Privacy

Last reviewed 15 September 2026.

Who we are

This notice explains how sarmsstore.co.uk (the Site) collects and uses personal data. The operator of the Site is the data controller. To contact us about your data, use the live chat on any page or the contact form.

What we collect

When you visit the Site we collect device information: IP address, browser type, time zone, the pages you view, the site you arrived from and how you interact with pages. We collect it through cookies, log files and analytics tags (Google Analytics, Microsoft Clarity, Shopify analytics). When you order we collect order information: name, delivery and billing address, email address, phone number, what you bought and how you paid. We never see your full card number; card and open banking payments are processed by our payment providers. If you contact us we keep the correspondence. If you subscribe to email updates we keep your email address and how you interact with our emails.

Why we use it and the lawful basis

To fulfil your order, deliver it and handle returns (performance of a contract). To send order confirmations and delivery updates (performance of a contract). To answer your questions (legitimate interests). To send research updates and offers by email where you have subscribed (consent, withdrawable at any time via the unsubscribe link). To detect fraud and verify age (legitimate interests and legal obligation). To keep accounting records (legal obligation). To improve the Site using analytics (legitimate interests; you can decline non-essential cookies in the banner).

Who we share it with

Shopify Inc, which hosts the store and processes orders (Shopify privacy policy). Payment providers: Boodil (open banking) and our card payment link provider. Postal and courier services, for delivery. Intuit Mailchimp, for email updates. Gorgias, for customer support. Google, Microsoft and Meta, for analytics and advertising measurement. Okendo, for product reviews you choose to leave. Our accountants and, where required by law, HMRC or other authorities. We do not sell personal data.

International transfers

Some providers process data outside the UK. Where they do, transfers rely on the UK International Data Transfer Agreement or UK adequacy regulations.

How long we keep it

Order records six years after the order, for tax and legal purposes. Email subscriptions until you unsubscribe, after which we keep a suppression record so we do not email you again. Support correspondence two years. Analytics data per the provider's retention setting (Google Analytics 14 months).

Your rights

You can ask for a copy of your data, ask us to correct or delete it, restrict or object to its use, or ask for it in a portable format. Contact us via live chat or the contact form. We respond within one month. You can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

Essential cookies run the cart and checkout. Analytics and advertising cookies are set only if you accept them in the banner, and you can change your choice at any time from the cookie preferences link in the footer.

Age

The Site is for customers aged 18 and over. We do not knowingly collect data from anyone under 18.

Changes

We update this notice when our processing changes and show the review date at the top.