This policy is not final. It still contains template fields that will be completed before Lot 001 ships. Anything in square brackets below is a placeholder, not a statement of fact. For anything you need confirmed in the meantime, contact us and we will answer directly.
Outstanding on this page: LEGAL ENTITY NAME · REGISTERED ADDRESS.
Legal
Privacy policy
Last updated August 17, 2026
What personal data we collect when you shop with us, why we have it, who else touches it, and what you can require us to do with it.
Who controls your data
[LEGAL ENTITY NAME] of [REGISTERED ADDRESS] is the controller of personal data collected through this store. For anything in this policy, write to privacy@cofactorsupply.com and a person will answer.
What we collect
What you give us. To fulfil an order: your name, delivery and billing address, email address and, if you provide one, a phone number for the carrier. If you contact us, whatever you put in the message. If you create an account, your login details.
What we never see. Your full payment card number. Card details are entered with our payment processor and never reach our servers.
What is collected automatically. Our CDN records the IP address and approximate country of each request in short-lived logs, for delivery and abuse prevention. Our host keeps standard server logs. That is the whole of it: this site sets no analytics cookie, loads no advertising pixel, and runs no third-party script on any page.
Why we use it, and on what legal basis
Where the UK GDPR or EU GDPR applies to you, these are our purposes and our lawful bases:
| Why | Legal basis |
|---|---|
| Take payment and dispatch your order | Performance of our contract with you |
| Answer support messages about an order | Performance of our contract with you |
| Keep tax, accounting and customs records | Compliance with a legal obligation |
| Prevent fraud, abuse and chargebacks | Our legitimate interest in operating a store that is not defrauded |
| Keep the site up and defend it against attack | Our legitimate interest in a secure and available service |
| Send marketing email | Your consent, which you can withdraw at any time |
Marketing
We only send marketing email to people who asked for it. Every one carries an unsubscribe link that works immediately and without conditions. Unsubscribing does not affect the transactional email about an order you have placed, which we have to send you.
Where your data goes
We operate from the United States and our processors are listed above with the regions they operate in. If you are in the UK, the EEA or Switzerland, that means your data is transferred outside your country. Where a transfer needs a safeguard, it is made under the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses. Ask privacy@cofactorsupply.com for a copy of the relevant one.
How long we keep it
Order records: 7 years, because tax and accounting law requires it. Account data: until you ask us to delete it. Marketing data: until you unsubscribe. CDN and server logs: days, not months.
A deletion request removes what we are free to remove. It cannot remove an invoice we are legally required to keep, and we will tell you plainly if that applies to you.
Adverse event reports
If you report a reaction to a product, we keep what you told us together with the order and lot it relates to. We are required to retain those records and to make them available to a regulator on request. We do not use them for marketing, we do not share them with anyone else, and we will never publish one.
How we protect it
The site is served over TLS. Access to the store admin is restricted and credentialled. Card data never touches our systems. We are a small company and we do not pretend to have a security operations centre — but we do not collect what we do not need, which is the control that actually reduces the damage a breach can do.
If a breach affects your personal data and presents a risk to you, we will tell you and the relevant regulator within the time the law requires.
Your rights
Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent you previously gave.
Email privacy@cofactorsupply.com. We will ask enough to be sure it is you — usually the email address on the order — and we will answer within one month, which is the limit the UK and EU GDPR set. Exercising a right never costs you anything and never affects the service you get.
If you are in the UK, the EEA or Switzerland and you are unhappy with our answer, you may complain to your data protection authority. If you are in the United States, see your privacy choices for the state-specific rights and how to use them.
Cookies
This site sets only the cookies the cart, checkout and login cannot work without — no analytics, no advertising, no third-party trackers. Every one is named and explained on our cookie policy.
Children
This store is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, tell privacy@cofactorsupply.com and we will delete it.
Changes to this policy
When this policy changes we update the date at the top. If a change materially affects your rights we will do more than that — we will tell the people it affects.
Contact
Privacy questions and rights requests: privacy@cofactorsupply.com. Anything else: support@cofactorsupply.com. Post: [LEGAL ENTITY NAME], [REGISTERED ADDRESS].