Privacy Policy: How MyHerbaStore UK Uses Personal Data
This Privacy Policy explains how MyHerbaStore UK (myherbastore.co.uk), run by Maide Dilan, a Herbalife Independent Member, collects and uses personal data when customers browse the website, place an order or send an enquiry. Personal data is used to process orders, take payment, arrange delivery, answer questions and meet legal obligations. It is shared only with providers needed for those purposes, such as Herbalife’s UK fulfilment service, delivery carriers and payment providers, and it is not sold. UK data protection law gives customers the right to access, correct, delete and move their data, and to complain to the Seller or to the Information Commissioner’s Office (ICO).
1. Who is responsible for personal data?
| Controller | Maide Dilan, Herbalife Independent Member, trading as MyHerbaStore UK |
|---|---|
| Postal address | Bahcivan Mah. Nurbaba Sk. B Blok No:16/31, Ipekyolu, Van, Turkey 65130 |
| Email for privacy requests | info@myherbastore.co.uk |
| Phone | +90 544 292 36 32 |
In this policy, “the Seller” means Maide Dilan and “you” means a visitor or customer. The Seller decides why and how personal data collected through this website is used. This policy applies UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). Details about the Seller are on the About Us page and the Contact page.
2. What personal data is collected, why, and for how long?
| Purpose | Personal data | Lawful basis (UK GDPR) | Kept for |
|---|---|---|---|
| Orders and delivery | Name, delivery and billing address, email address, phone number, order details | Contract: needed to supply the goods ordered | 6 years from the order date, for legal claims and accounting |
| Payment | Payment status and transaction reference. Card details are entered with the payment provider and are handled by that provider | Contract; legitimate interests in preventing fraud | 6 years |
| Enquiries and customer service | Name, email address, message, order number | Legitimate interests in answering enquiries; contract where the enquiry is about an order | 12 months after the last message |
| Cancellations, returns, refunds and complaints | Order details, correspondence, refund details | Contract; legal obligation | 6 years |
| Tax, accounting and legal obligations | Order and payment records | Legal obligation | The period required by tax and accounting law |
| Website security and operation | IP address, browser and device information, pages visited | Legitimate interests in keeping the website secure and working | Up to 12 months |
| Marketing emails, only where requested | Name, email address | Consent, or the PECR soft opt-in for existing customers | Until the person unsubscribes |
| Analytics and advertising cookies | Cookie identifiers, device information | Consent | As set out in section 6 |
Providing personal data for an order is necessary to complete it. If the details needed for delivery or payment are not provided, the order cannot be fulfilled. The Seller does not make decisions about individuals based solely on automated processing.
3. Where does personal data come from?
- From customers directly, when they place an order, create an account, use the contact form or send an email.
- Automatically, from the device used to visit the website, through the website software and cookies.
- From payment providers and delivery carriers, which confirm payment and delivery status.
4. Who receives personal data?
- Herbalife and delivery carriers. Orders are fulfilled from the Herbalife warehouse in the UK, so the recipient’s name, delivery address, phone number and order contents are shared with Herbalife’s fulfilment service and the carrier that delivers the parcel.
- Payment providers and banks, including iyzico, to process payments, issue refunds and check for fraud.
- Website hosting, email and IT providers, which store the website data and send order emails.
- Advertising and analytics providers, such as Google, only for cookies that a visitor accepts in the cookie banner.
- Professional advisers and authorities, such as accountants and lawyers, and tax authorities, courts or regulators where the law requires it.
The Seller does not sell personal data. Recipients that act for the Seller may use personal data only to provide their service. Other recipients may have their own privacy notices.
5. Is personal data sent outside the UK?
The Seller is located in Turkey, so personal data collected through this website is accessed and stored in Turkey, and some providers process data in other countries. Turkey is not covered by UK adequacy regulations. Where UK law requires safeguards for sending personal data outside the UK, the Seller puts an appropriate safeguard in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or relies on a UK adequacy decision. More information about these safeguards is available on request.
6. How are cookies used?
- Strictly necessary cookies keep the shopping basket and checkout working and protect the website. They do not need consent.
- Preference cookies remember choices, such as whether the cookie notice has been accepted.
- Analytics and advertising cookies are set only after a visitor accepts them in the cookie banner. They can be changed or withdrawn at any time through the cookie settings on the website or in the browser.
7. When are marketing emails sent?
Marketing emails are sent only to people who have asked to receive them, or to existing customers about similar products where they were offered a simple way to opt out when their details were collected. Every marketing email includes an unsubscribe link. Order and delivery emails are service messages, not marketing.
8. What rights do individuals have?
Under UK data protection law, individuals have the right to:
- ask for a copy of their personal data (access);
- ask for incorrect data to be corrected (rectification);
- ask for data to be deleted (erasure), where the law allows it;
- ask for use of data to be limited (restriction);
- receive data in a portable format, where it was provided under a contract or consent (portability);
- object to use of data based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, without affecting earlier use.
Requests are made by email to info@myherbastore.co.uk, with “Data protection request” in the subject line. The Seller replies within one month, does not charge a fee in normal cases and may ask for proof of identity. Some records, such as tax and accounting records, must be kept even after a deletion request.
9. How can a data protection complaint be made?
A complaint can be sent to the Seller at info@myherbastore.co.uk with “Data protection complaint” in the subject line. The Seller acknowledges complaints within 30 days, investigates without undue delay, keeps the complainant informed and gives the outcome. Complaints can also be made at any time to the ICO, the UK data protection regulator, at ico.org.uk/make-a-complaint, or by phone on 0303 123 1113.
10. How is personal data kept secure?
The website is served over HTTPS, payment card details are handled by the payment provider rather than stored by the Seller, and access to order data is limited to people who need it. No method of transmission or storage is completely secure, so the Seller cannot guarantee absolute security.
11. Is the website for children?
No. Purchases are for people aged 18 or over, as set out in the Terms and Conditions, and the Seller does not knowingly collect personal data from children.
12. Can this policy change?
The Seller may update this policy, for example when providers or practices change. The latest version is always on this page, with the date of the update shown below. Significant changes affecting existing customers are communicated by email.
Last updated: 22 October 2026.