Privacy Notice

INTRODUCTION 

This Privacy Notice explains when and why Cholesterol SMART® Living collects personal information, how we use it, the conditions under which we may disclose it to others, and how we keep it secure. It also explains your rights under UK data protection law and how to exercise them.

WHO WE ARE 

 Cholesterol SMART® Living’s subscription service is provided by HEART UK Trading Company Limited (“we”, “us”, “our”), a private limited company registered in England and Wales with registration number 03679100, whose registered office is at 7 North Road, Maidenhead, Berkshire, SL6 1PE.

HEART UK Trading Company Limited is a wholly owned trading subsidiary of HEART UK (registered charity number 1003904) a private limited company limited by guarantee and registered in England and Wales with company number 02631049, whose registered office is at 7 North Road, Maidenhead, Berkshire, SL6 1PE. All profits generated are paid to the charity to support its charitable purposes. For the purpose of data protection legislation, HEART UK is the Data Controller of your personal information.

Contact Information, Queries and Complaints 

If you have questions about this Privacy Notice or how we process your personal data, or if you wish to exercise your rights, please contact us here:

• Email:[email protected]
• Postal address:
  • HEART UK - The Cholesterol Charity
    7 North Road
    Maidenhead
    Berkshire
    SL6 1PE

YOUR RIGHTS 

Under UK data protection law, you have the following rights. Some rights are subject to limitations (for example, safeguarding or legal obligations) and may not always apply. If we cannot fulfil a request, we will explain why. 

• Right to be informed – to know how your data is used.
• Right of access – to request a copy of your personal data.
• Right to rectification –to correct inaccurate or incomplete data. 
• Right to erasure – to request deletion where legally 
• Right to restrict processing – to limit how we use your data in certain circumstances.
• Right to data portability – to receive certain data in a structured, machine‑readable format.
• Right to object –to processing based on legitimate interests or for direct marketing. 
• Rights around automated decision‑making – we do not make decisions that produce legal or similarly significant effects solely by automated means.
• Right to complain- to complainagainst any of our activities.  

HOW WE PROTECT YOUR DATA 

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit and at rest (where appropriate), data minimisation, secure deletion, staff training, confidentiality agreements, and vendor due diligence. We regularly review and improve these measures. 

WHAT PERSONAL DATA WE COLLECT AND HOW?

When you sign up to our subscription service, we collect personal data in order to administer your subscription and effectively deliver our services. This includes:

• Identity and contact information, such as your name and email address.
• Payment and billing information, including your chosen payment method, billing address, payment history, and subscription status, which are required to process payments and manage renewals.

This information is provided directly by you when you register for the subscription service or update your account details.

In addition, we may collect the following personal data automatically when you use our service:

• Account and usage information, such as subscription preferences, and interactions with the service, to operate, maintain, and improve our platform. If you cancel your premium subscription, your account will remain active and you may continue to access available free features unless you choose to delete your account. If you wish to delete your account, please contact us at [email protected].
• Technical and usage information, such as device and browser type, pages viewed, referral source and similar information needed to operate, secure and understand the use of the service. We use Plausible Analytics to produce anonymous, aggregate website statistics. Plausible does not use cookies or persistent identifiers and is not used for advertising or profiling.
• Recipe and account activity, such as favourites, collections, shopping lists, private notes, ratings and reviews, where you choose to use these features. Private notes are visible only to you.

• Support information: We may also collect personal data when you contact us for support, provide feedback, or otherwise communicate with us, including the content of your communications and related contact details.
• Email communication preferences, including whether you receive the recipe emails included with your subscription, whether you have unsubscribed, and whether you have separately chosen to receive communications from HEART UK.

Where payments are processed by third‑party payment providers, we receive confirmation of payment and limited transaction details from those providers. We do not store full payment card details ourselves.

HOW WE USE YOUR DATA

We use your personal data only where it is necessary to provide and manage our subscription service. In particular, we use your data to:

• Create and manage your subscription account, including registering you as a subscriber and maintaining accurate account records.
• Deliver the subscription service, including providing access to paid features and content in accordance with your subscription plan.
• Process payments and manage billing, including charging subscription fees, handling renewals, refunds (where applicable), and keeping records of transactions.
• Communicate with you about your subscription, including confirmations, renewal reminders, changes to the service, important administrative notices and the regular recipe emails included with your subscription.
• Provide customer support, respond to enquiries, and handle requests, complaints, or feedback you submit to us.

• Sending optional marketing communications from HEART UK, if you have signed up to receive them.
• Operate, secure and improve the website, administer requested recipe and account features, prevent fraud, process payments, and understand aggregate patterns in how the service is used.
   

OUR LAWFUL BASIS

• We process your personal data under Article 6(1)(b) of the UK General Data Protection Regulation (UK GDPR), as the processing is necessary for the performance of a contract between you and us, namely the provision of the subscription service.
• The regular recipe emails form part of the Cholesterol SMART® Living subscription service and are communicated under UK GDPR Article 6(1)(b) contract. Any separate marketing communications from HEART UK are only sent where you have chosen to receive them and are processed under Article 6(1)(a).
• Where additional processing is required to comply with legal obligations (such as accounting or tax requirements), this processing is carried out in accordance with Article 6(1)(c) UK GDPR.

We process information needed to create and administer accounts, provide Premium access and take subscription payments under Article 6(1)(b). We rely on our legitimate interests under Article 6(1)(f) where necessary to secure the service, prevent fraud and understand aggregate website usage, provided those interests are not overridden by your rights and interests. We also process information where required to meet a legal obligation.

COOKIES AND SIMILAR TECHNOLOGY

We use cookies and similar technologies, including browser storage and embedded scripts, only where needed to operate and secure Cholesterol SMART® Living, provide requested account and recipe features, process payments, understand aggregate website usage, and display optional content that you choose to load.

Essential website functions: Essential technologies support functions such as signing in, maintaining account and subscription status, protecting forms, processing checkout and payments, preventing fraud, and remembering choices made within requested recipe tools. These technologies are used only to provide or secure the service and are not used for advertising or behavioural profiling.

Website statistics: We use Plausible Analytics to understand aggregate trends such as which pages are visited and the general types of device used. Plausible does not set analytics cookies, use persistent identifiers, track visitors across websites, or create advertising profiles.

Payments and security: We use Stripe to process subscription payments and help detect and prevent fraud. Stripe may use cookies and similar technologies within the Premium purchase and payment journey for payment processing, authentication, security, fraud detection and loss prevention. We do not store complete payment-card details.

We also use Cloudflare security services to protect the website and forms against malicious traffic, automated abuse and other security threats.

Recipe tools; When you actively use recipe tools such as favourites, collections, shopping lists or private notes, we store the information needed to remember your choices and provide that feature. For signed-in subscribers, these choices are associated with their account. They are not used for advertising or unrelated profiling.

YouTube videos; YouTube videos are not loaded automatically. We first display a local placeholder and explain that loading the video will connect to YouTube. If you choose to play a video, YouTube may store or access information on your device and process information about the viewing interaction. We use YouTube's privacy-enhanced mode where available. Choosing not to play a video does not restrict access to the rest of the website.

Your choices: Because the website loads only essential service and security technologies by default and uses cookieless analytics, we do not display a general cookie consent banner. Where optional third-party content may use storage or similar technologies, we ask for your choice at the point you request that content.

DATA SHARING

We do not sell personal data or share it for third-party advertising. We use carefully selected service providers where necessary to operate the service, including website hosting and email providers, Stripe for payment processing and fraud prevention, Plausible for aggregate website statistics, and Cloudflare for website security. These providers may process only the information needed to perform their services and are subject to appropriate contractual and security safeguards.

YouTube receives information only if you choose to load and play an embedded video. We use privacy-enhanced video settings where available.

Complaints Process 

If you are unhappy with how we handle your personal data, you have the right to raise a complaint with us.  

You can contact us by:  

• Email: [email protected]
• Postal address:
  • HEART UK - The Cholesterol Charity
    7 North Road
    Maidenhead
    Berkshire
    SL6 1PE

Please provide:  

• Your name and contact details 
• A clear description of your concern 
• Any relevant dates or reference numbers 

 What Happens Next?  

1. We will acknowledge your complaint within 30 days of receiving it. 
2. We will investigate your concerns. 
3. We may contact you if we need further information. 
4. We will respond as soon as possible and without undue delay. 

Our response will explain:  

• What we have found 
• Whether any action has been taken 
• What happens next 

If You Are Not Satisfied  

If you remain unhappy with our response, you have the right to complain to the Information Commissioner’s Office (ICO):  

Information Commissioner’s Office  

Wycliffe House  
Water Lane  
Wilmslow  
Cheshire  
SK9 5AF  

Telephone: 0303 123 1113  
Website: https://ico.org.uk  

 Accessibility  

If you require this information in an alternative format, please contact us and we will be happy to assist.