Privacy Policy
This policy explains what personal data we collect, why we collect it, how long we keep it and what rights you have. We are the data controller for the information described here.
Last updated: 6 August 2026
Who we are
Mundo Fit Natural (“we”, “us”). Contact our data lead at mundo_fit_naturaluk@outlook.com.
What we collect
- Order information: name, delivery address, email, optional phone number, and the items you bought.
- Payment information: handled entirely by Stripe. We receive confirmation that payment succeeded and the last four digits of the card. We never see or store your full card number.
- Consultation information: health history, lifestyle details and any notes taken during your appointment. This is special category data and we treat it accordingly.
- Contact and booking forms: the details you choose to give us.
- Website analytics: only if you accept analytics cookies. See our cookie policy.
Why we can use it (lawful basis)
- Contract: to take payment, deliver your order and provide services you booked.
- Consent: for marketing emails, analytics cookies, and processing health information for a consultation. You can withdraw consent at any time.
- Legal obligation: to keep sales and tax records for six years, as HMRC requires.
- Legitimate interests: to prevent fraud and to keep the website secure and working.
How long we keep it
Order records: six years, for tax purposes. Appointment records: kept only as long as we need them to look after you, and deleted on request where we are not legally required to retain them. Marketing consent: until you unsubscribe. Contact form messages: 24 months.
Who we share it with
We never sell your data. We share the minimum necessary with: Stripe (payments), our courier (delivery address), our email provider (order confirmations and newsletters), and our booking software. All are bound by data processing agreements. Where a provider processes data outside the UK, we rely on the UK International Data Transfer Addendum or adequacy regulations.
How we keep it safe
The site runs over HTTPS with a valid TLS certificate. Appointment and order records are held in access-controlled systems protected with multi-factor authentication, and access is limited to the people who need it to serve you. We take encrypted backups daily, retained for 30 days, and test restores quarterly. We keep our software and dependencies patched, and we will report any qualifying breach to the ICO within 72 hours and tell you directly where there is a high risk to you.
Your rights
Under UK GDPR you have the right to access your data, correct it, have it erased, restrict or object to processing, and receive a portable copy. To exercise any of these, email mundo_fit_naturaluk@outlook.com. We respond within one month. If you are unhappy with our response you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Children
We do not knowingly collect data from children under 16. Where we sell products for children, the account and order belong to the parent or guardian.
Changes to this policy
If we make a material change we will update the date at the top of this page and, where the change affects how we use data you have already given us, email you about it.
Questions about this page? Email mundo_fit_naturaluk@outlook.com or message us on Instagram at @mundo_fit_natural.