Privacy Policy

B FUTURE INNOVATION UK LTD is the Data Controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

• Registered Address: 114 Hope Street, Sheerness, England, ME12 1QD
• Company Registration: 15978560
• ICO Registration Reference: ZB598412
• Data Protection Officer / Privacy Team: parth.mehta@bfuturecompany.uk

We collect only the personal information strictly necessary to provide our botanical products and services:

• Identity & Contact Data: First name, last name, email address, telephone number, billing address, and UK shipping address with postcode.
• Order & Transaction Data: Products ordered, order reference numbers, purchase amounts in GBP integer pence, delivery preferences, and payment provider confirmation references.
• Technical & Usage Data: IP address, browser type and version, device information, operating system, and time zone setting.
• Customer Support Data: Communications with our customer care team, complaint records, and product reviews.
• Marketing & Consent Preferences: Opt-in records for email/SMS promotions, timestamp of consent, and unsubscribe requests.

Under Article 6 of the UK GDPR, we process your data under the following lawful bases:

1. 1
   Contractual Performance: To process orders, manage checkout, arrange Royal Mail or DPD shipping, and provide customer support.
2. 2
   Legal Obligation: To calculate HMRC VAT, maintain statutory accounting and tax records for 6 years, and comply with UK consumer rights regulations.
3. 3
   Legitimate Interests: To prevent payment fraud, safeguard site security, and optimize platform performance.
4. 4
   Explicit Consent: For optional email/SMS marketing newsletters and non-essential analytical cookies (which can be withdrawn at any time).

We do not sell, rent, or trade your personal data. We share data only with verified sub-processors required to fulfill our contractual commitments:

• Payment Processors: Stripe Payments UK Ltd & PayPal (Europe) S.à r.l. (PCI-DSS compliant payment processing).
• Delivery Carriers: Royal Mail Group Ltd & DPD (UK) Ltd (for parcel dispatch, tracking, and SMS delivery updates).
• Transactional Email & Hosting: Secure UK/EU data centers with encryption in transit (TLS 1.3) and at rest (AES-256).

All primary customer data is stored within the United Kingdom and the European Economic Area (EEA). If any sub-processor transfers data outside the UK/EEA, adequate safeguards (such as the UK International Data Transfer Agreement or Standard Contractual Clauses) are enforced.

• Order & Accounting Records: 6 years in accordance with UK HMRC statutory accounting regulations.
• Customer Account Data: Kept active until you request account deletion or after 3 years of inactivity.
• Marketing Consent Records: Retained until consent is withdrawn.
• Customer Complaints: 3 years following final resolution.

You have the right to:

1. 1
   Access: Request a copy of the personal data we hold about you (Subject Access Request).
2. 2
   Rectification: Request correction of inaccurate or incomplete personal information.
3. 3
   Erasure ("Right to be Forgotten"): Request permanent deletion of your data where no overriding legal obligation exists.
4. 4
   Restriction & Objection: Object to processing based on legitimate interests or direct marketing.
5. 5
   Data Portability: Request structured transfer of your personal data.

To exercise any of these rights, contact our Data Protection Team at parth.mehta@bfuturecompany.uk. We respond within 30 calendar days free of charge.

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk | Helpline: 0303 123 1113
• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.