Privacy
Privacy Policy
Effective 11 August 2026. This Privacy Policy explains, in plain terms, how Fornelo Health Ltd ("Fornelo", "we", "us" or "our") collects, uses, stores, shares and protects personal information in connection with fornelo.world, our telephone order confirmation service, and the delivery of Turmeric Complex to customers across the United Kingdom. We are committed to handling personal data fairly, transparently and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read this policy carefully alongside our Cookie Policy, Terms of Use and Returns Policy, which together describe how we operate. If you do not agree with any part of this policy, please do not submit personal information to us through the website, telephone or email.
1. Scope of this document
This policy applies to anyone who visits fornelo.world, submits the order form, speaks with our team by telephone to confirm an order, or otherwise contacts Fornelo Health Ltd by email or post. It covers information gathered at every stage of a typical customer journey: browsing the site, completing the order request, the confirmation telephone call, dispatch and delivery, and any after-sales contact such as a return or a general enquiry. It does not extend to the internal systems of independent couriers once a parcel has left our control, nor to any third-party website you may reach via a link from our site, each of which maintains its own privacy notice. Where we act only as a data processor on behalf of another organisation, a separate notice specific to that arrangement would apply instead of this one.
2. Who is responsible for your data (the controller)
Fornelo Health Ltd, a company registered in England and Wales under company number 09847401, is the data controller responsible for the personal information described in this policy. Our registered office and correspondence address is 74 Cavendish Road, London, SW12 0DG, United Kingdom. You can reach our privacy team by email at [email protected], or by telephone on +44 20 3897 4201 during our normal business hours of Monday to Friday, 9:00 to 17:30. We have not been required to appoint a statutory Data Protection Officer given the scale and nature of our processing, but a designated member of staff reviews privacy matters and can be reached using the contact details above.
3. Information we collect
When you use the order form, we collect your full name, delivery address, telephone number and, where provided voluntarily, your email address, together with the product and quantity you have requested. During the confirmation telephone call, we record the outcome of the call (confirmed, rescheduled or cancelled) and any notes relevant to delivery, such as access instructions or a preferred delivery window. Because payment is made directly to the courier on delivery, we do not collect or store card numbers, expiry dates or security codes on our own systems at any point. We also automatically collect limited technical information when you browse the site, including your approximate location derived from your IP address, browser type and version, device type, referring pages, and the pages you view, which is described in more detail in our Cookie Policy.
4. Legal bases for processing
We rely on different lawful bases depending on the purpose of processing. Where you submit the order form, we process your name, address and telephone number as steps taken at your request prior to entering into a contract, and subsequently to perform that contract once confirmed by telephone. We rely on legitimate interests to maintain basic website security logs, to prevent fraudulent or abusive submissions through the honeypot field on the order form, and to analyse aggregated visit statistics that help us improve the site. We rely on legal obligation to retain certain order and financial records for tax and accounting purposes. Where we ever seek your consent, for example for optional analytics or marketing cookies, we will ask for it clearly and you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
5. How long we keep your information
| Category of data | Typical retention period | Reason |
|---|---|---|
| Order and delivery records | 6 years from the end of the relevant financial year | UK tax, accounting and consumer record-keeping obligations |
| Customer service and returns correspondence | 24 months after the matter is resolved | Handling follow-up queries and demonstrating fair resolution |
| Unconfirmed or abandoned order requests | 90 days from submission | Allowing us to complete a confirmation call before secure deletion |
| Website analytics data (aggregated) | Up to 14 months | Understanding site usage and improving navigation |
| Cookie consent record | 12 months, then renewed | Evidencing your cookie choices as required by law |
| Complaints to Fornelo about data protection | 3 years from closure | Demonstrating accountability under UK GDPR |
Once a retention period expires, we securely delete or irreversibly anonymise the relevant information unless a longer period is required by law, for example where records are relevant to an ongoing legal claim, an HM Revenue and Customs enquiry, or a dispute with a customer that has not yet been resolved. We periodically review our retention schedule to ensure it remains proportionate and no longer than necessary for the purposes described in this policy.
6. Your rights under UK GDPR
You have the right to request access to the personal information we hold about you, and to receive a copy of it free of charge in most cases. You can ask us to correct inaccurate information, or to complete information that is incomplete. You can ask us to erase your personal information where it is no longer needed, where you withdraw consent, or where you object to processing based on legitimate interests, subject to limited legal exceptions such as our tax record-keeping obligations. You can ask us to restrict processing while a dispute about accuracy or lawfulness is resolved, and you can ask for certain information to be provided in a portable, machine-readable format. To exercise any of these rights, please email [email protected] with "Privacy Request" in the subject line, including your name and order reference where applicable so that we can verify your identity; we aim to acknowledge every request within 5 working days and to respond substantively within one calendar month, extendable by a further two months for complex requests, in which case we will explain the delay.
7. Third-party processors and recipients
We share personal information with a limited number of organisations that help us operate the website and fulfil orders, each bound by a data processing agreement that requires them to protect your information and use it only for the purposes we specify. Our delivery partners, which may include Royal Mail, Evri and DPD depending on your region and the courier available on the day, receive your name, address and telephone number so that they can deliver your parcel and collect payment on delivery. Our website hosting and infrastructure provider, Amazon Web Services EMEA SARL, stores the technical data underlying the site. Where activated, aggregated analytics are processed by Google LLC through Google Analytics, and transactional or notification emails may be sent through Mailchimp Ireland Limited. We never sell personal information to third parties, and we do not share your data with couriers or providers beyond what is reasonably necessary to complete your order.
8. Cookies and similar technologies
Our website uses a small number of cookies to remember your consent choices, support the basic operation of the order form, and, where you agree, to gather anonymised analytics about how pages are used. Full details of each cookie, including its name, purpose and lifespan, are set out in our separate Cookie Policy, which forms part of this overall privacy framework. You can manage or withdraw cookie consent at any time using the Cookie Settings link in the footer of every page, or by adjusting your browser settings directly. Blocking strictly necessary cookies may affect your ability to submit an order through the website, in which case you are welcome to contact us by telephone instead.
9. International data transfers
Most personal information is stored and processed within the United Kingdom or the European Economic Area. Where a processor such as our hosting or analytics provider transfers data outside the UK or EEA, for example to the United States, that transfer is protected either by an adequacy decision recognised under UK law, or by the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with supplementary technical and organisational safeguards such as encryption in transit. You can request further details of the specific safeguards applying to any particular transfer by contacting us using the details in section 2.
10. Security measures
We apply reasonable technical and organisational measures appropriate to the nature of the personal information we hold, including encrypted connections between your browser and our servers, restricted staff access to order records on a need-to-know basis, and regular review of the third parties we work with. The order form includes a hidden honeypot field designed to reduce automated and fraudulent submissions before they reach our systems. While we take these precautions seriously, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot fully assure absolute security; if we become aware of a breach likely to result in a risk to your rights, we will notify the Information Commissioner's Office and, where required, affected individuals without undue delay.
11. Children
Our website and products are intended for adults, and we do not knowingly collect personal information from anyone under the age of 18. Turmeric Complex is not marketed to or intended for children. If we become aware that we have inadvertently collected personal information from a minor without appropriate consent, we will take reasonable steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us so that we can investigate and act accordingly.
12. Complaints and how to contact us
If you have any concern about how we handle your personal information, please contact us first at [email protected] or +44 20 3897 4201 so that we can try to resolve the matter directly; we aim to acknowledge complaints within 5 working days and to provide a substantive response within 30 calendar days. If you remain unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, or online at ico.org.uk, generally within three months of receiving our final response. Making a complaint does not affect any other legal rights or remedies you may have.
13. Changes to this policy and revision history
We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or the law. Where changes are significant, we will highlight them on this page and, where appropriate, notify customers who have an open order at the time of the change. We encourage you to review this page periodically so that you remain informed about how we protect your information.
| Version | Date | Summary of change |
|---|---|---|
| 1.0 | 3 February 2026 | Initial publication of the Privacy Policy for fornelo.world |
| 1.1 | 22 April 2026 | Added named third-party processors and clarified retention periods |
| 1.2 | 11 August 2026 | Current version — expanded rights section and complaints procedure |