform, including the database services used through that platform.

Cloudflare: domain and DNS services, together with any security or network services we have enabled.

Google Workspace: business email.

Google Analytics: optional website analytics, used only where you have consented.

Fena Pay: Open Banking payment initiation.

Royal Mail: delivery fulfilment.

Regulators, courts, professional advisers or other authorities where disclosure is required by law.

We do not sell personal data.

Some providers may process personal data outside the UK. Where this occurs, PurePeps will use an adequacy regulation or appropriate safeguards recognised by UK data-protection law, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with any required supplementary measures. You may request further information about the relevant safeguards by emailing hello@purepeps.uk.

Order, payment and tax or accounting records: 6 years after the end of the relevant financial year, unless a longer period is legally required.

Customer-service enquiries and complaints: 3 years after resolution, unless needed for a legal claim or regulatory matter.

Delivery and returns records: 6 years where linked to an order or a legal or accounting obligation; otherwise 3 years after resolution.

Marketing-consent records: for as long as consent remains active, after which we retain only a minimal suppression record as needed to honour withdrawal and comply with marketing rules.

Security and abuse-prevention logs: no longer than 12 months, unless required for an active investigation or a legal obligation.

Analytics data: retained for the retention period configured in Google Analytics, which we review regularly.

Data is deleted or anonymised when the relevant retention period ends, unless a lawful reason requires further retention.

You have the right to be informed about our processing, to access personal data we hold about you, to have inaccurate data corrected, to have data erased in certain circumstances, to restrict or object to certain processing, and to receive certain data in a portable format.

You can exercise these rights by emailing hello@purepeps.uk or by submitting a request through the contact form on our website. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

We use commonly accepted technical and organisational measures to protect personal data, including access controls, encryption in transit and restricted administrative access. No system is completely secure and we cannot guarantee absolute security.