Privacy, plainly set out.

1. Scope and controller

This Privacy Policy explains how Sornevo Health Ltd, of 47 Briggate, Leeds, LS1 6HJ, collects, uses, stores and shares personal data in connection with sornevo.info and the sale of B Complex Max. It applies to anyone who browses the site, submits an order request, speaks to us by phone during order confirmation, or otherwise contacts our customer service team. Sornevo Health Ltd is the data controller for the purposes of the UK GDPR and the Data Protection Act 2018, meaning we decide how and why your personal data is processed rather than acting on behalf of another organisation. If you have any questions about this policy, our contact details are set out throughout this page and repeated in section 12.

2. Data we collect

We collect the personal data you actively provide through our order-request form, principally your full name, telephone number, delivery address and postcode, together with any delivery notes you choose to add. When one of our team calls to confirm your order, we may take a brief written note of that call, such as the confirmed delivery date or a note that the order was cancelled at your request. We also collect limited technical information automatically as you browse, including your IP address, browser type, device type and the pages you view, some of which is gathered only with your consent through cookies as described in section 7. The order form includes a hidden honeypot field designed to catch automated spam submissions; this field is not intended to be completed by genuine visitors and any data submitted through it is discarded automatically.

3. Legal bases for processing

We process your order information because it is necessary to take steps you request before entering into a contract with us and subsequently to perform that contract, in accordance with Article 6(1)(b) of the UK GDPR. We rely on consent, given through our cookie banner, for optional analytics and marketing cookies, and that consent can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. We may also rely on our legitimate interests under Article 6(1)(f) for activities such as fraud prevention, network security and handling general enquiries, having considered and balanced those interests against your right to privacy in each case. We do not process any special category data, such as health data about you personally, through the ordinary operation of this website.

4. Retention periods

Order records, including name, address, phone number and transaction details, are retained for seven years from the date of the order to satisfy our recordkeeping obligations under the Companies Act 2006 and HMRC guidance on business records. Unsuccessful or abandoned order requests that never proceed to dispatch are deleted or anonymised within ninety days unless a complaint or legal matter requires a longer period. General customer service correspondence that does not relate to a completed order is kept for two years, technical security logs are retained on a rolling ninety-day basis, and cookie consent records are kept for the lifetime of the relevant cookie, typically up to twelve months, so that we can demonstrate compliance with your recorded preference.

5. Your rights and how to exercise them

You have the right to request confirmation of whether we process your personal data and to obtain a copy of it, the right to have inaccurate data corrected, the right to have data erased where it is no longer needed or where you withdraw consent, the right to restrict processing in certain circumstances, the right to object to processing based on legitimate interests, and the right to data portability where processing is based on consent or contract and carried out by automated means. To exercise any of these rights, email [email protected] or write to Sornevo Health Ltd, 47 Briggate, Leeds, LS1 6HJ, marking your request "Data Protection Query". We will acknowledge your request within five working days and provide a full response within one calendar month, extendable by a further two months for complex requests, in which case we will explain the reason for the delay in writing.

6. Named third-party processors

We share personal data with a defined and limited set of processors who help us run the business. Courier partners Evri and DPD receive your name, delivery address and phone number to deliver your parcel and to collect any return, acting as independent controllers once the parcel is in their custody. Our website is hosted on infrastructure provided by Vercel Inc., which stores order-request submissions securely before they reach our internal systems. Where a card payment is taken by a courier driver at the point of delivery, that payment is processed through the courier's own payment terminal provider and never passes through sornevo.info. We do not sell personal data to any third party, and we do not share your data with anyone for their own independent marketing purposes without your separate, explicit consent.

7. Cookies and similar technologies

sornevo.info uses a strictly necessary session cookie named sornevo_session, which lasts only for the duration of your browsing session and supports basic navigation and security; this cookie does not require consent because the site could not function reliably without it. A preference cookie named cookie_consent, lasting twelve months, remembers whether you have already responded to our cookie banner. If you actively opt in through the Cookie Settings option, an analytics cookie may be set for up to thirteen months to help us understand general visiting patterns, and a marketing cookie may be set for up to six months to support limited advertising measurement; neither is active until you consent, and both can be withdrawn at any time. Full detail on each cookie, including its purpose and provider, is set out in our separate Cookie Policy.

8. International transfers

Our courier deliveries and phone-confirmation calls take place entirely within the United Kingdom, so most personal data connected with a physical order does not leave the UK. Our website hosting provider, Vercel Inc., operates global infrastructure and may process data, including order-request submissions, on servers located outside the United Kingdom, including in the United States and the European Economic Area, as part of its ordinary content-delivery operations. Where this occurs, the transfer is carried out under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or under an equivalent safeguard recognised by UK data protection law, so that your personal data continues to receive a level of protection broadly equivalent to that required under the UK GDPR.

9. Security measures

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including encrypted transmission of order-form submissions, access controls limiting which staff can view customer records, and regular review of our processors' own security commitments. No system can be considered fully secure completely secure, and we ask that you also take reasonable precautions, such as keeping any account or email credentials confidential, when communicating with us. If we become aware of a personal data breach that presents a risk to your rights and freedoms, we will notify the Information Commissioner's Office within the statutory 72-hour window where required, and will notify affected individuals directly where the risk to them is high.

10. Children's data

sornevo.info is intended for use by adults, and B Complex Max is not marketed to or intended for purchase by children. We do not knowingly collect personal data from anyone under the age of 18 through our order-request form, and if we become aware that a minor has submitted personal data to us, we will delete that data promptly and, where an order has already been placed, will not proceed with dispatch until an adult has confirmed the order by phone.

11. Automated decision-making

We do not use your personal data for any automated decision-making, including profiling, that produces legal effects concerning you or that similarly significantly affects you. Every order placed through sornevo.info is confirmed by a human member of our team by telephone before dispatch, which means a person, not an algorithm, makes the final decision to proceed with any order.

12. Complaints and contact procedure

If you have any concern about how your personal data has been handled, please contact us first at [email protected] or by telephone on +44 113 289 4708 during our working hours of Monday to Friday, 9:00 to 17:30, so that we have the opportunity to investigate and resolve the matter directly; we aim to respond to any privacy-related complaint within one calendar month of receipt. If you remain unsatisfied after our internal review, you have the right to lodge a complaint with the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, without needing our permission to do so first.

13. Changes to this policy

We review this Privacy Policy periodically to ensure it remains accurate and reflects our current practices and legal obligations. Material changes will be reflected in the revision log below and, where appropriate, highlighted on this page for a reasonable period following publication. We encourage you to review this page from time to time, particularly before placing a new order, so that you remain aware of how your data is handled.

14. Revision and change log

This Privacy Policy is provided in connection with the sale of B Complex Max, a food supplement. It does not constitute legal advice.