Privacy Notice

26th October 2026

We respect your privacy and aim to explain clearly what personal information we collect, why we use it, who may access it and how you can exercise your rights. This Privacy Notice covers visitors to our website and external business contacts, including prospective and existing customers, suppliers, contractors, consultants, service providers and other individuals who communicate or deal with Kew Health & Beauty Limited. It applies to website, email, WhatsApp, telephone, written and other business communications. Where a particular engagement involves materially different processing, additional privacy information may be provided.

Kew Health & Beauty Limited (company number 05007380) generally acts as data controller for its own website, business enquiries, professional contacts and marketing activities. In a particular project or service arrangement Kew may instead act as a processor, or in some cases as a joint controller, depending on who determines the purposes and means of processing; any relevant roles and obligations are addressed by applicable arrangements and supplementary notices where required.

For privacy enquiries or to exercise your rights, please use the dedicated privacy contact facility on our website, which is routed to our dedicated privacy mailbox, or write to our registered office marked “Privacy Enquiry”. To reduce automated harvesting of email addresses, we may prefer to provide the mailbox through a functioning web contact facility rather than display it on every website page. Kew does not claim to have appointed a statutory Data Protection Officer merely by designating this privacy contact.

• Contact and professional details: name, job title, employer, business email address, phone number, postal address and relevant correspondence.
• Enquiry and project information: details given through contact forms, email, telephone or meetings, including product or service interests, proposed projects and subsequent communications.
• Technical and website information: IP address, browser and device information, operating system, requested pages, access times, referring pages, approximate location inferred from IP address, cookies and similar identifiers where used.
• Business development information: professional profile, organisation, business sector, publicly available business information, prior enquiries, correspondence, marketing preferences and relevant website engagement, where lawfully collected.
• Security information: access and system logs, reports of misuse, and records needed to investigate technical incidents or protect our systems.

Because websites, online forms, databases, email systems and underlying software are complex and can be exposed to security vulnerabilities or unlawful interference, we strongly discourage the submission of highly personal, sensitive, commercially confidential or security or time-critical information through general website forms. This includes, for example, medical or health information, identity documents, financial or account credentials, passwords, unpublished inventions, confidential formulations, trade secrets and detailed proprietary technical information. Please contact us first to agree an appropriate and, where necessary, more secure communication method. Do not assume that marking a website submission “confidential” makes a general enquiry form a secure or contractually protected channel.

We obtain information directly from you when you submit a form, email or telephone us, meet our team or otherwise communicate with us. Some technical information is collected automatically when you access our website. We may also obtain relevant business-contact information from your employer, publicly available corporate websites, professional directories, professional networking services, referrals or lawful business-intelligence providers, subject to applicable transparency obligations.

Where we rely on legitimate interests, these include operating and protecting our business, responding to enquiries, managing professional relationships, improving our website and identifying relevant commercial opportunities. We assess those interests against the rights and reasonable expectations of individuals. The precise basis depends on the activity and circumstances.

Where enabled and lawful, we may measure the pages visited, navigation routes, visitor numbers, referring websites, device types, approximate geography and interactions with our website. We may use third-party analytics and business visitor identification services to understand interest in Kew’s services and identify prospective business organisations. Depending on the technology and available information, data may be linked to a business organisation or an identifiable professional contact.

We do not assume that website analytics are anonymous. Information that identifies or can reasonably be linked to an individual is handled as personal data. Where required and possible, we obtain consent before setting non-essential cookies or using comparable tracking technologies. Further details of live tools, cookies, purposes and choices appear in our Cookie Policy and also a consent interface where available.

We may use proportionate business-interest profiles to prioritise enquiries or tailor business communications. Such profiling does not, by itself, determine eligibility for a service or produce decisions with legal or similarly significant effects. If our practices change in a material way, this notice will be updated as required.

We may contact relevant business contacts about Kew’s products, services or related business opportunities where this is lawful and consistent with reasonable expectations. Where consent is required, we will seek to obtain it. Individuals and sole traders may be subject to different electronic marketing rules from corporate subscribers. We identify ourselves in marketing communications, offer an appropriate opt-out and honour objections to the use of personal information for direct marketing where direct marketing is intended.

You may object to direct marketing at any time by using the unsubscribe method in a marketing communication or by contacting us. We may keep limited details on a suppression list to ensure that your preference is respected.

Cookies and similar technologies may be used for essential website operations, security, user preferences, analytics or marketing where enabled. Some limited uses may not require consent under applicable law. Our separate Cookie Policy where applicable will strive to identify the actual technologies deployed, their purposes, providers, durations and how to change or withdraw consent.

Our website may include externally supplied forms, videos, maps, social media features or other embedded functionality. When you use them, the relevant provider may process information under its own privacy terms. Whether it acts for us or independently depends on the particular service and configuration.

We may disclose relevant personal information to authorised personnel and carefully selected service providers, including website designers, developers and administrators; hosting, cloud, database and backup operators; IT, cybersecurity and technical-support contractors; form-processing services and providers of analytics, visitor intelligence and other business systems. Such providers may need to inspect, retrieve, access, view, read, copy, transfer or otherwise process website submissions, databases, logs or stored communications in the ordinary course of troubleshooting, maintenance, updates, security checks, system migrations, backup or support. This may include information contained in forms or attachments, even where the provider is not the intended recipient of the enquiry.

We do not publish enquiry details merely because they have been submitted through the website. Where another organisation is independently responsible for its own processing, we will provide relevant information where requested.

Where lawful and reasonably necessary, we may investigate, record, preserve, use and disclose information relating to suspected fraud, attempted fraud, cybercrime, unauthorised access, malicious activity, misuse of our website, infringement of rights or other suspected unlawful conduct. This may include IP addresses, access and security logs, device and browser details, enquiry submissions, communications and related records held by us or our authorised providers. We may share relevant information with the police, law-enforcement agencies, regulators, competent public authorities, courts, professional advisers, cybersecurity specialists and other appropriate recipients to prevent, detect, investigate or respond to wrongdoing, protect people or our systems, comply with law, or establish, exercise or defend legal claims. Disclosure may be voluntary where a lawful basis exists or made in response to a lawful request or obligation. We assess necessity, proportionality, security and data minimisation, and apply applicable UK data-protection rules. We may retain relevant evidence beyond normal retention periods where lawfully justified by an investigation, dispute or legal claim. Where law permits, we may delay informing a person if disclosure would prejudice a legitimate investigation or another lawful purpose.

Some service providers or business partners may access or process personal data outside the United Kingdom. Where a restricted transfer takes place, we will use where possible an appropriate mechanism such as applicable UK adequacy regulations or approved contractual safeguards, together with any necessary assessments and supplementary measures to help protect this data. You may contact us for information about safeguards relevant to your data.

General business enquiries and related correspondence may be retained for up to seven years from the last substantive interaction or relevant review. Business-development and marketing contact records may also be retained for up to seven years from the last relevant engagement or review. These periods are maximum limits, not minimum retention commitments. They do not mean that Kew is obliged to or will retain any record for the full period.

These periods are maxima, not minimum retention commitments or promises to preserve records. Kew may delete, anonymise or otherwise cease retaining information at any earlier time and we review ongoing necessity. We do not retain information merely because a maximum period has not yet expired. Where someone objects to direct marketing, we will cease using their personal data for that purpose and may retain only the limited suppression information reasonably necessary to honour the objection.

We seek to implement technical and organisational measures appropriate and proportionate to the nature, sensitivity, volume, context and intended use of the personal information we process, taking account of the risks to individuals, the state of the art, implementation costs and applicable data-protection legislation. Our general enquiry facilities are intended principally for routine business contact information, such as a name, company, business email address, telephone number and brief enquiry; they are not designed as secure channels for highly sensitive personal or proprietary information. Nevertheless Kew applies safeguards appropriate to the actual risks. However, no website, database, software system, email service or electronic transmission can be guaranteed completely secure against sophisticated malicious activity, unauthorised access, interception, loss, theft, misuse or misappropriation. This should be considered before submitting any data.

Please do not send medical information, identity documents, financial credentials, confidential formulations, trade secrets, unpublished inventions or other sensitive material through general website forms. Before transmitting such information, please contact Kew through an independently verified and trusted channel to check that the intended email address or other communication method remains correct, active and appropriate, and agree suitable safeguards. Our website may be hosted, developed, maintained, secured or supported by authorised third-party providers; personnel of those providers may be able to access, view or read information submitted through the website or held in associated systems when reasonably necessary to perform their work, subject to appropriate contractual and security controls. Law enforcement in other territories may have access to underlying records. For website-specific contractual exclusions and limitations, please consult the separate Website Terms of Use.

We take reasonable steps to keep personal information accurate and up to date for its intended purpose. Please tell us if your business contact details change or you believe a record is inaccurate. When providing information about someone else, you should have an appropriate lawful basis and authority to share it, and provide any privacy information required by law. Kew may request clarification, verify information where proportionate, or correct or remove inaccurate or outdated details but shall not be obliged to do so. A party acting independently as a controller or processor remains responsible for its own applicable data-protection duties.

Where third-party providers process personal data on Kew’s behalf, we seek appropriate written arrangements where practical or proportionate, including documented processing instructions, confidentiality obligations, risk-appropriate security measures, controls over sub-processors and assistance with relevant data-protection obligations. The measures and access rights are proportionate to the service and associated risks. External website developers, hosts, IT providers, system administrators and other support contractors may need to inspect or read information in websites, databases or contact forms in the course of authorised work. We do not promise that third-party personnel will never see submitted material.

We assess suspected personal data breaches having regard to the information involved, the incident and the possible risks to individuals. Where a breach is notifiable, we will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours after becoming aware of it. Where a breach is likely to result in a high risk to individuals, we will also notify affected individuals unless a legal exception applies. We maintain breach records as required. These duties depend on the circumstances; not every security incident is a reportable personal data breach.

Subject to applicable conditions and exemptions, you may have rights to be informed, access personal data, correct inaccurate information, request erasure or restriction, obtain data portability where it applies, object to processing based on legitimate interests, and object at any time to direct marketing. Rights concerning certain solely automated decisions and profiling may also apply where legally relevant; we do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects through our general website. You may withdraw consent at any time where processing relies on it, without affecting processing that was lawful beforehand. We may take reasonable steps to verify identity and authority before disclosing information.

To make a subject access request or exercise another applicable right, contact us using the details in section 1. We normally respond to valid subject access requests within one month, subject to permitted extensions or other applicable procedural rules. If a request cannot be met in full because of a relevant legal exemption or obligation, we will explain this where required. You may also complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator but we would welcome the opportunity to address your concerns first.

Our website is intended primarily for business and professional audiences and is not directed at children. We do not intentionally seek special-category personal data through our general website enquiries. If a project requires such data, we will assess and document the relevant legal requirements separately.

This notice concerns Kew’s own processing of personal information. Separate agreements may govern the confidentiality, intellectual property and commercial treatment of project information. This notice does not override a valid confidentiality agreement or transfer ownership of a customer’s ideas or formulations. Links to external websites are governed by their operators’ own notices.

We may update this Privacy Notice to reflect changes in our operations, technology or legal obligations. The current version will be published on our website with its updated date.