Privacy policy

Last updated: 19 April 2026

1. Who we are

Clinical Services Group Ltd ("we", "us", "our") operates the NAD+ Life® brand and this website (nadpluslife.co.uk). We are the data controller for personal data collected via this website.

Company number: 15967942
Registered address: 28 Maises Way, South Normanton, Derbyshire, DE55 2DS
ICO registration: ZB760358
CQC registration: 1-26088938261

For any privacy-related questions or to exercise your data protection rights, contact us at orders@nadpluslife.co.uk or by post at the address above.

2. What data we collect

When you visit our website, place an order, or contact us, we may collect:

- Identity & contact data: name, email address, delivery and billing address, telephone number
- Order data: items purchased, order history, delivery preferences
- Payment data: processed directly and securely by our payment provider. We do not store full card details on our servers
- Communication data: emails, messages, and support tickets you send us
- Marketing data: your marketing preferences and consent records
- Technical data: IP address, browser type and version, device identifiers, operating system, referral source
- Usage data: how you use our website (pages visited, products viewed, session duration)
- Cookie data: see Section 8

We do not operate customer accounts — all purchases are completed via guest checkout. We do not collect health or medical data on this website. NAD+ Life products are wellness supplements, and this site does not provide clinical consultations or prescription services.

3. How we use your data and our legal basis

Under UK GDPR, we rely on the following legal bases for processing your personal data:

- Process and fulfil your order — Contract performance
- Deliver your order via courier — Contract performance
- Provide customer service — Contract performance
- Send order-related emails (confirmations, shipping updates) — Contract performance
- Send marketing emails and promotions — Consent (you can withdraw at any time)
- Prevent fraud, secure our systems, and protect our business — Legitimate interests
- Analyse website usage to improve our service — Legitimate interests / consent (cookies)
- Comply with tax, accounting, consumer protection, and regulatory obligations — Legal obligation

4. Who we share your data with

We share your personal data only with the following categories of recipients:

- Delivery partners (Royal Mail and couriers) — to deliver your order
- Payment processors — Shopify Payments and other authorised processors — for secure transaction handling
- Shopify Inc. — our e-commerce platform provider (Canada, with data hosting in multiple regions)
- Klaviyo Inc. — our email marketing platform, hosted in EU data centres — if you have consented to marketing
- Google LLC — Google Analytics for website performance measurement (USA)
- Professional advisors — accountants, auditors, and legal advisors where required
- Regulatory bodies — MHRA, HMRC, ICO, Trading Standards, CQC — where legally required

We never sell your personal data to third parties.

5. International data transfers

Some of our service providers are based outside the UK, including in the USA and Canada. When we transfer your data internationally, we ensure it is protected by one or more of the following safeguards:

- UK adequacy regulations (where applicable)
- International Data Transfer Agreements (IDTAs) or the UK Addendum to the EU Standard Contractual Clauses
- EU–US Data Privacy Framework (where the recipient is certified)

For more information about the safeguards used by specific providers, contact us at orders@nadpluslife.co.uk.

6. How long we keep your data

We retain your personal data only for as long as necessary:

- Order and transaction records — 6 years (UK tax law, HMRC)
- Customer service emails — 3 years from last contact
- Marketing consent and preferences — until withdrawn, plus 2 years for audit purposes
- Website analytics (Google Analytics) — 14 months
- Marketing automation data (Klaviyo) — until consent is withdrawn
- Cookie data — as specified per cookie (see Section 8)

After the retention period, we securely delete or anonymise your data.

7. Your rights under UK GDPR

You have the following rights:

- Right of access — request a copy of the data we hold about you
- Right to rectification — correct inaccurate or incomplete data
- Right to erasure ("right to be forgotten") — request deletion of your data, subject to legal retention requirements
- Right to restrict processing — ask us to limit how we use your data
- Right to data portability — receive your data in a portable format
- Right to object — object to processing based on legitimate interests or direct marketing
- Right to withdraw consent — where we rely on consent, you can withdraw it at any time
- Right not to be subject to automated decision-making — we do not make solely automated decisions that have legal or significant effects on you

To exercise any of these rights, email us at orders@nadpluslife.co.uk. We will respond within one month of your request, as required by UK GDPR. This service is free unless your request is manifestly unfounded or excessive.

8. Cookies and tracking

Our website uses cookies and similar technologies. When you first visit, our cookie banner lets you accept or reject non-essential cookies.

Categories we use:

- Strictly necessary — required for the site to function (shopping cart, checkout, session). Always on.
- Analytics — Google Analytics. Measures website performance. Set only with your consent.
- Marketing — Klaviyo tracking for email measurement. Set only with your consent.
- Functional — remembers your preferences (e.g. language, region). Set only with your consent.

You can change your cookie preferences at any time via the cookie settings on our website or by clearing cookies in your browser.

9. Marketing communications

We will only send you marketing emails if you have given explicit consent (e.g. by subscribing to our newsletter or opting in at checkout).

You can unsubscribe at any time by:

- Clicking the "unsubscribe" link in any marketing email
- Contacting us at orders@nadpluslife.co.uk

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal, nor does it affect transactional emails about orders you've placed.

10. Automated decision-making

We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing. Some fraud-prevention checks run automatically through our payment processor, but these do not determine access to services on their own.

11. Security

We use industry-standard technical and organisational measures to protect your data, including:

- Encrypted connections (HTTPS/TLS) across the whole site
- Secure hosting via Shopify (PCI DSS Level 1 compliant)
- Access controls limiting staff access to personal data
- Regular security reviews and updates

12. Children

Our products and services are not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If you become aware that a child has provided personal data to us, please contact us and we will remove it.

13. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with a revised "last updated" date. If we make material changes, we will make reasonable efforts to notify customers of those changes where appropriate.

14. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at orders@nadpluslife.co.uk. You also have the right to lodge a complaint with the UK's data protection authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk

15. Contact us

Clinical Services Group Ltd
28 Maises Way, South Normanton, Derbyshire, DE55 2DS
Email: orders@nadpluslife.co.uk
Phone: 0115 882 0039
Company No. 15967942
ICO Registration: ZB760358
CQC Registration: 1-26088938261