Privacy Policy

Last Updated: 26 August 2026

1. Introduction

Welcome
to Indigo Rock ltd trading as HELD ("we", "our", "us").

We are committed to protecting your privacy and handling your personal information
responsibly, fairly, and transparently.

This Privacy Policy explains how we collect, use, store, and protect your personal
data when you:

visit our website;
create an account;
purchase our products;
subscribe to our emails;
contact us;
interact with our marketing.

We process your personal information in accordance with the UK General Data
Protection Regulation (UK GDPR), the Data Protection Act 2018, and other
applicable UK privacy laws.

2. Who We Are

Company Name:
Indigo Rock ltd

Registere in: England and Wales

Registered Office: 167-169
Great Portland Street, London, England, W1W 5PF

Company Number: 12303058

Email: info@heldhealth.co

If you have any questions regarding this Privacy Policy or your personal
information, please contact us using the details above.

3. Personal Information We Collect

Depending on how you use our website, we may collect:

Identity Information

Name
Title

Contact Information

Email address
Telephone number
Billing address
Shipping address

Account Information

Login details
Password (encrypted and managed by Shopify)
Account preferences

Order Information

Products purchased
Order history
Payment status
Delivery information

Payment Information

Payments are securely processed by Shopify Payments and/or approved third-party payment providers.

We do not store your full payment card details.

Technical Information

IP address
Browser type
Device information
Operating system
Time zone
Cookie identifiers

Usage Information

Pages viewed
Time spent on the website
Products viewed
Shopping cart activity
Referral source

Marketing Information

Email marketing preferences
Competitions entries
Survey responses
Product reviews
Customer feedback

4. How We Collect Your Information

We collect information when you:

place an order;
create an account;
subscribe to our newsletter;
contact customer support;
browse our website;
leave a review;
enter promotions;
interact with our advertisements;
consent to cookies.

5. How We Use Your Information

We use your personal information to:

process and fulfil your orders;
deliver products;
manage your account;
respond to enquiries;
process payments;
prevent fraud;
improve our website;
analyse website performance;
send order confirmations and updates;
send marketing communications where you have consented or where permitted by law;
comply with legal obligations.

6. Legal Bases for Processing

We process your personal information under one or more of the following lawful
bases:

Contract

To fulfil your order and provide our services.

Legal Obligation

To comply with tax, accounting, consumer protection, and other legal requirements.

Legitimate Interests

To improve our services, prevent fraud, secure our website, and manage our
business, provided these interests do not override your rights.

Consent

Where required, including for:

email marketing;
non-essential cookies;
certain advertising technologies.

You may withdraw your consent at any time.

7. Marketing Communications

If you choose to receive marketing emails, we may send information about:

new products;
promotions;
special offers;
educational content;
company updates.

You can unsubscribe at any time by:

clicking the unsubscribe link in any email; or
contacting us directly.

8. Cookies

We use cookies and similar technologies to:

operate our website;
improve user experience;
analyse website traffic;
personalise content;
measure advertising performance.

For further information, please see our Cookie Policy.

9. Sharing Your Information

We only share personal information where necessary.

This may include:

Shopify

To operate our online store.

Payment Providers

To process payments securely.

Delivery Companies

To deliver your purchases.

Email Marketing Providers

To send newsletters and marketing communications where permitted.

Analytics Providers

To understand website performance.

Professional Advisers

Including accountants, solicitors, insurers, and auditors.

Government Authorities

Where required by law or regulatory obligation.

We do not sell your personal information.

10. International Transfers

Some of our service providers may process personal information outside the United
Kingdom.

Where this occurs, we ensure appropriate safeguards are in place, including approved
contractual protections or other lawful transfer mechanisms.

11. Data Security

We implement appropriate technical and organisational measures to protect your
information, including:

encrypted website connections (SSL/TLS);
secure payment processing;
access controls;
password protection;
regular security updates.

No method of transmission over the internet is completely secure, but we take
reasonable steps to protect your information.

12. Data Retention

We
retain personal information only for as long as necessary to:

fulfil orders;
comply with legal obligations;
resolve disputes;
enforce our agreements.

Retention periods vary depending on the type of information and applicable legal
requirements.

13. Your Rights

Under UK data protection law, you may have the right to:

access your personal information;
correct inaccurate information;
request deletion of your information;
restrict processing;
object to processing;
request data portability;
withdraw consent where processing is based on consent;
lodge a complaint with the Information Commissioner's Office (ICO).

We may request proof of identity before responding to certain requests.

14. Children's Privacy

Our website is not intended for children under the age of 18.

We do not knowingly collect personal information from children.

If you believe a child has provided personal information to us, please contact us
so we can remove it.

15. Third-Party Websites

Our website may contain links to third-party websites.

We are not responsible for the privacy practices or content of those websites.

We encourage you to review their privacy policies before providing personal
information.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Any changes will be published on this page together with the revised "Last
Updated" date.

17. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal
information, please contact us:

Company:
Indigo Rock ltd

Registered Address:
167-169 Great Portland Street, London, England, W1W 5PF

Email:
info@heldhealth.co

18. Complaints

If you are unhappy with how we
handle your personal information, we would appreciate the opportunity to address
your concerns first.

You also have the right to lodge a complaint with the Information Commissioner's
Office (ICO), the UK's independent authority for data protection matters.