In short
- We collect only what it takes to process your payment, deliver your order and answer your questions.
- We never sell your personal data.
- Your full card number is never visible to us and never stored by us. Certified payment providers handle payments.
- 1 click is all it takes to unsubscribe from our emails.
- Ask us any time for a copy of your data, a correction or its deletion: [email protected].
1. Who is responsible for your data
Northwake Limited operates the Orbalife online store and decides how your personal data is used (it is the "data controller"). The company number and registered address are listed in the Terms and Conditions.
The policy applies to orbalife.com, to the product pages, articles and offer pages connected to our checkout, and to our emails. Data questions go to [email protected].
2. The data we collect
- Order details: your name, delivery and billing address, email address, phone number, the items you ordered and the amount you paid.
- Payment details: you enter your card details on our payment providers' secure systems. What reaches us is the payment result, the card type and its last 4 digits, never the full card number.
- Unfinished checkouts: if you type your email address at checkout without completing the order, we hold it briefly so that we can send you a reminder.
- Messages: the emails, contact forms and photos you send to our customer care team, together with our answers.
- Order tracking: the order number and email address you enter on the Order tracking page.
- Reviews: the rating, the text and the first name you give us when you review a product.
- Browsing data: your IP address, your device and browser type, the pages you view, what you click and the ad or link that led you to us. We collect this through cookies and similar technologies (section 7).
We don't ask for sensitive information like health details. Please leave it out of your messages and reviews unless we need it to solve a problem with your order.
3. What we use it for
- Processing the order: collecting payment, preparing and delivering the parcel, sending confirmation, shipping and delivery emails, managing returns and refunds. Our contract with you requires this.
- Supporting you: replying to questions and running the online order tracking. Our contract with you requires this, and we have a legitimate interest in it.
- Fighting fraud and managing payment disputes: reviewing suspicious orders and, in a dispute, showing the bank what was ordered and delivered. We have a legitimate interest in this.
- Complying with the law: maintaining accounting and tax records, and replying to lawful requests made by authorities.
- Sending offers: product emails and abandoned-checkout reminders, based on your consent or, where permitted by law, on your status as a customer. Each email carries an unsubscribe link. You may also tell us to stop.
- Improving pages and measuring ads: finding out how pages are used and which ads generate orders. The legal basis is our legitimate interest or your consent, according to your country's law.
No decision with legal effect on you is made purely by automated means.
4. Who we share it with
We never sell your personal data. We share it only with the companies that help us run the shop, and only the part they need:
- payment providers and fraud-prevention services, so that your payment can be processed;
- our checkout and order-management platforms;
- our warehouses, logistics partners and carriers, so that your parcel can be prepared and delivered;
- email and customer-service tools, so that we can email you and answer your messages;
- analytics and advertising partners, so that we understand how our pages are used and can measure our ads (section 7);
- banks and card networks, when a payment is disputed;
- our accountants, lawyers and insurers, and public authorities when the law requires it.
If the shop, or part of it, is sold or reorganised, your data may pass to the new owner, who must respect this policy.
5. Transfers outside your country
Our makers, warehouses and service providers are spread around the world, and the company itself is established outside the United Kingdom and the European Economic Area. Your data is consequently processed outside your country of residence. Where required by law, these transfers rely on appropriate safeguards such as the European Commission's standard contractual clauses and the UK addendum. Details are available on request.
6. How long we keep it
- Orders, invoices and payment records: 7 years, as accounting and tax rules require.
- Customer care messages: 3 years from your last message.
- Unfinished checkouts: 30 days.
- Marketing preferences: until you unsubscribe. After that we keep only your email address, on a "do not contact" list.
- Browsing and analytics data: 13 months at most.
Once these periods end, we delete your data or make it anonymous.
7. Cookies and similar technologies
A cookie is a small file stored by your browser. Cookies and related technologies such as pixels are used by us and by our partners for 3 reasons:
- Running the site and checkout: securing your session and keeping your order in memory until you finish it.
- Understanding page usage: we use Microsoft Clarity to see how visitors use and interact with our pages through behavioural metrics, heatmaps and session replays, and we improve the pages with what we learn. How Microsoft collects and uses this data is explained in the Microsoft Privacy Statement.
- Measuring ads: our advertising platforms rely on cookies and pixels to report which ads bring visits or orders, and to display our ads to people likely to be interested.
Cookies can be blocked or deleted in your browser settings at any time. Third-party cookies can be refused in most browsers. Pages still load with cookies blocked, but certain functions, checkout included, may stop working correctly.
8. Your rights
Wherever you live, you can ask us to:
- send you a copy of the personal data we hold about you;
- correct data that is wrong or out of date;
- delete your data, unless we have to keep it, for instance under accounting rules or because of an open dispute;
- stop sending you marketing emails;
- stop or restrict a use of your data that you object to, or hand you your data in a format you can take elsewhere.
Write to [email protected] from the email address you ordered with. We may ask you to confirm who you are, and we answer within 30 days. Using your rights costs nothing and never affects your orders or the service you get.
United Kingdom and European Union
The UK GDPR and the EU GDPR are the source of these rights. Consent, where we rely on it, can be withdrawn at any moment. If you're unhappy with our reply, you may complain to the Information Commissioner's Office (UK) or to the data protection authority in your country.
United States
Depending on your state, California included, you have the right to know what personal information we collect, to have it corrected or deleted, and to opt out of its sale or sharing. We don't sell personal information. Some laws count advertising cookies as "sharing": to opt out, block third-party cookies in your browser or write to us. We never treat you differently because you used your rights.
Australia and Canada
You may request access to your personal information and its correction. If you're unhappy with our reply, the Office of the Australian Information Commissioner or the Office of the Privacy Commissioner of Canada can be contacted.
9. How we protect your data
Our pages and checkouts run on encrypted connections. Payments go through providers certified under PCI DSS, the card industry's security standard. Within our team, access to your data is limited to the people who need it to handle your order or answer you. No system is perfectly secure, so if we ever learn of a breach that puts your data at risk, we'll tell you and the authorities as the law requires.
10. Children
The store is intended for adults. We never knowingly collect data from people under 18. If a child appears to have sent us personal data, let us know and it will be deleted.
11. Changes to this policy
We update this policy when our tools or the law change. The date at the top of this page tells you which version is current. When a change is significant, we email our customers about it.