Privacy and data protection

1. Who controls the data

iHerb24, an online shop. The seller's full registration details are given with the order confirmation and on the invoice. Requests about personal data are made through the order they concern, using the reply address on the order confirmation.

2. What we hold

Your name, telephone, e-mail address, the delivery address or collection point you chose, what the order contained and what it cost, and technical details your browser sends.

3. Why, and on what basis

To perform the contract of sale (GDPR art. 6(1)(b)), to meet tax and accounting obligations (art. 6(1)(c)), and — only where you have agreed to it — to send you news of what has arrived and what has changed price (art. 6(1)(a)).

4. Who else sees it

The carriers InPost and DPD, to the extent a parcel cannot be delivered without it; the payment providers, to take the payment; and our accountants and hosting provider, as processors acting on our instructions.

5. How long, and what you may ask of us

Order records are kept for as long as tax law requires. You may ask for access to your data, for it to be corrected, erased or restricted, for it to be handed to you in a portable form, and you may complain to the President of the Polish data protection authority (UODO).

6. Cookies and analytics

The shop uses cookies to keep your basket and your session, and analytics only once you have agreed to them — the choice is offered before anything is loaded, and refusing is one click. Cookie settings can also be changed in your browser.