Last updated: 1 October 2026
This privacy policy explains how Express Peds (operating at expresspeds.is) collects, uses, stores and protects your personal information. We are the data controller for personal data processed on this website under UK GDPR and the Data Protection Act 2018.
1. Who we are
Express Peds is a UK-based e-commerce store selling fitness and performance supplements. Our registered contact point for all customer and data-protection matters is our WhatsApp support line: +44 7386 080529.
2. What personal data we collect
- Account and order information: your name, email address, postal address, phone number, and order history.
- Communications: the contents of any messages you send us via WhatsApp or any reply you make to our emails.
- Technical information: IP address, browser type, device information, pages visited, referral source, and timestamps, collected automatically when you use the site.
- Marketing preferences: whether you have opted in to receive marketing communications, and your interaction history with those emails (opens, clicks, unsubscribes).
We do not collect payment card details on this site. Payment happens off-site via a secure link we send you through WhatsApp. We do not see, store, or process your card information.
3. How we collect it
- Directly from you when you place an order, create an account, contact support, or opt in to marketing.
- Automatically through cookies and similar tracking technologies when you browse the site. See the Cookies section below.
- From third-party service providers who help us run the business (for example, our shipping carrier returning delivery confirmations).
4. How we use your data (lawful bases)
- To fulfil your order and provide customer support (lawful basis: contract). This includes sending order confirmations, dispatch notifications, delivery updates, and responding to your messages.
- To send you marketing communications (lawful basis: consent). We send occasional product updates, restock alerts, nurture sequences, and newsletters only to customers who have opted in. You can withdraw consent at any time using the unsubscribe link in any marketing email.
- To improve the site and our products (lawful basis: legitimate interests). We analyse aggregate usage patterns to understand what works and what does not.
- To prevent fraud and keep accounts secure (lawful basis: legitimate interests and legal obligation).
- To comply with legal and tax obligations (lawful basis: legal obligation). UK law requires us to retain certain order and financial records.
5. Who we share your data with
We only share your data with service providers who help us run the business. We never sell your data. Current processors include:
- Warehouse and fulfilment partners for order packing and dispatch.
- Royal Mail as our shipping carrier, who receive your name and delivery address.
- Mailgun (Sinch Email) as our email service provider, who process your email address and the contents of emails we send you.
- Payment processors for the payment link flow. Payment details are handled on their systems, not ours.
- Analytics providers including Google Analytics and the Meta Pixel, who receive pseudonymised usage data from your browser.
- Our hosting and infrastructure providers, who store the website and database on secure servers.
Each of these processors is contractually required to protect your data and only use it for the purposes we have authorised.
6. International transfers
Some of our processors are based outside the UK. Where this is the case (for example, Mailgun’s US region servers), transfers are protected by the UK International Data Transfer Agreement, Standard Contractual Clauses, or an equivalent safeguard recognised under UK GDPR.
7. How long we keep your data
- Order and financial records: 7 years from the date of transaction, to meet UK tax and accounting requirements.
- Account information: for as long as your account is active, plus a reasonable period afterwards for legitimate business purposes.
- Marketing data: until you unsubscribe or ask us to remove you.
- Analytics data: up to 2 years in aggregated form.
- Support conversations: for as long as needed to resolve your query, plus a reasonable period for reference.
8. Your rights under UK GDPR
You have the right to:
- Access the personal data we hold about you.
- Ask us to correct inaccurate or incomplete data.
- Ask us to delete your data (subject to our legal retention obligations above).
- Ask us to restrict or object to how we process your data.
- Receive a copy of your data in a portable format.
- Withdraw consent for marketing at any time, with no effect on the lawfulness of processing before withdrawal.
- Lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) if you believe we have mishandled your data.
To exercise any of these rights, message us on WhatsApp at +44 7386 080529. We aim to respond to all requests within one month, as required by UK GDPR.
9. Cookies and tracking
We use cookies and similar technologies to make the site work, understand how it is used, and (with your consent) to show you relevant advertising. The main categories are:
- Strictly necessary: session, cart, checkout, and security cookies. These are required for the site to function and cannot be switched off.
- Analytics: Google Analytics and similar tools that measure traffic and usage patterns in aggregate.
- Marketing: the Meta Pixel and similar tags that let us measure the effectiveness of our advertising and show relevant ads on third-party platforms.
You can control cookies through your browser settings. Blocking strictly necessary cookies will prevent the site from working properly.
10. Security
We use industry-standard measures to protect your data, including HTTPS encryption for all site traffic, secured server infrastructure, access controls, and regular security monitoring. No system is completely secure, so we also commit to notifying affected customers and the ICO without undue delay if a personal-data breach is likely to result in a risk to your rights.
11. Children’s data
Our products are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, message us on WhatsApp and we will delete it.
12. Changes to this policy
We may update this policy from time to time to reflect changes in our processing or in the law. The “Last updated” date at the top shows the most recent version. If we make material changes, we will take reasonable steps to notify affected customers.
13. Contact
Questions about this policy, your data, or your rights: WhatsApp +44 7386 080529. WhatsApp is our only monitored customer channel. Replies to our automated emails are not monitored.