Privacy Policy

Last updated: 24 October 2026

This policy explains what personal data we collect when you use ancestralsuperfoods.co.uk or buy from us, why we use it and the rights you have. We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Who is responsible for your data

The data controller is Ancestral Superfoods OOD, UIC/VAT BG204663799, Plachkovitsa 2 Str., fl. 2, apt. 5, 1407 Sofia, Bulgaria. For any privacy question or request, email office@ancestralsuperfoods.co.uk.

2. What we collect

• Identity and contact details: name, email address, telephone number, delivery and billing address.
• Order details: the products you buy, order value, delivery and returns history, and messages you send us.
• Payment information: payments are processed by our payment providers. We see only limited details such as the card type and last four digits; we never see or store your full card number.
• Account details: if you create an account, your login email and order history.
• Marketing preferences: whether you have signed up to our emails or texts.
• Technical and usage data: IP address, device and browser type, pages viewed and how you arrived at the website, collected through cookies and similar technologies.
• Reviews: the name and content you choose to publish.

We do not intentionally collect data about children under 13, and you must be 18 or over to place an order.

3. How we use your data and our lawful bases

Purpose	Lawful basis
Processing, delivering and supporting your order, including returns and refunds	Performance of a contract
Keeping accounting and tax records	Legal obligation
Answering your questions and complaints	Contract or legitimate interests
Preventing fraud and keeping the website secure	Legitimate interests
Sending marketing emails or texts	Consent, or for existing customers our legitimate interests under the PECR "soft opt-in" (you can opt out at any time)
Analytics and advertising cookies, and measuring our ads	Consent
Improving our products and website using aggregated data	Legitimate interests

4. Who we share your data with

We share personal data only with trusted service providers who process it on our behalf under contract, and only as far as needed:

• Shopify: our e-commerce platform, which hosts the website and stores order data.
• Core Fulfilment Ltd (Crewe, UK): stores, packs and dispatches your order.
• Delivery companies such as Royal Mail, Evri or DPD: deliver your parcel.
• Payment providers such as Shopify Payments, PayPal and others shown at checkout: take payment and help prevent fraud.
• Email and SMS providers: send order updates and, if you have agreed, marketing.
• Analytics and advertising partners such as Google and Meta: only if you accept the relevant cookies.
• Professional advisers and authorities: our accountants, lawyers and, where required by law, HMRC, the police or regulators.

We never sell your personal data.

5. International transfers

We are based in Bulgaria (EU), which the UK recognises as providing adequate data protection. Some of our providers, including Shopify, Google and Meta, may process data in other countries such as Canada or the United States. Where this happens, we rely on UK adequacy regulations (including the UK–US Data Bridge) or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses to protect your data.

6. How long we keep it

• Order and invoice records: 6 years after the end of the financial year in which you ordered, to meet tax and accounting rules.
• Customer account: until you ask us to close it, or after 3 years of inactivity.
• Marketing data: until you unsubscribe or withdraw consent; we then keep your email on a suppression list so we do not contact you again.
• Customer service emails: up to 2 years after the matter is resolved.
• Cookies: see section 8.

7. Your rights

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, where there is no legal reason for us to keep it;
• restrict or object to our use of your data, including objecting to direct marketing at any time;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent.

To use any of these rights, email office@ancestralsuperfoods.co.uk. We will reply within one month and will not charge a fee in most cases. You can unsubscribe from marketing using the link at the bottom of any of our emails.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.

8. Cookies

Cookies are small files stored on your device. We use:

• Strictly necessary cookies: to run the shopping basket, checkout, login and security. These do not need consent.
• Analytics cookies: to understand how visitors use the website (for example Google Analytics and Shopify analytics).
• Marketing cookies: to show you relevant adverts and measure them (for example Meta Pixel and Google Ads).

We only set analytics and marketing cookies if you accept them in our cookie banner. You can change your choice at any time using the cookie settings link on the website or by clearing cookies in your browser.

9. Security

The website uses encrypted (HTTPS) connections, and our providers use industry-standard security. Access to personal data is limited to people who need it to do their job.

10. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.