Legal

Privacy Policy

This policy explains, in plain terms, what personal data Talvena Wellness Ltd collects when you visit talvena.world or order Elderberry Zinc, why we collect it, how long we keep it, and how you can exercise your rights under the UK General Data Protection Regulation and the Data Protection Act 2018.

Last updated: 5 June 2026. Controller: Talvena Wellness Ltd, Company No. 14692038, 33 High Street, Bristol, BS1 2AW, United Kingdom.

1. Scope of this policy

This privacy policy applies to every visitor, browser, and customer who interacts with talvena.world, whether by reading a page, submitting the order form, telephoning our Bristol office, or emailing [email protected]. It covers all personal data processed in connection with the sale and delivery of Elderberry Zinc, including data gathered before an order is placed, during the pay-on-delivery confirmation call, and after the parcel has been delivered. It does not cover the practices of independent third-party websites that we may link to, such as Companies House or the Information Commissioner's Office, which maintain their own separate privacy notices. Where we refer to "we", "us" or "Talvena" in this document, we mean Talvena Wellness Ltd acting as the data controller for the purposes of UK data protection law.

2. Who we are and how to contact us

Talvena Wellness Ltd is a private limited company registered in England and Wales under Company No. 14692038, with its registered office and trading address at 33 High Street, Bristol, BS1 2AW, United Kingdom. We are registered for VAT under number GB 718 0084 19. For any privacy-related question, correction request, or concern, you can write to us at the address above, telephone +44 117 289 4607 during our office hours of Monday to Friday, 9:00 to 17:30, or email [email protected] with the subject line "Privacy Enquiry". We have not appointed a statutory Data Protection Officer because our processing activities do not meet the thresholds set out in Article 37 of the UK GDPR, but a named member of staff is responsible for data protection matters and can be reached through the same contact channels.

3. Personal data we collect

We collect the minimum personal data necessary to fulfil an order placed on a pay-on-delivery basis. Through the order form on the homepage we collect your full name, your telephone number and selected country code, and your explicit consent to our Privacy Policy and Terms of Use, together with a hidden honeypot field that is left blank by genuine customers and is used only to detect automated spam submissions. During the confirmation telephone call our customer service team may additionally note your delivery address, any preferred delivery instructions, and the outcome of the call, such as confirmed, rescheduled, or cancelled. If you contact us by email or telephone outside the order process, we retain the content of that correspondence, your contact details, and any account or order reference you provide. Our web server and analytics tooling also automatically log technical information such as your approximate location derived from your IP address, browser type, device type, referring page, and the pages you view, none of which is used to identify you individually.

4. Legal basis for processing

We rely on several lawful bases depending on the purpose of the processing, in accordance with Article 6 of the UK GDPR. Processing your name, telephone number and address to take, confirm and deliver your order is necessary for the performance of a contract to which you are a party, namely the sale of Elderberry Zinc on pay-on-delivery terms. Recording the outcome of confirmation calls and maintaining fraud-prevention measures, including the honeypot field, is carried out on the basis of our legitimate interest in preventing fraudulent orders and protecting our business and genuine customers. Where you voluntarily contact us with a query, we process your message on the basis of legitimate interest in responding to correspondence, or on the basis of your consent where you have specifically requested further information. Any processing connected with statutory obligations, such as retaining transaction records for tax purposes, is carried out to comply with a legal obligation under UK tax and accounting law.

5. Data retention periods

We do not keep personal data for longer than is necessary for the purpose it was collected for. Order and delivery records, including your name, telephone number, delivery address and transaction value, are retained for six years from the end of the relevant financial year, in line with record-keeping obligations under the Companies Act 2006 and HM Revenue and Customs guidance on VAT and business records. Correspondence sent to [email protected] that does not result in an order is retained for a maximum of 24 months from the date of the last message, after which it is permanently deleted unless a longer period is required to resolve an ongoing dispute or complaint. Cookie consent records are kept for 12 months, matching the validity period of your consent choice, after which you will be asked to confirm your preferences again. Call notes taken during pay-on-delivery confirmation calls are retained for the same six-year period as order records, since they form part of the order fulfilment history.

6. Your rights under UK GDPR

As a UK data subject you have the right to request access to the personal data we hold about you, to request that inaccurate data be corrected, and to request erasure of your data where it is no longer necessary for the purpose it was collected or where you withdraw consent. You also have the right to request that we restrict processing in certain circumstances, to object to processing based on legitimate interest, and to receive a copy of data you have provided to us in a structured, commonly used, machine-readable format so that it can be transferred to another controller. To exercise any of these rights, email [email protected] or write to Talvena Wellness Ltd, 33 High Street, Bristol, BS1 2AW, quoting your name and telephone number so that we can locate your records. We aim to acknowledge every rights request within 5 working days and to provide a full response within one calendar month, as required by the UK GDPR, extending this by up to two further months for complex requests where we will explain the reason for the delay.

7. Third-party processors and recipients

We share personal data only with processors who need it to help us run our business and deliver your order, and we have written agreements in place with each of them that require appropriate security and confidentiality safeguards. Our website is hosted on infrastructure provided by Vercel Inc., which stores server logs and form submissions in transit to our systems. Order confirmation calls and SMS delivery updates may be routed through Twilio Ireland Limited, our telephony and messaging processor. Parcels are handed to national delivery partners including Royal Mail Group Ltd, DPD UK, and Evri Parcelnet Ltd, each of which receives only the name, address and telephone number necessary to complete delivery and to allow the courier to collect payment on our behalf where applicable. Our accounting and bookkeeping software is provided by Xero (UK) Limited, and general business email is hosted through Google Workspace, operated by Google Ireland Limited. We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

8. Cookies and tracking technologies

Our website uses a small number of cookies to remember your preferences and to understand, in aggregate, how visitors use the site. A strictly necessary session cookie called talvena_session keeps the order form working correctly while you browse and expires when you close your browser. A second strictly necessary cookie, talvena_consent, stores your cookie banner choice for 12 months so that we do not ask you again on every visit. If you accept analytics cookies, Google Analytics 4 sets _ga and _ga_ prefixed cookies for 13 months and _gid for 24 hours to help us understand page views and visitor numbers in aggregate; these are never used to identify you personally. Marketing cookies are currently disabled by default and no advertising pixels are active on talvena.world at this time; the marketing toggle in our Cookie Settings panel is provided for transparency and will only take effect if we introduce advertising cookies in future, at which point this policy and our Cookie Policy will be updated in advance. Full details of every cookie we use, including exact names and lifespans, are set out in our separate Cookie Policy.

9. International data transfers

Most of the personal data we process is stored on servers located within the United Kingdom or the European Economic Area. Where a processor such as Vercel Inc., Google Ireland Limited, or Twilio Ireland Limited transfers data outside the UK, for example to the United States, we ensure that the transfer is protected by an appropriate safeguard recognised under UK data protection law, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or a valid adequacy decision made by the Secretary of State. We review the safeguards used by our processors periodically and will not engage a new international processor unless an equivalent safeguard is in place before any personal data is transferred. If you would like more detail on the specific safeguard relied upon for any particular processor, you can request this by emailing [email protected].

10. Security measures

We take the security of your personal data seriously and apply technical and organisational measures proportionate to the risk involved. Our website enforces an encrypted HTTPS connection for all traffic, order form submissions are transmitted over TLS, and access to our order management systems is restricted to authorised staff using individual, password-protected accounts. We periodically review who has access to personal data and remove access promptly when it is no longer required, for example when a staff member changes role. While we take reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure, and we cannot fully assure absolute security; if we become aware of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours as required by law and will notify affected individuals without undue delay where the risk is high.

11. Children's data

Elderberry Zinc is intended for adults, and talvena.world is not designed for, nor knowingly directed at, children under the age of 16. We do not knowingly collect personal data from children, and the order form is intended to be completed by an adult placing an order on their own behalf or on behalf of their household. If we become aware that a child has provided us with personal data without appropriate parental or guardian consent, we will take steps to delete that information from our records as soon as reasonably practicable. Parents or guardians who believe their child may have submitted personal data to us should contact [email protected] so that we can investigate and, where appropriate, remove the data promptly.

12. Complaints procedure and contact

If you have any concern about how we handle your personal data, we would like the opportunity to address it directly before you approach a regulator, and we ask that you first contact us at [email protected] or by telephone on +44 117 289 4607, Monday to Friday, 9:00 to 17:30. We aim to acknowledge complaints within 5 working days and to provide a substantive response within 20 working days, escalating to a senior member of staff where the matter is not straightforward. You also have the right at any time to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, by telephone on 0303 123 1113, or online at ico.org.uk/make-a-complaint, and doing so will not affect any other legal remedies available to you.

13. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our processing activities, our use of third-party processors, or changes in data protection law. Where changes are significant, we will highlight this on the homepage for a reasonable period and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically so that you remain informed about how we protect your personal data. The revision history below records the substantive changes made to this document since it was first published.

Date	Change
18 January 2026	Initial publication of the Privacy Policy alongside the launch of talvena.world.
2 March 2026	Added detail on the honeypot spam-prevention field and clarified the legitimate interest basis relied upon for fraud prevention.
14 April 2026	Updated the list of named third-party processors to include Evri Parcelnet Ltd following the onboarding of an additional UK courier partner.
5 June 2026	Clarified retention periods for call notes and correspondence, and added the international transfers section in full.

See also our Cookie Policy, Terms of Use, Returns Policy and Legal Notice.