Privacy Policy
Last updated: 19 July 2026
Who we are
Heldi LTD ("Heldi", "we", "us") is a company registered in England and Wales (company number 17179772), with its registered office at:
71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
We are the data controller for personal information collected through heldi.co.uk. Contact us about privacy at info@heldi.co.uk.
What we collect and why
| What | When | Why (lawful basis) |
|---|---|---|
| Email address | You join the waitlist | To email you when we launch (consent, you can unsubscribe any time). If you also tick the box for our weekly email, we send you Heldi Living articles, recipes and occasional offers until you unsubscribe (consent) |
| Name, email, delivery address, phone | You place an order | To fulfil and deliver your order and send order updates (performance of a contract) |
| Payment details | You pay at checkout | Processed entirely by Shopify Payments / your payment provider — we never see or store your card details (performance of a contract) |
| Order history | You shop with us | Customer support, refunds, fraud prevention, and our legal record-keeping duties (legal obligation, legitimate interests) |
| Emails you send us | You contact us | To reply and help (legitimate interests) |
| Anonymous usage statistics | You browse the site | Aggregate counts of visits and page use, with no cross-visit identifier and IP addresses discarded; see the Cookie Policy for the free opt-out (legitimate interests, statistical purposes) |
| Analytics identifier, usage events and session replays (typed text hidden) | Only after you choose "Accept all" in the cookie window | Understanding how the site is used so we can improve it (consent, withdrawable any time on the Cookie Policy page) |
We do not sell personal information. We do not send marketing emails without consent.
Who we share it with
We use a small number of service providers who process data on our behalf:
- Shopify — checkout, payments and order management
- Vercel — website hosting
- PostHog — website analytics, hosted in the EU (Frankfurt); receives usage events and, only with your consent, session replays with typed text hidden
- Royal Mail — delivery (name and address on the parcel)
- Supabase — secure database storage for waitlist signups and review submissions
- Klaviyo — sending our emails: the launch announcement, the weekly Heldi Living email if you asked for it, and order emails once the shop is live
Each provider only receives what it needs to do its job. Some providers store data outside the UK; where they do, transfers are protected by UK-approved safeguards (adequacy regulations or standard contractual clauses).
We may also disclose information where the law requires it.
How long we keep it
- Waitlist emails: until you unsubscribe or 2 years of inactivity
- Order records: 6 years (tax and accounting law)
- Support emails: 2 years after the query is closed
- Analytics events and session replays: 12 months, then deleted
Your rights
Under UK GDPR you can ask us to access, correct, delete, restrict or port your personal data, and you can object to processing based on legitimate interests. You can withdraw consent (e.g. unsubscribe) at any time. Email info@heldi.co.uk and we will respond within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).
Cookies and local storage
See our Cookie Policy.
Changes
We will post any changes to this policy on this page and update the date above.