Privacy Policy

Last updated: 28 July 2026. This policy explains how Yes Papa Ltd collects, uses and protects your personal data.

1. Who we are (data controller)

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is:

Yes Papa Ltd (formerly Sun Supplement Limited)
Registered office: 71-75 Shelton Street, London, England, WC2H 9JQ, United Kingdom
Company number: 15879634 (England & Wales)
Email: sam@gwsupplements.co.uk
Phone: +44 7931 420 543

We trade online as GWS Supplements (Get Well Soon Supplements).

2. What personal data we collect

We collect the following categories of personal data:

• Identity & contact: name, billing address, delivery address, email address, phone number.
• Order & transaction: products ordered, order value, order history, delivery preferences.
• Payment: payment-method type and the last four digits of your card. We do not store full card numbers, card expiry dates or CVV codes — these are handled directly by our PCI-DSS compliant payment processor.
• Account (if you register): username, password (hashed), order history, saved addresses.
• Communications: emails you send us, customer-service correspondence, complaints and reviews.
• Technical & usage: IP address, browser type, device type, pages visited, referring URL, approximate location (city/country), collected automatically by our hosting and analytics tools.
• Cookies & similar: see the Cookies section.

3. How we use your data and our legal basis

Purpose	Type of data	Legal basis (UK GDPR)
Take and fulfil your order, deliver products, process payment, handle returns	Identity, contact, order, payment	Contract (Art 6(1)(b))
Comply with tax, accounting and record-keeping obligations	Order, transaction	Legal obligation (Art 6(1)(c))
Detect and prevent fraud, abuse, and security incidents	Technical, order, payment	Legitimate interests (Art 6(1)(f)) — keeping customers and our business safe
Respond to enquiries, complaints, and customer-service requests	Identity, contact, communications	Legitimate interests (Art 6(1)(f)) — running our business well
Improve our website, products and customer experience	Technical, usage	Legitimate interests (Art 6(1)(f))
Marketing emails about our products, offers and news (only if you opt in)	Identity, contact	Consent (Art 6(1)(a)) — you can withdraw at any time

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.

4. Who we share data with

We do not sell your personal data. We share it only with carefully selected third parties who help us run the business:

• Payment processor — to take and verify your payment.
• Couriers and delivery partners — to deliver your order.
• Hosting and IT service providers — to operate the website and store data securely.
• Accountants and professional advisers — for tax and audit purposes only.
• Law-enforcement or regulators — only where we are legally required to do so.

Each of these parties is bound by data-protection obligations equivalent to ours under UK GDPR.

5. International transfers

Some of our service providers (for example, payment processors and our hosting infrastructure) may store or process data outside the UK, including in the United States and the European Economic Area. Where this happens, we ensure an appropriate safeguard is in place, such as:

• the recipient is based in a country the UK government has deemed adequate for data protection, or
• we use the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

6. How long we keep your data

Type of data	Retention period
Order, transaction and invoice records	6 years from the date of the transaction (HMRC requirement)
Customer-service correspondence and complaints	6 years from the date of last contact
Marketing consent records	Until you withdraw consent (and 1 year after for audit)
Account data	Until you delete your account, plus 6 years for the underlying orders
Website analytics (aggregated)	Up to 26 months

7. Your rights under UK data protection law

You have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct data that is wrong or incomplete.
• Right to erasure (“right to be forgotten”) — ask us to delete your data in certain circumstances.
• Right to restriction — ask us to suspend processing of your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent — at any time, where processing is based on consent.
• Right to complain — to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint/.

To exercise any of these rights, please contact us at sam@gwsupplements.co.uk. We will respond within 1 month (extendable to 3 months for complex requests, in which case we will tell you why).

8. Cookies

Our website uses cookies and similar technologies. Cookies are small text files placed on your device when you visit our site. We use them to:

• Strictly necessary cookies — for the shopping basket, checkout and account login (these cannot be disabled).
• Functional cookies — to remember preferences such as currency and recently viewed products.
• Analytics cookies — to understand how visitors use our site (aggregated, anonymous).
• Marketing cookies — only with your consent.

You can manage your cookie preferences at any time via your browser settings or our cookie banner.

9. How we protect your data

We take the security of your data seriously and use appropriate technical and organisational measures, including:

• HTTPS encryption in transit;
• PCI-DSS compliant payment processing (we never store full card details);
• Access controls and least-privilege principles for staff;
• Regular backups and monitoring;
• Vendor due diligence for all third-party processors.

No system is 100% secure. If you suspect a security issue, please contact us immediately.

10. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a revised “Last updated” date. For material changes that affect your rights, we will notify you by email or by a prominent notice on the website.

11. How to contact us

If you have any questions about this policy or how we handle your data, please contact:

Yes Papa Ltd (Data Protection enquiries)
71-75 Shelton Street, London, England, WC2H 9JQ
Email: sam@gwsupplements.co.uk
Phone: +44 7931 420 543