Sans (UK) Privacy Policy

Effective date: 10 November 2025

1. Who we are

This Privacy Policy explains how Sans (“we”, “us”, “our”) handles your personal data in the United Kingdom when you visit our site, purchase our products, contact support, or receive our marketing.

Controller: Living Well Solutions UK Ltd, 124–128 City Road, London, England, EC1V 2NX
Privacy contact: hi@livesans.co.uk

We may update this notice from time to time. We will revise the effective date above and, where appropriate, notify you of material changes.

2. Personal data we collect

2.1 Data you provide

Orders & account: name, billing/shipping address, email, phone, order details, and payment information (processed by our payment provider; we do not store full card details).
Support: information about your enquiry, order context, communications and attachments.
Marketing preferences: your email/SMS opt-in choices and topic preferences.

2.2 Data collected automatically

Device & usage data: IP address, device identifiers, browser type, time zone, pages viewed, links clicked, referrers, session timing.
Cookies & similar technologies: identifiers and signals set/read on your device. See Section 6 (Cookies & similar technologies).

2.3 Data from third parties

Ecommerce & delivery: updates from our platforms and carriers to process and deliver orders.
Analytics/advertising: aggregated and identifier-based signals from our analytics/ads partners (only after consent where required).

3. How we use personal data and our lawful bases

Purpose	Examples	Lawful basis
Purchases & fulfilment	process payment, prevent fraud, ship via Evri, manage returns/warranties, issue invoices	Contract; Legitimate interests (fraud prevention)
Customer support	respond to enquiries, quality assurance	Legitimate interests; Contract
Account & preferences	manage profile, addresses, subscriptions	Contract
Legal & compliance	tax/audit records, responding to lawful requests	Legal obligation
Analytics & performance	measure and improve site performance and UX	Consent (for non-essential cookies)
Marketing (email/SMS)	news, offers, product updates; unsubscribe any time	Consent (or soft opt-in for similar products by email, where permitted)
Advertising & ad matching	retargeting, lookalike audiences, campaign measurement	Consent
Security	detect abuse, protect services and users	Legitimate interests

You may withdraw consent at any time. You have an absolute right to object to direct marketing at any time.

4. Disclosures of personal data

We share personal data with:

Ecommerce & payments: Shopify (store platform), Shopify Payments (payments).
Delivery & logistics: Evri (carrier).
Marketing & communications: Klaviyo (email), Attentive (SMS).
Analytics & advertising: Northbeam, Google Analytics 4, Google Ads, Meta, Microsoft/Bing Ads, TikTok, Google Tag Manager (tag deployment).
Product analytics/UX: Microsoft Clarity (session analytics with masking).
Data layer / identity services: Fueled (data layer/identity/attribution services).
Professional services & authorities: auditors, advisors, insurers, and public authorities where required by law.

Depending on context, partners act as processors (on our instructions) or independent controllers. We have appropriate contracts in place. We do not sell your personal data.

5. Advertising & ad matching

Where you consent to marketing/advertising cookies, we may use ad matching (e.g., uploading a hashed email to platforms such as Meta/Google/Klaviyo/Attentive) to find or reach audiences with similar interests, measure performance, and reduce irrelevant ads.

Ad matching runs only after your consent and can be turned off in Cookie Settings.
You can also control ads in-platform (e.g., Meta Ad Preferences, Google Ad Settings, Microsoft/Bing, TikTok).
We do not permit partners to store/sell/monetize your data for their own purposes.

6. Cookies & similar technologies (PECR)

We use essential cookies required for our store to function and, with your consent, analytics and advertising cookies.

Consent first: non-essential cookies (e.g., GA4, Northbeam, Meta, Google Ads, Bing, TikTok, Klaviyo web tracking, Microsoft Clarity) are not set unless you opt in via our cookie banner/controls.
Manage choices: use the Cookie Settings link (in our footer) to accept, reject, or change categories at any time.
Browser controls: you can also manage cookies in your browser; blocking cookies may affect site functionality.

We treat online identifiers (cookie IDs, advertising IDs, IP addresses) as personal data where they can be linked to you or your device.

A summary of our cookies and pixels appears in Appendix A – Cookie & Pixel Table.

7. International transfers

Some recipients are outside the UK. Where we transfer personal data internationally we use:

The UK–US Data Bridge (extension of the EU–US Data Privacy Framework) where the recipient participates; or
The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, plus supplementary measures where appropriate.

Further details are available on request.

8. Retention

We keep personal data only as long as needed for the purposes above and to meet legal, accounting, and reporting requirements:

Orders & invoices: 6 years (tax/audit).
Customer support: up to 36 months from your last interaction. Where a support matter relates to a contract, warranty or potential claim, we may retain relevant records up to 6 years to establish, exercise or defend legal claims.
Marketing (email/SMS): 24 months from your last interaction or until you unsubscribe/withdraw consent, whichever is sooner. We keep a minimal suppression record indefinitely to ensure we do not contact you after you opt out.
Cookie consent records: up to 24 months (or the period configured in our consent tool) to honour your settings.

We then delete or irreversibly anonymise the data.

9. Your rights (UK)

You have the right to access, rectify, erase, restrict, port, and object to processing. You can withdraw consent at any time. You have an absolute right to object to direct marketing.

We do not make decisions solely by automated means that produce legal or similarly significant effects. If this changes, we will tell you and enable human review and a right to contest a decision.

To exercise your rights, email hi@livesans.co.uk. We may ask for information to verify your identity. We will respond within one month (extendable by up to two further months for complex requests; we will let you know if we need more time).

You may complain to the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint. We would appreciate the chance to resolve your concerns first.

10. Security

We implement appropriate technical and organisational measures including encryption in transit (and at rest where supported by vendors), access controls and least-privilege, vendor due diligence and DPAs, staff training, and incident response procedures. No system is perfectly secure; we review and improve our controls regularly.

11. Children

Our site and services are not intended for children under 13. If you believe we have collected personal data about a child, please contact us and we will delete it.

12. Contact

Living Well Solutions UK Ltd
124–128 City Road, London, England, EC1V 2NX
Email: hi@livesans.co.uk

Appendix A – Cookie & Pixel Table (summary)

Non-essential cookies/pixels load only after consent. You can change choices any time via Cookie Settings. Names and durations may change as vendors update their services.

Category	Provider	Example identifiers	Purpose	Typical duration
Essential	Shopify	`_secure_session_id`, `cart`, `cart_sig`, `checkout_token`, `secure_customer_sig`, `_shopify_u`, `storefront_digest`	Store operation, checkout, authentication, security	Session to 2 years
Essential/Functional	Google Tag Manager	(first-party storage as configured)	Deploy/condition tags based on your consent choices	N/A
Analytics (consent)	Google Analytics 4	`_ga`, `_ga_*`, `_gid`	Site usage and performance (aggregated)	24 hours to 2 years
Analytics (consent)	Northbeam	`nb_*` (naming may vary)	Marketing & attribution analytics across campaigns	up to 2 years
Analytics/UX (consent)	Microsoft Clarity	`_clck`, `_clsk`, `CLID`	Session analytics and UX diagnostics (with masking)	24 hours to 1 year
Marketing/Ads (consent)	Meta (Facebook/Instagram)	Pixel (`_fbp`), event beacons	Ad performance, retargeting, lookalikes	up to 2 years
Marketing/Ads (consent)	Google Ads	`_gcl_au`, conversion tags	Ad performance, retargeting	up to 3 months
Marketing/Ads (consent)	Microsoft/Bing Ads	`MUID`, `_uet*`	Ad performance, retargeting	up to 1 year
Marketing/Ads (consent)	TikTok	`tt_*`	Ad performance, retargeting	up to 13 months
Email marketing (consent)	Klaviyo	`__kla_id`, `__kla_viewed`	Email analytics, onsite signup and campaign measurement	up to 2 years
SMS marketing (consent)	Attentive	`attn_*`	SMS signup flows, onsite modals, attribution	up to 2 years
Data layer / identity (consent)	Fueled	`fueled_*` (if cookies used)	Data layer/identity to improve analytics/ads	varies

Notes & safeguards

Consent gating: analytics, advertising, email/SMS tracking, session replay and ad matching run only after opt-in.
Session replay (Clarity): configured to mask sensitive fields; keystroke capture for payment/PII is disabled.
Ad matching/lookalikes: if you consent to marketing, we may share hashed identifiers with platforms for matching; you can opt out in Cookie Settings and via platform controls.
Retention.com: not currently active. If adopted in the future, it will be enabled only after consent and described as ad matching/identity resolution (not “selling” data).

Policies

Privacy Policy