Privacy Policy
Last updated: 13.10.2026
1. Who we are
This policy explains how Vital Caucas Probiotics Ltd ("we", "us", "our") collects and uses personal data when you visit ddoctor.co.uk (the "Website"), buy from us, or contact us. We sell food supplements online.
We are the "controller" of the personal data described in this policy, which means we decide how and why it is used.
- Company number: 17129800 (registered in England and Wales)
- Address: 36 Market Place, Heckmondwike, England, WF16 0JG Email: hello@ddoctor.co.uk
- Telephone: 07471 579850
We do not have a Data Protection Officer. Questions about this policy or your data can be sent to hello@ddoctor.co.uk.
2. The personal data we collect, why we use it, and our lawful basis
| What we collect | Why we use it | Lawful basis (UK GDPR) |
|---|---|---|
| Orders: name, email, delivery and billing address, telephone number, the products you order, order history and delivery details | To take and deliver your order, take payment, handle returns, refunds and complaints, and send you order and delivery updates | Performing our contract with you |
| Accounting and legal records: order and payment records | To keep the records that tax, accounting and consumer law require | Legal obligation |
| Payments: payment confirmation and limited card details (for example the last four digits) provided by our payment provider. Your full card details are entered on the secure checkout and are not seen or stored by us | To take payment, prevent fraud and handle refunds | Performing our contract with you; our legitimate interests in preventing fraud |
| Newsletter and marketing: your email address, and a record of when and how you agreed | To send you news, offers and a welcome email with a discount code | Your consent |
| Marketing to existing customers: your email address, where you have bought from us | To send you marketing about similar products, where you have been given the chance to opt out when you bought and in every email | Our legitimate interests (and the "soft opt-in" rule in the Privacy and Electronic Communications Regulations) |
| Enquiries: name, email, company name (Become a Partner form) and the content of your message | To reply to you and, for partner enquiries, to take steps towards a possible contract | Our legitimate interests in answering you; taking steps at your request before a contract |
| Product safety and complaints: details you give us when you report a problem or adverse reaction (see section 3) | To investigate, respond, keep safety records and meet our legal duties as a food business | Legal obligation; our legitimate interests in product safety |
| Stock alerts: your email address and the product you have requested to be notified about. | To notify you by email when a product you are interested in becomes available again. | Our legitimate interests in providing a service you have requested. |
| Reviews: your name or display name and your review, if you submit one | To publish customer reviews | Our legitimate interests |
| Website and device data: IP address, device and browser type, pages viewed, approximate location and cookie identifiers | To keep the Website secure and working. Where cookies or similar technologies are not strictly necessary, we only use them with your consent (see section 7) | Our legitimate interests in security and running the Website; your consent for non-essential cookies |
Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and expectations. You can ask us for more detail about this assessment using the contact details above.
You do not have to give us personal data, but we cannot process or deliver an order without the details marked as needed for orders.
3. Health information
We do not ask you for health information when you order, and you should not include it when you contact us unless it is necessary. However, please be aware that the products you buy could, in some cases, suggest something about your health. If you report an adverse reaction, or you tell us about a medical condition, we treat that information with extra care. We use it only to deal with your report, to meet our legal and safety obligations, and to protect people's health. We will only use it for other purposes with your explicit consent.
4. Who we share your data with
We do not sell your personal data. We share it with the following kinds of organisations, only so far as needed for the purposes in section 2:
- Our e-commerce platform and payment providers: Shopify, which hosts our store, checkout, customer and order records, and payments. For some purposes (for example fraud prevention or if you use its own services such as Shop Pay) they act as an independent controller under their own privacy policy.
- Website hosting, security and technical providers: Lovable, Cloudflare and Google Fonts.
- Email providers: MailerLite
- Delivery and returns providers: Royal Mail
- Analytics and advertising providers: Google Analytics, Google Search Engine.
- Professional advisers and authorities: accountants, lawyers, insurers, and regulators or law enforcement where we are legally required to or it is needed to protect our rights or others' safety.
- A buyer or successor business, if we sell or restructure the business, who would use your data as described in this policy.
These providers are only allowed to use your data on our instructions and under written agreements, unless they are independent controllers.
5. Transfers outside the UK
Some of the providers above, or their sub-processors, may handle data outside the UK, for example in the EU, Canada or the United States. Where this happens, we make sure a lawful transfer mechanism is in place, such as: UK "adequacy" regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified), the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can contact us for more information about the safeguards for a particular transfer.
6. How long we keep your data
| Data | How long |
|---|---|
| Order, payment and accounting records | 6 years from the end of the financial year to which they relate (tax and accounting requirements) |
| Newsletter subscriber details | Until you unsubscribe or withdraw consent. We then keep a minimal record of your email address (a "suppression list") so we do not email you again |
| Marketing to existing customers | Until you opt out, or until we reasonably judge your account inactive (we aim to review after 2 years) |
| Enquiries and messages | As long as needed to deal with them, and normally no longer than 2 years |
| Product safety and adverse reaction records | 6 years to meet our legal and safety obligations |
| Reviews | For as long as the review is displayed, then deleted or anonymised |
| Stock alert details | Until the relevant product becomes available and the notification is sent, or until you withdraw your request, whichever happens first. We may retain a minimal record where necessary to comply with our legal obligations. |
| Website and cookie data | In line with each cookie's lifespan (see our Cookie Policy) |
After these periods we delete or anonymise the data. We may keep it for longer where we need it to deal with a legal claim or where the law requires us to.
7. Cookies and similar technologies
Our Website and checkout use cookies and similar technologies.
- Strictly necessary cookies are needed for the basket, checkout, security and basic site functions. These do not need your consent.
- Analytics, preference, marketing and advertising cookies are only set if you consent through our cookie banner (or where the law allows a limited, low-risk exemption, in which case you will be told and given a way to opt out). You can change your choice at any time.
You can also control and delete cookies in your browser settings, but some parts of the Website may not work without the necessary ones. Our Cookie Policy lists the cookies we use, what they do and how long they last.
8. Marketing
We will only send you marketing emails if you have asked to receive them, or, for existing customers, where the "soft opt-in" rule applies. You can unsubscribe at any time using the link in every email or by emailing hello@ddoctor.co.uk. We will still send you service messages about your orders. Receiving a welcome code is subject to the terms of the offer, but you may unsubscribe straight afterwards and keep any code you have received, unless the offer says otherwise.
9. Your rights
Under UK data protection law, you have the right to:
- be informed about how we use your data (this policy);
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, in certain circumstances;
- restrict our use of your data, in certain circumstances;
- object to our use of your data where we rely on legitimate interests, and to object at any time to direct marketing;
- data portability, where we use your data with your consent or to perform a contract and the processing is automated;
- withdraw your consent at any time where we rely on consent (this will not affect anything we did before you withdrew it); and
- not be subject to a decision based solely on automated processing that has a legal or similarly significant effect. We do not make decisions of this kind.
To use any of these rights, email hello@ddoctor.co.uk. We may need to verify your identity first. We will normally respond within one month, which may be extended by up to two further months for complex or numerous requests, and we will tell you if so. There is normally no charge.
10. How to complain
If you are unhappy with how we have handled your personal data, please tell us first at hello@ddoctor.co.uk. We will acknowledge your complaint within 30 days and investigate and respond without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You can complain to the ICO at any time, and you do not have to contact us first.
11. Security
We use appropriate technical and organisational measures to protect your personal data, and we choose reputable providers. No online system is completely secure. If a personal data breach is likely to put your rights and freedoms at risk, we will notify the ICO within 72 hours of becoming aware of it and, where required, tell you.
12. Children
Our Website is intended for adults aged 18 and over, and orders can only be placed by adults. We do not knowingly collect personal data from children. If you think a child has given us personal data, please contact us and we will delete it.
13. Links to other websites
The Website may link to other websites. This policy does not apply to them, and we are not responsible for their privacy practices.
14. Changes to this policy
We may update this policy from time to time. We will post the updated version on the Website with a new "last updated" date. If we make a significant change that affects how we use your data, we will take reasonable steps to tell you, for example by email.