Privacy Policy

Last updated: 23 July 2026

1. Who we are

ExtolX Limited (company number 17314659) is the controller of the personal information described in this notice. Our registered office is 44 Hillcrest Avenue, Ingol, Preston, England, PR2 3UP.

2. Information we collect

Depending on how you interact with us, we may collect:

identity and contact details, including name, organisation, billing and delivery addresses, email address and telephone number;
account and eligibility information, including confirmation that you are at least 18 and information used to assess whether an order is appropriate;
order, payment and transaction information (we do not normally receive complete payment-card or bank-login credentials from payment providers);
communications, complaints, returns and product-safety reports;
technical and usage information, including IP address, device, browser, cookie and advertising identifiers, referral source, website activity, product interactions and conversion events;
address-search information entered into the checkout address-autocomplete feature;
marketing preferences; and
information required to prevent fraud, protect safety or comply with law.

Please do not send us health information or information about intended human use. Our products are supplied only for legitimate laboratory research and are not for human or veterinary use.

3. Why we use information and our lawful bases

We use personal information:

to create accounts, process orders, take payment, deliver products and provide customer service, because this is necessary to perform a contract or take requested pre-contract steps;
to verify eligibility, prevent misuse and fraud, maintain security, keep appropriate transaction and product-traceability records, and establish or defend legal claims, based on our legitimate interests and legal obligations;
to handle safety reports, recalls and regulatory enquiries, to comply with legal obligations and protect legitimate interests;
to maintain tax, accounting and corporate records, to comply with legal obligations;
to send requested service messages and, where permitted, marketing communications, based on consent or legitimate interests as applicable; and
to measure website use, product interactions, advertising performance and conversions through Google Analytics and Google Ads. We rely on consent for non-essential cookies and similar storage. Where Google consent mode sends limited cookieless measurement signals before consent, we rely on our legitimate interests in obtaining aggregated service and campaign measurements, subject to appropriate minimisation and your rights.

Where we rely on legitimate interests, we consider the necessity of the processing and its impact on individuals. You may object as explained below.

4. Sources

We obtain information from you, your organisation, website technology, payment and delivery providers, fraud-prevention services and publicly available business sources where appropriate.

5. Sharing information

We may share information with:

Hostinger, which provides our website and email hosting, website backups and associated infrastructure and security services. Customer accounts, WooCommerce orders, SureForms submissions and business email may be stored or processed on Hostinger systems. Hostinger's privacy information is available at https://www.hostinger.com/uk/legal/privacy-policy;
Wallid, which provides our Pay-by-Bank checkout and payment service. When you choose Wallid, it and participating banking or open-banking providers may receive identity, contact, order, account and transaction information needed to initiate, authenticate, reconcile or refund the payment, prevent fraud and comply with law. Wallid's privacy information is available at https://wallid.co/privacy-policy;
Starling Bank, which provides our business bank account and receives payer, payee, account, reference and transaction information when a payment or refund is made by manual bank transfer. Starling's privacy information is available at https://www.starlingbank.com/legal/privacy-notice/;
Royal Mail, which receives recipient name, delivery address, contact details where needed, parcel and tracking information in order to deliver, return and trace orders and handle delivery claims. Royal Mail's privacy information is available at https://www.royalmail.com/privacy-notice;
Cloudflare, which provides Turnstile protection on our forms and processes technical, device and interaction information to distinguish legitimate visitors from automated or abusive traffic. Cloudflare's privacy information is available at https://www.cloudflare.com/privacypolicy/;
Google, which provides Google Analytics, Google Ads conversion measurement, Google for WooCommerce and Google Places address autocomplete. Depending on your choices and use of the site, Google may receive IP address, device and browser information, cookie or advertising identifiers, page and product interactions, referral and ad-click information, conversion events, and address-search text entered into autocomplete. Google tags operate using consent mode and non-essential storage should remain denied until you consent. Google's privacy information is available at https://policies.google.com/privacy?gl=uk&hl=en-GB;
WhatsApp and Meta companies, when you choose to contact us through WhatsApp. WhatsApp processes your telephone number, account and device information, communications metadata and other information under its own terms and privacy policy. Messages are end-to-end encrypted in transit, but information you send is also received and retained by ExtolX as correspondence. WhatsApp's UK privacy information is available at https://www.whatsapp.com/legal/privacy-policy-uk;
Brainstorm Force US LLC, the provider of the SureForms software, if information is sent to it through an enabled cloud feature, diagnostic or support request. Ordinary form submissions are intended to be stored on our Hostinger-hosted WordPress website and delivered to our Hostinger-hosted email account. SureForms' privacy information is available at https://sureforms.com/privacy-policy/;
WPManageNinja/FluentSMTP, which provides the software used to route and log transactional website email. Email metadata and content are processed through our configured Hostinger SMTP service, and local email logs are retained on our hosted website for 14 days. The plugin is currently configured to share limited non-sensitive diagnostic or usage information with its provider. FluentSMTP's privacy information is available at https://fluentsmtp.com/privacy-policy/;
insurers, testing laboratories, legal advisers and other professional advisers where their services require the information;
regulators, law-enforcement bodies, courts and public authorities where required or appropriate; and
a buyer, investor or adviser involved in a proposed sale or reorganisation of our business.

WordPress, WooCommerce, CartFlows and related checkout, cart, pricing and shipping extensions are software used to operate our hosted website and shop. Order and interaction information used by these tools is primarily stored on our Hostinger-hosted website. Their developers may receive limited diagnostic, licence, update or support information where an optional service, telemetry or support feature is enabled.

CookieYes provides the consent banner and preference controls used on our website. We currently use its free native WordPress mode without connecting the website to a CookieYes cloud account. Consent preferences are stored in the visitor's browser rather than in CookieYes cloud consent logs. If we connect the cloud service later, we will update this notice before or when that processing begins, as required.

We do not currently use an external warehouse, fulfilment provider, label-printing provider or accountant. Our overseas product supplier does not receive customer information. If this changes, we will update this notice before or when the new processing begins, as required.

We do not sell personal information.

6. International transfers

Some suppliers may process information outside the UK. Before using such suppliers, we will put an appropriate UK transfer mechanism in place where required and assess relevant protections. Contact us for information about safeguards applying to a particular transfer.

7. Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this notice. Our standard periods are:

order, invoice, payment, tax and accounting records: normally six years after the end of the relevant company financial year;
active customer account information: while the account remains active and normally for two years after the customer's last activity;
routine customer-service correspondence: normally two years after the matter is resolved;
returns, refunds, contractual complaints, chargebacks and associated fraud records: normally six years after the matter is resolved;
product batch, supplier and traceability records: normally ten years after the final sale of the relevant batch, where retaining identifiable customer information remains necessary for product-safety, recall, legal or regulatory purposes;
product-safety incidents, recalls and serious product complaints: normally ten years after the matter is closed, or longer where required by a regulator, an investigation or applicable law;
completed customer eligibility records: while the account remains active and normally for two years afterwards;
rejected eligibility applications: normally 12 months after the decision;
incomplete shopping-basket information: normally between 30 and 90 days;
general website and security logs: normally 90 days, unless they are required for a security investigation, fraud prevention or legal claim;
contact-form enquiries that do not result in a customer relationship: normally 12 months after the last contact;
transactional email logs stored by our website: 14 days;
marketing-consent evidence: while we send marketing and normally for six years afterwards where needed to demonstrate compliance;
marketing suppression records: for as long as needed to ensure that we continue to respect an objection or opt-out, using only the minimum information required;
cookie-consent preferences stored in the visitor's browser: 180 days from the most recent choice. We do not currently maintain CookieYes cloud consent logs; and
analytics information: according to the settings described in our Cookie Policy and normally no longer than 26 months.

The applicable period may be longer where information is needed for an active complaint, legal claim, safety incident, recall, regulatory investigation or other legal obligation. When identifiable information is no longer required, we delete or anonymise it. We periodically review retained information and may apply a shorter period where it is no longer necessary.

8. Your rights

Subject to applicable conditions, you may ask us to access, correct, erase or restrict your information, receive portable information, or object to processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may also object at any time to direct marketing.

Contact info@extolx.co.uk to exercise a right. We may need to verify your identity.

You may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. We would appreciate the opportunity to address your concern first.

9. Marketing

We will follow UK rules applicable to the recipient and communication method. Marketing emails will identify us and provide an unsubscribe method. Service messages necessary for an order are not marketing, although we will not add promotional content in order to bypass marketing rules.

10. Security and automated decisions

We use proportionate organisational and technical measures to protect information. No internet service is completely secure.

We do not currently make decisions producing legal or similarly significant effects based solely on automated processing.

11. Changes

We may update this notice when our services, suppliers or legal obligations change. The current version will appear on our website with its update date.