Customer information · Updated 23 October 2026

Privacy and Cookies Policy

How we use your information, who helps us fulfil your order, how long records are kept and how to manage cookies.

Who is responsible

INTRA CELL SUPPLEMENTS LTD
Company number: 15021127. Registered in England and Wales.

Registered office: Solar House, 282 Chase Road, London, N14 6NZ.
Returns and cancellation correspondence: 63 Trent Gardens, London, N14 4QB.

Customer support is by email: hello@intracellsupplements.com.

We are the controller of the personal information used to run this store and handle customer orders and enquiries. Contact hello@intracellsupplements.com for privacy questions or to exercise your rights.

Information we use and why

We receive information you enter at checkout, provide for an account or send by email, together with payment/order updates from our providers and technical information generated when you use the website.

  • Orders and delivery: your name, email, billing and delivery addresses, any telephone number you provide, products, quantities, totals, order status and payment references. We use these to take steps you request before purchase, perform the contract, deliver goods and handle cancellations/refunds.
  • Accounts: account identifiers, login details, saved contact details and associated orders, to provide account access. Guest checkout is available; purchasing does not require an account.
  • Enquiries and complaints: your email address, message and relevant order details, to answer product questions and resolve issues. This relies on contract where it concerns your purchase, and our legitimate interest in providing customer support for other routine enquiries.
  • Accounting and legal requirements: relevant purchase, refund and correspondence records, to comply with accounting, tax and consumer-law duties.
  • Security: IP address, browser/device information, request details and security events, for our legitimate interests in keeping the store secure and preventing fraud and abuse.

Required checkout information is needed to process and deliver your order; without it we may be unable to fulfil the purchase. Please do not email full card details or unnecessary medical information.

Who receives information

We share relevant information with service providers for the purposes described here:

  • Our fulfilment partner and delivery carriers: order/product details, customer names and delivery addresses so the order can be prepared and delivered. We remain your contact for order problems.
  • Krystal: website hosting and the customer-support mailbox, including information stored on the website and correspondence sent to our email address.
  • Brevo (Brevo SAS): delivery of transactional customer emails, including order receipts, processing updates, password resets and customer notes. Data shared is limited to the recipient’s email address, name and relevant order details necessary to deliver the notification.
  • Stripe and PayPal: payment and refund processing, payment references, transaction details, and relevant contact/billing/device information. Card details entered in provider-hosted controls are handled by the payment provider.
  • Security services: Wordfence, Google reCAPTCHA and payment-provider security services, including hCaptcha where used by an integration. These services receive technical/request information for security and fraud prevention.
  • Professional advisers and authorities: relevant records where needed for accounting, legal advice or a legal obligation.

Providers may act as processors for services supplied to us and as independent controllers for their own regulatory, security or other purposes. Payment providers may use automated fraud screening or decline a payment; contact us if you need help with an order affected by a payment decision.

Provider information: Krystal, Brevo, Stripe, PayPal, Wordfence, Google and hCaptcha.

International processing

Some external providers process information outside the UK, including in the European Economic Area (EEA) and the United States. We do not represent all processing as UK-only.

Brevo SAS processes transactional email data in the European Union (France), which is recognized by the UK Government as providing adequate data protection under UK GDPR adequacy regulations. Stripe describes using adequacy arrangements, standard contractual clauses with the UK Addendum and other lawful mechanisms where applicable. PayPal describes adequacy arrangements, approved contractual safeguards and other applicable transfer mechanisms. Krystal also describes overseas supplier processing and adequacy or approved contractual safeguards in its privacy notice. Their linked notices explain their arrangements; these statements do not mean every service uses the same mechanism.

Email hello@intracellsupplements.com to request information about relevant recipients, overseas processing and applicable safeguards, including copies where available.

How long information is kept

  • Order and accounting records: six years after the end of the relevant financial year.
  • Routine enquiries: two years after resolution.
  • Inactive accounts: reviewed after two years of inactivity. Unnecessary account details are removed; order records needed for accounting or legal purposes are retained separately.
  • Security records: retained according to their security purpose and the relevant provider’s settings. Our Wordfence Live Traffic log is set to Security Only, with a maximum of 2,000 entries and 30 days. These limits do not apply to every hosting or external-provider log.
  • Cookie preferences and earlier visit-source data: see the cookie durations below. Any attribution saved with an order follows the order-record period.
  • Backups: copies may remain within the hosting or backup provider’s recovery cycle until rotated or overwritten. A change to live data does not instantly remove every historical backup.

We retain relevant information longer where an unresolved dispute or legal requirement makes this necessary, and remove or anonymise information when it is no longer needed. The periods above are our retention policy; they do not imply that all deletion is automated. External providers may keep their own records under their separate legal duties and notices.

Cookies and your choices

Cookies and similar browser storage support shopping, account access, secure payments, security and remembering your cookie choice. Optional analytics and external services are controlled through the banner. WooCommerce visit-source attribution tracking remains disabled.

Choose Reject optional to decline optional uses, Accept optional to allow them, or Choose settings to select categories. Use the Cookie settings control to change or withdraw your choice. Withdrawing consent does not affect earlier lawful processing.

Optional external services include PayPal widgets and externally hosted Google Fonts. Payment/security services needed for the shopping or account function you request may still run. Google Analytics 4 is an optional statistics service, supplied by Google, used to understand visits, product views, basket activity, checkout starts and completed purchases. It receives pseudonymous browser/device identifiers and event information after statistics consent. We do not intentionally send names, email addresses, delivery addresses, payment details or order-access keys to Google Analytics. Advertising features are disabled. Analytics consent is separate from optional payment widgets and fonts.

Cookie lifetimes describe browser storage, not how long a provider keeps its server-side records. Providers can refresh storage and vary names or durations.

Shopping and account storage

woocommerce_items_in_cart and woocommerce_cart_hash: session basket state. wp_woocommerce_session_*: shopping session, normally about two days. WooCommerce cart/API data may also be held in local storage, which has no inherent expiry. WordPress login cookies are used when signing into an account; their duration depends on whether “Remember me” is selected.

Cookie preferences

cmplz_* cookies remember your consent choices, categories and policy version, normally for up to one year. Complianz may also use local/session storage to support the banner. This storage records your choices rather than consent to optional tracking.

Optional Google Analytics storage

After statistics consent, _ga and _ga_* cookies distinguish browsers and maintain session information. Google Analytics cookies may last up to two years unless deleted earlier; individual settings may shorten this. Google can process analytics information outside the UK, including in the United States, under the arrangements described in its privacy notice and data processing terms. Change or withdraw statistics consent through Cookie settings. Blocking statistics does not prevent shopping or card payment.

Earlier visit-source cookies

Visit-source measurement is disabled. Cookies from earlier visits may remain until they expire, your browser session ends or you delete them in your browser. Earlier WooCommerce/Sourcebuster cookies included sbjs_current, sbjs_first, sbjs_current_add, sbjs_first_add, sbjs_udata and sbjs_migrations: visit-source/session information, normally session cookies. sbjs_session: session activity, about 30 minutes.

Payment and security providers

Stripe identifiers include __stripe_mid (about one year), __stripe_sid (about 30 minutes) and a provider-domain identifier m (observed at about 400 days). PayPal can use l7_az, sc_f and other service identifiers, with session and persistent lifetimes. hCaptcha/Cloudflare service cookies can include hmt_id (observed at about 30 days), __cf_bm and __cflb (about 30 minutes). Google service storage, including NID where present, depends on the service/account context; it was observed at about six months during payment/security browsing. The linked provider notices explain their purposes and current terms.

Other browser support

WordPress may use wpEmojiSettingsSupports in session storage to remember browser emoji capability. External font or emoji resources send network/request information to their hosts; an external request does not by itself mean an advertising cookie has been set.

You can also restrict or delete storage in your browser. Restricting essential shopping, account or payment storage can affect those functions.

Your rights and complaints

Depending on the processing and legal conditions, you may ask to access, correct, erase, restrict or obtain a portable copy of your personal information. You may object to processing based on legitimate interests and withdraw consent where we rely on it.

Email hello@intracellsupplements.com with your request. We may need proportionate information to confirm your identity. We respond within the applicable legal time limit, normally one month; lawful exceptions or extensions may apply. Some records must be retained to meet legal obligations.

You can complain to the Information Commissioner’s Office. You do not need to complain to us first, though we welcome the opportunity to address a concern.

Changes to this policy

We update this notice when our data use, providers or controls change, and bring material changes to your attention where required. The update date appears at the top of this page.

Back to top · Contact us