PRIVACY POLICY

Last updated: 20 August 2026

1. Introduction

Blood Records Limited ("Blood Records", "we", "us" or "our") respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you:

• visit or use blood-records.co.uk (the "Site");
• create or use a customer account;
• purchase products from us;
• subscribe to email or SMS marketing;
• contact our customer service team;
• enter a competition, promotion or survey; or
• otherwise interact with Blood Records.

For the purposes of this Privacy Policy, "personal information" and "personal data" mean information relating to an identified or identifiable individual.

This Privacy Policy should be read alongside our Terms & Conditions and Shipping & Returns Policy.

2. Data Controller

For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data-protection law, the data controller is:

Blood Records Limited
Company number: 11490928

1 Lucas Bridge Business Park
Old Greens Norton Road
Towcester
Northants
NN12 8AX
United Kingdom

Email: info@blood-records.co.uk
Subject: Data Protection

Blood Records Limited determines the purposes for which, and the manner in which, personal information relating to our customers and Site users is processed.

3. Personal Information We Collect

The information we collect depends on how you interact with Blood Records.

We may collect the following categories of personal information.

Identity Data

Your name, username, customer identifier and similar information used to identify you.

Contact Data

Your billing address, delivery address, email address and telephone number.

Financial Data

Information necessary to process payments.

Full payment-card details are generally collected and processed directly by Shopify and/or the applicable payment provider rather than being stored by Blood Records.

Transaction Data

Information concerning purchases, orders, payments, cancellations, returns, refunds, replacements and other transactions with Blood Records.

Profile Data

Information associated with your customer account, including your purchase history, preferences, feedback, competition entries and survey responses.

Technical Data

Information such as your IP address, browser type and version, device information, operating system, approximate location, time zone, login information and other technical information relating to your use of the Site.

Usage Data

Information about how you access, navigate and interact with our Site and services.

Marketing and Communications Data

Your email and SMS marketing preferences, records of consent or opt-out requests and information concerning your interaction with marketing communications.

Customer Support Data

Information contained in correspondence with Blood Records, including customer-support enquiries, order information, support history and photographs, videos or other materials you provide in connection with damaged, faulty or incorrect products.

4. How We Collect Personal Information

We may collect personal information in the following ways.

Information You Give Us

We collect information directly from you when you:

• place an order;
• create or use a customer account;
• subscribe to email marketing;
• opt in to SMS marketing;
• contact customer support;
• request a cancellation, return, refund or replacement;
• enter a competition or promotion;
• complete a survey;
• provide feedback; or
• otherwise communicate with us.

Information Collected Automatically

When you interact with our Site, certain Technical and Usage Data may be collected automatically using cookies, pixels, server logs, local storage and similar technologies.

Information From Third Parties

We may receive information from organisations that help us operate our business, including ecommerce, payment, fulfilment, delivery, customer-service, marketing, analytics, advertising, security and fraud-prevention providers.

5. How We Use Your Personal Information

We may use personal information to:

• create and administer customer accounts;
• process and fulfil orders;
• process payments and refunds;
• arrange delivery;
• communicate with you about your orders;
• process cancellations, returns and replacements;
• provide customer support;
• investigate damaged, missing or incorrect orders;
• administer competitions, promotions and surveys;
• detect and prevent fraud or abuse;
• protect our Site, customers and systems;
• enforce product purchase limits;
• identify attempts to circumvent purchasing restrictions;
• protect limited releases from automated or abusive purchasing;
• maintain financial, tax and business records;
• analyse and improve Site performance;
• improve our products, services and customer experience;
• understand customer behaviour and preferences;
• measure the effectiveness of our marketing;
• provide or measure personalised advertising where permitted;
• send email and SMS marketing where permitted;
• establish, exercise or defend legal claims; and
• comply with legal and regulatory obligations.

6. Our Lawful Bases for Processing

Under data-protection law, we must have a lawful basis for processing your personal information.

Depending on the circumstances, we may rely on the following.

Performance of a Contract

We process information where necessary to enter into or perform our contract with you.

For example, we need your name, delivery address and order information to fulfil and deliver an order.

Legal Obligation

We process information where necessary to comply with a legal or regulatory obligation, including applicable tax, accounting and consumer-protection requirements.

Legitimate Interests

We may process information where necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

• operating and improving Blood Records;
• protecting our Site and customers;
• preventing fraud and abuse;
• maintaining the security of our systems;
• understanding how customers use our Site;
• enforcing product purchase limits;
• preventing attempts to circumvent purchasing restrictions; and
• establishing or defending legal rights.

Consent

We rely on consent where you have actively agreed to a particular use of your information and consent is the appropriate lawful basis.

This includes our opt-in email and SMS marketing.

Where we rely on consent, you may withdraw it at any time.

7. Shopify

Our online store is powered by Shopify.

Shopify provides technology used to operate our Site, ecommerce services, checkout and customer-account functionality.

Shopify may therefore process personal information relating to visitors and customers in connection with providing these services.

Shopify may also provide or facilitate payment processing, security, fraud prevention, analytics and other ecommerce functionality.

8. Payments

Payments are processed through Shopify and/or the payment provider associated with the payment method you choose during checkout.

We accept the payment methods made available at checkout, which may include major credit and debit cards, digital wallets and local payment methods.

Depending on the payment method used, relevant payment providers may process information including your name, billing information, payment details and transaction information.

Some payment providers may act as independent data controllers for certain processing and their own privacy policies may apply.

9. Order Fulfilment

To provide our customers with an efficient and reliable fulfilment service, we work with a specialist UK-based fulfilment partner to store, pick, pack and dispatch Blood Records orders on our behalf.

To enable our fulfilment partner to provide these services, we share the information reasonably necessary to fulfil and manage your order.

This may include:

• your name;
• delivery address;
• email address;
• telephone number where relevant;
• order number;
• products ordered;
• delivery service;
• fulfilment status; and
• information necessary to investigate or resolve fulfilment, return or delivery issues.

Blood Records Limited remains the retailer and data controller for purchases made through blood-records.co.uk. Our fulfilment partner provides warehousing and fulfilment services on our behalf and does not own or operate Blood Records.

10. Delivery Providers

UK orders are dispatched using Royal Mail Tracked 48.

International orders are dispatched using tracked services and may be transferred to local postal or courier providers in the destination country.

We provide delivery providers with information reasonably necessary to deliver and track your order. This may include your name, delivery address, email address and telephone number.

Delivery providers may process certain information as independent data controllers in accordance with their own legal obligations and privacy policies.

11. Email Marketing – Brevo

We use Brevo to manage our email marketing communications and subscriber information.

If you opt in to Blood Records email marketing, information including your email address, marketing preferences, consent records and interaction with our communications may be processed through Brevo.

We may use this information to send you information about Blood Records releases, products, offers and related news, and to understand the effectiveness of our communications.

You can unsubscribe from email marketing at any time using the unsubscribe link contained in our marketing emails.

12. SMS Marketing – TextMagic

We use TextMagic to send SMS marketing communications.

Our SMS messages are used for marketing purposes and are sent to customers who have opted in to receive them, subject to applicable law.

Information processed for this purpose may include:

• your mobile telephone number;
• your consent and opt-out status;
• the date and method of your consent; and
• information relating to SMS marketing sent to you.

You may withdraw your consent to SMS marketing at any time using the opt-out method provided in the relevant message or by contacting us.

Withdrawing consent does not affect the lawfulness of processing carried out before your consent was withdrawn.

13. Customer Support – Zendesk

We use Zendesk to manage customer-service enquiries.

When you contact Blood Records, information including your name, contact details, order information, correspondence and support history may therefore be processed through Zendesk.

If you provide photographs, videos or other attachments when reporting a damaged, faulty or incorrect product, these materials may also be processed through our customer-support systems.

We use this information to investigate, manage and respond to your enquiry.

14. Marketing Communications

We may send you information concerning Blood Records products, releases, offers and related news where permitted by applicable law.

Where required, we will only send email or SMS marketing where you have opted in to receive it.

Creating a Blood Records customer account or placing an order does not automatically constitute consent to receive marketing.

You can opt out of marketing communications at any time using the unsubscribe or opt-out method provided in the relevant communication or by contacting us.

Opting out of marketing does not prevent us from sending necessary service communications concerning orders, payments, deliveries, returns, customer-support requests or your account.

We do not sell your personal information to unrelated organisations for their own direct-marketing purposes.

15. Cookies and Similar Technologies

Our Site and the technology providers supporting it may use cookies, pixels, local storage and similar technologies.

These technologies may be used to:

• provide essential Site functionality;
• maintain security;
• remember settings and preferences;
• understand how our Site is used;
• analyse Site performance;
• measure marketing campaigns; and
• provide or measure advertising where permitted.

Some cookies and similar technologies are necessary for the operation of the Site.

Where applicable law requires consent, non-essential analytics, advertising and similar technologies will only be used after the appropriate consent has been obtained.

You can manage available cookie preferences using the controls provided on our Site and through your browser settings.

Blocking certain technologies may affect the functionality of the Site.

16. Analytics and Advertising

We may use third-party analytics and advertising services to understand use of our Site, measure marketing performance and advertise Blood Records products.

These services may use cookies, pixels and similar technologies.

Where consent is required, these technologies will only be used after appropriate consent has been obtained.

The particular technologies and providers we use may change as our Site and marketing activities develop.

17. Who We Share Personal Information With

Depending on the circumstances, we may share personal information with:

• Shopify and ecommerce service providers;
• our warehousing and order fulfilment partners;
• Royal Mail and international delivery providers;
• payment providers;
• Brevo;
• TextMagic;
• Zendesk;
• IT, cloud, hosting and security providers;
• analytics providers;
• advertising platforms;
• fraud-prevention providers;
• professional advisers including accountants, lawyers, auditors and insurers;
• HM Revenue & Customs;
• regulators, courts and law-enforcement authorities where required or permitted by law; and
• other organisations where reasonably necessary to establish, exercise or defend legal rights.

We may also disclose personal information in connection with a proposed or completed sale, acquisition, merger, restructuring or transfer of all or part of Blood Records or its assets.

We do not share personal information with third parties simply so that they can market their unrelated products or services to you.

18. International Transfers

Some organisations that process personal information for us may operate, or use infrastructure, outside the United Kingdom.

Where personal information is transferred internationally, we take appropriate steps designed to ensure that the transfer complies with applicable data-protection law.

Depending on the circumstances, these safeguards may include:

• UK adequacy regulations;
• applicable EU adequacy decisions;
• the UK International Data Transfer Agreement;
• the UK Addendum to European Commission Standard Contractual Clauses;
• European Commission Standard Contractual Clauses where applicable; or
• another lawful international-transfer mechanism.

You may contact us for further information about safeguards applicable to your personal information.

19. Data Security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access.

Access to personal information is restricted to employees, contractors and service providers who have an appropriate business need to access it.

We maintain procedures for responding to suspected personal-data breaches and will notify affected individuals and applicable regulators where required by law.

No method of electronic transmission or storage can be guaranteed to be completely secure.

20. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying applicable legal, regulatory, tax, accounting and reporting obligations.

When determining appropriate retention periods, we consider:

• the nature and amount of the information;
• its sensitivity;
• the purposes for which it is processed;
• the potential risks associated with unauthorised use or disclosure;
• whether those purposes can be achieved in another way; and
• applicable legal requirements.

We may retain basic customer and transaction information for six years where necessary for tax, accounting, contractual or legal purposes.

Marketing information may be retained for as long as you remain subscribed and for an appropriate period afterwards to maintain records of consent, withdrawal or suppression preferences.

Information that has been permanently anonymised may be retained indefinitely.

21. Your Data-Protection Rights

Depending on the circumstances and applicable law, you may have the following rights.

Right of Access

You may request confirmation that we process your personal information and a copy of the information we hold about you.

Right to Rectification

You may ask us to correct personal information that is inaccurate or complete information that is incomplete.

Right to Erasure

You may ask us to delete your personal information in certain circumstances where we no longer have a lawful reason to retain it.

This right is subject to legal exceptions, including circumstances where we are required to retain information.

Right to Restrict Processing

You may ask us to restrict how we process your personal information in certain circumstances.

Right to Object

You may object to certain processing carried out on the basis of legitimate interests.

You have the right to object to the use of your personal information for direct-marketing purposes.

Right to Data Portability

In certain circumstances, you may request personal information you provided to us in a structured, commonly used and machine-readable format or ask us to transfer it to another controller.

Right to Withdraw Consent

Where we rely on your consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

These rights are subject to the conditions, limitations and exemptions provided by applicable data-protection law.

22. Exercising Your Rights

To exercise a data-protection right, contact:

info@blood-records.co.uk

Please use "Data Protection" as the subject where possible.

You will not normally be required to pay a fee.

Where permitted by law, we may charge a reasonable fee or refuse to comply with a request that is manifestly unfounded or excessive.

We may request information reasonably necessary to confirm your identity before responding to a request.

We aim to respond to valid requests within one month. Where permitted by law, additional time may be required for particularly complex requests, in which case we will inform you.

23. Automated Decision-Making

We may use automated systems to help detect fraud, suspicious activity or attempts to circumvent purchasing restrictions.

We do not currently use solely automated decision-making that produces legal or similarly significant effects on individuals unless permitted by applicable law and appropriate safeguards are in place.

24. Children's Information

Our Site is not intended for children and we do not knowingly collect personal information from children.

If you believe that a child has provided personal information to us, please contact us.

25. Third-Party Websites

Our Site may contain links to websites or services operated by third parties.

We are not responsible for the privacy practices, content or security of websites we do not operate.

We encourage you to review the privacy information provided by a third-party service before providing personal information to it.

26. Complaints

If you have concerns about how Blood Records processes your personal information, please contact us so that we have an opportunity to investigate.

You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.

Individuals in the EU or other jurisdictions may also have the right to complain to their relevant local data-protection authority.

27. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, technology, service providers, legal requirements or privacy practices.

The current version will be published on our Site and the "Last updated" date at the top of this policy will be updated accordingly.

28. Contact Us

For questions about this Privacy Policy, how we use your personal information, or to exercise your data-protection rights, please contact:

Blood Records Limited
Company number: 11490928

1 Lucas Bridge Business Park
Old Greens Norton Road
Towcester
Northants
NN12 8AX
United Kingdom

Email: info@blood-records.co.uk
Subject: Data Protection