Privacy policy

At Wild Oats Limited, we respect your privacy and take care to protect your personal information.

This Privacy Notice explains what information we collect, why we use it, who we may share it with, how long we keep it and the rights you have over your information.

Who we are

Wild Oats Limited is a company registered in England and Wales under company number 08365294.

For the purposes of UK data protection law, Wild Oats Limited is the data controller responsible for your personal information.

Our address is:

Wild Oats Limited
9-11 Lower Redland Road
Bristol
BS6 6TB
Website: woats.pro

If you have any questions about how we use your personal information, or would like to exercise any of your data protection rights, please email us at enquiries@wild-oats.co.uk.

What information we collect

The information we collect depends on how you interact with us. It may include:

• your name;
• billing and delivery address;
• email address and telephone number;
• details of your orders and purchases;
• customer account details;
• loyalty card number and loyalty scheme details;
• marketing preferences;
• payment and transaction information;
• emails or other communications you send to us;
• information about how you use our website, such as your IP address, browser/device information and website activity; and
• CCTV images if you visit our shop.

We do not knowingly collect personal information from children and our website is not specifically aimed at children.

How we use your information

We only use personal information where we have a lawful reason to do so.

Process and manage your orders

We use information such as your name, contact details, delivery address and order information to process purchases, take payment, arrange delivery and communicate with you about your order.

Our lawful basis is that this information is necessary to fulfil our contract with you.

Manage your customer account

If you create an online account, we use your information to provide and manage that account and your relationship with us.

Our lawful basis is the performance of our contract with you and, where appropriate, our legitimate interest in providing and managing our customer services.

Operate our loyalty scheme

If you join our loyalty scheme, we use information such as your name, contact details, postcode and loyalty card number to manage your membership and provide loyalty benefits. Joining our loyalty scheme does not automatically subscribe you to marketing emails.

Our lawful basis is the performance of our agreement with you and our legitimate interest in operating and managing our loyalty scheme.

Respond to enquiries and provide customer service

We use the information you give us to answer questions, resolve problems, deal with complaints and provide customer service.

Depending on the enquiry, our lawful basis may be our contract with you or our legitimate interest in providing good customer service and managing our business.

Meet our legal and financial obligations

We may retain and use information where necessary to comply with legal, accounting, tax or regulatory requirements.

Our lawful basis is compliance with our legal obligations.

Protect our business, customers and staff

We may use information where reasonably necessary to prevent fraud, protect our systems and investigate or defend legal claims.

Our lawful basis is our legitimate interest in protecting our customers, staff and business.

Payments

Online payments are processed using Shopify Payments, including Shop Pay and card payments, and PayPal.

Payments made in our shop, including certain telephone payments, are processed using ClearAccept.

Payment providers process information necessary to complete your payment. Wild Oats does not retain customers' full payment card details after a payment has been processed.

These payment providers have their own responsibilities for how they process and protect your payment information.

Deliveries

Local deliveries are carried out by our own employees rather than an external courier.
We use the customer information necessary to complete the delivery, such as the customer's name, delivery address and relevant contact/order information.

Our loyalty scheme

We operate a Wild Oats loyalty scheme.

We may collect your name, email address, telephone number, postcode and loyalty card number to create and manage your loyalty account.

Our loyalty system is operated using Vector EPOS from CSY, with the loyalty database stored on our shop server.

Joining the loyalty scheme does not automatically sign you up to receive marketing.

Email marketing

We only send you marketing emails where you have chosen to receive them.

We use Klaviyo to manage our email marketing. Klaviyo may hold information such as your name, email address, telephone number, postcode/location, marketing preferences and information about your interaction with our emails and website.

For example, we may be able to see whether a marketing email has been opened or a link has been clicked.

Our lawful basis for sending marketing emails is your consent.

You can unsubscribe at any time by using the unsubscribe link in any marketing email.

If you unsubscribe, we will stop sending you marketing emails. We may keep a record of your preference so that we can make sure you do not receive marketing you have opted out of.

Joining our loyalty scheme, or making a purchase does not automatically subscribe you to marketing.

Our website and cookies

Our online shop is operated using Shopify.

Our website uses cookies and similar technologies. Cookies are small files stored on your device when you visit a website.

Some cookies are necessary for our website and online shop to work. Others may help us understand how our website is used, remember your preferences or support our marketing activities.

Necessary cookies

These are needed for important functions such as the shopping basket, checkout, security and other features you request. Where a cookie is strictly necessary to provide the service you have requested, your consent is not required.

Analytics and performance

With your consent where required, we may use analytics technologies to understand how visitors use our website and help us improve it. These may include technologies provided by Shopify and Google Analytics.

Functional cookies

These support additional website functions and can help the website remember choices or preferences you make.

Marketing cookies

With your consent, we may use cookies and similar technologies to understand customer engagement and support or measure our marketing. These may include technologies provided by Shopify, Google and Klaviyo.

Managing cookies

When you first visit our website, you can use our cookie banner to accept or reject non-essential cookies or manage your preferences.

Our cookie consent system is provided through Consentmo.

You can also control and delete cookies using your browser settings, although blocking some cookies may affect how our website works.

CCTV

CCTV operates within our shop for the safety and security of our customers, staff and premises and to help prevent and investigate crime or other incidents.

CCTV records video only; it does not record audio.

Recordings are normally kept for six weeks and can only be accessed by authorised managers.

We may provide relevant footage to the police, insurers or other appropriate organisations where it is necessary and lawful to do so.

Our lawful basis for using CCTV is our legitimate interest in protecting our customers, staff, property and business.

Who we share your information with

We do not sell your personal information.

Where necessary, we may share or allow access to personal information with trusted companies that help us operate our business, including:

• Shopify, which provides our online shop and Shopify Payments;
• PayPal, where you choose PayPal to make a payment;
• ClearAccept, which processes card payments in our shop;
• Klaviyo, which provides our email marketing platform;
• Hosting UK, which provides website hosting and domain services;
• Consentmo, which provides our website cookie consent system;
• CSY, which provides our Vector EPOS system;
• Microsoft, which provides our Microsoft 365 business email services;
• our IT support provider, where access to our systems is necessary to provide technical support; and
• professional advisers, regulators, law enforcement or other organisations where we are legally required or reasonably need to disclose information.

We only share the information reasonably necessary for the relevant purpose.

Information processed outside the UK

Some of the companies that provide services to us operate internationally, so your personal information may sometimes be processed outside the UK.

Where this happens, we make sure appropriate safeguards are in place as required by UK data protection law. These may include UK adequacy arrangements or approved contractual safeguards designed to protect your information.

You can contact us if you would like more information about the safeguards that apply to your information.

How long we keep your information

We only keep personal information for as long as we reasonably need it, including to provide our services and meet legal, accounting and regulatory requirements.

Different information therefore has different retention periods. For example:

• paper customer order records are normally kept for 28 days and then securely destroyed;
• ordinary customer enquiries are normally deleted once they have been dealt with, unless we need to keep them for an ongoing order, complaint, legal or other legitimate reason;
• CCTV recordings are normally kept for six weeks;
• marketing information is kept while you remain subscribed, and we may retain enough information after you unsubscribe to record and respect your preference;
• customer and loyalty accounts are kept while they are active and are normally deleted or anonymised after 3 years of inactivity, unless we need to keep some information for legal, accounting or other legitimate reasons; and
• order and transaction information may be retained for longer where necessary for accounting, tax, legal, fraud prevention or dispute-resolution purposes.

We periodically review the personal information we hold and delete or anonymise information when we no longer have a reason to keep it.

Keeping your information secure

We take appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

Access to systems containing personal information is limited to employees and service providers who need access for their work, and appropriate security measures such as passwords and access controls are used.

Paper records containing personal information are securely disposed of when they are no longer required.

Your rights

UK data protection law gives you rights over your personal information. Depending on the circumstances, these can include the right to:

• ask us for a copy of the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete your information;
• ask us to restrict how we use your information;
• object to certain uses of your information;
• receive certain information in a portable format; and
• withdraw your consent where we rely on consent.

You have the right to object where we process your personal information on the basis of our legitimate interests. You also have the right to object to the use of your personal information for direct marketing.

These rights do not apply in every situation and sometimes we may need to keep or continue using information for legal or other permitted reasons.

To exercise your rights, email enquiries@wild-oats.co.uk.

We may need to ask you for enough information to confirm your identity before dealing with a request.

Complaints about your personal information

If you are concerned about how we have collected or used your personal information, please contact us at enquiries@wild-oats.co.uk.

We will acknowledge a data protection complaint within 30 days and will investigate it and respond without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

You can find information about making a complaint at ico.org.uk.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time, for example if our services, systems or legal obligations change.

The latest version will always be available on our website. Where appropriate, we will bring significant changes to your attention.

===

Last updated: September 2026