Privacy policy
Last updated: 18 July 2026
This Privacy Policy explains how INSTANT GP LIMITED ("we", "us", "our"), trading as MendSupps, collects and uses personal data when you visit mendsupps.com ("the Site") or buy products from us.
We are a "controller" of your personal data for the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
1. Who we are
- Legal entity: INSTANT GP LIMITED
- Companies House number: 15894238 (registered in England & Wales)
- Registered office: 30 Stratford Road, Wolverton, Milton Keynes, MK12 5LW, United Kingdom
- Contact: support@mendsupps.com
- ICO registration number: [TO BE ADDED ONCE REGISTERED, ico.org.uk]
2. What personal data we collect
We collect the following categories of personal data:
| Category | Examples | When we collect it |
|---|---|---|
| Identity & contact | Name, billing address, delivery address, email, phone (if you provide one) | When you place an order, create an account, contact support, or subscribe to our newsletter |
| Transaction | Items ordered, order value, order date, dispatch & delivery status | When you place an order |
| Payment | Last 4 digits of card, card brand, billing postcode (full card details are handled by Shopify Payments / our payment processor and never touch our servers) | At checkout |
| Account credentials | Login email and Shopify-managed authentication tokens | If you create a customer account |
| Communications | Emails and messages between you and us, including support tickets and newsletter preferences | When you write to us or interact with our emails |
| Technical | IP address, device type, browser, referring URL, pages viewed, basic analytics about how you use the Site | Automatically when you visit (subject to your cookie choices, see Section 8) |
We do not knowingly collect data from anyone under the age of 16. If you believe we hold data about a child, contact us and we will delete it.
We do not collect "special category" data (e.g. health information). Our products are food supplements, please consult a qualified clinician before use if you have a medical condition. Any clinical correspondence is handled separately by Mend Clinic, not MendSupps.
3. Why we use your data and the lawful basis
Under UK GDPR Article 6, every processing activity must have a lawful basis. Ours are:
| Purpose | Lawful basis |
|---|---|
| Processing your order, taking payment, arranging delivery, issuing receipts | Performance of a contract (Art. 6(1)(b)), necessary to fulfil our sale agreement with you |
| Customer support and handling returns | Performance of a contract and our legitimate interests in providing good service (Art. 6(1)(f)) |
| Sending order-related transactional emails (confirmation, dispatch, refund) | Performance of a contract |
| Sending marketing emails (newsletter, restock alerts) | Consent (Art. 6(1)(a)), given when you sign up; you can withdraw at any time via the "unsubscribe" link in every email |
| Fraud prevention and securing the Site | Legitimate interests in protecting our business and customers |
| Complying with tax, accounting and consumer-law obligations | Legal obligation (Art. 6(1)(c)) |
| Analytics (aggregated, where consent given) | Consent via the cookie banner |
4. Who we share your data with
We share personal data only with parties that help us run the shop:
- Shopify Inc., our e-commerce platform host, processes orders and payments on our behalf
- Shopify Payments (and any alternative payment provider), card processing
- Royal Mail / DPD / other carriers, delivery (name and address only)
- Email service provider (Shopify Email / Klaviyo / Mailchimp, confirm and update), for transactional and marketing emails you've consented to
- Accountants and HMRC, for tax and statutory reporting
- Professional advisers (legal, insurance), only where strictly necessary
- Law enforcement or regulators, where required by law
We do not sell your personal data. We do not share it for third-party advertising.
5. International transfers
Some of the processors listed above (notably Shopify) may store or process data outside the UK. Where this happens, transfers are protected by:
- UK adequacy decisions (e.g. for the EU/EEA, or where the destination country has an adequacy regulation), or
- Standard Contractual Clauses with the UK International Data Transfer Addendum, or
- The recipient's own certification (e.g. UK Data Bridge for the US).
You can request a copy of the safeguards in place by emailing support@mendsupps.com.
6. How long we keep your data
- Order and tax records: 6 years from the end of the relevant financial year (HMRC requirement)
- Customer account data: until you ask us to delete it, or after 5 years of inactivity (whichever is sooner)
- Marketing list: until you unsubscribe
- Support correspondence: up to 3 years after the matter is closed
- Anonymous analytics: up to 26 months
Anonymous, aggregated data may be kept indefinitely.
7. Your rights under UK GDPR
You have the right to:
- Be informed about how we use your data (this notice)
- Access the data we hold about you (a "subject access request")
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten") where the lawful basis no longer applies
- Restrict processing in certain circumstances
- Data portability, receive your data in a machine-readable format
- Object to processing based on legitimate interests, including direct marketing
- Withdraw consent at any time where we rely on it (e.g. marketing)
To exercise any of these rights, email support@mendsupps.com. We will respond within one calendar month. There is no fee unless the request is manifestly unfounded or excessive.
Complaints: if you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
8. Cookies and similar technologies
We use a small number of cookies and similar technologies:
- Strictly necessary, required for the Site, cart and checkout to function. These do not need consent.
- Functional, remember your preferences (e.g. region, login).
- Analytics, help us understand site usage. Only set if you accept them via our cookie banner.
- Marketing, used to measure the effectiveness of any campaigns. Only set with your consent.
You can change your cookie choices at any time using the cookie banner shown on first visit, or by clearing your browser cookies and revisiting the Site. For more detail see our Cookie Policy.
9. Security
We take appropriate technical and organisational measures to protect your data. The Site is served over HTTPS; payment data is handled by PCI-DSS compliant providers and is not stored by us. No internet transmission is 100% secure, if you suspect unauthorised access to your account, contact us immediately.
10. Automated decision-making
We do not make decisions about you that have a legal or similarly significant effect by purely automated means.
11. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be flagged on the Site or by email where appropriate.
12. Contact us
INSTANT GP LIMITED (trading as MendSupps)
30 Stratford Road, Wolverton, Milton Keynes, MK12 5LW, United Kingdom
Email: support@mendsupps.com