Effective Date: 12 August 2026 · Version: 2026-08-12
Who we are
PHOnlineResearch Ltd is the data controller for personal data collected through phantom.health.
Registered office: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF
Company number: 17217268
Data protection contact: [email protected]
ICO registration: applied for, 12 August 2026 (application C2006241)
What we collect and why
| What we collect | Why | Lawful basis |
|---|---|---|
| Name, email, delivery and billing address, phone | To take, process and deliver your order | Performance of a contract |
| Order history and payment status | To fulfil orders, handle returns, and keep accounting records | Contract, and legal obligation for the accounting record |
| Account credentials, where you register | To operate your account | Contract |
| Your acceptance of our terms: the version accepted, date, time and IP address | To evidence the contract and our compliance position | Legitimate interests |
| Security and fraud logs, including IP address and login attempts | To protect the site and detect fraud | Legitimate interests |
| Marketing preferences and email subscriptions | To send you updates you have asked for | Consent |
| Website analytics | To understand how the site is used | Consent, via our cookie banner |
We collect only what we need. We do not collect special category data, and we ask you not to send us health information about yourself or anyone else.
Cookies
Essential cookies, which keep your basket and session working, are set automatically because the site cannot function without them.
All other cookies — analytics, advertising and preference cookies — are only set if you consent through our cookie banner. You can change or withdraw your consent at any time using the banner.
Who we share data with
We share personal data only with organisations that help us run the business:
- Payment processing: Wallid
- Delivery: Royal Mail
- Website hosting and email delivery: Hostinger
- Site security: Wordfence
- Analytics: Google Analytics, only where you consent via the cookie banner
- Our accountant, for statutory accounting purposes
- Legal or regulatory authorities, where we are required by law to disclose
We do not sell personal data.
Transfers outside the UK
Some of the providers above process data outside the UK — principally Google Analytics. Where that happens, we rely on UK adequacy regulations or on the International Data Transfer Addendum to the EU Standard Contractual Clauses.
How long we keep it
- Order and transaction records: six years from the end of the financial year, as required for tax and company records
- Terms acceptance records: six years, alongside the related order
- Account data where no orders were placed: two years of inactivity, then deletion
- Marketing consents: until you withdraw them
- Security logs: twelve months
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct anything inaccurate
- Erase your data, subject to records we must keep by law
- Restrict or object to how we use it, including objecting to processing based on legitimate interests
- Portability — receive your data in a machine-readable format
- Withdraw consent at any time, where we rely on consent
To exercise any of these, email [email protected]. We will respond within one month.
Note that we are legally required to retain order records for six years, so an erasure request will not remove your transaction history. We will remove everything we are not required to keep.
Complaints
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113.
Changes
We may update this policy. Each version carries an effective date, and we keep previous versions.
Governing law
This policy is governed by the laws of England and Wales.
