Who holds your personal data when you visit this shop or buy from us, what we collect, why, who else sees it, how long we keep it and how to use your rights. This is information we give you under the UK GDPR and the Data Protection Act 2018. It is not a term of your contract. This version is dated 8 October 2026.
One company decides how your personal data is used for this website and for orders placed on bio-swiss.com.
BIO SWISS LTD, registered in England and Wales, company number 14544393, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, is the controller of your personal data.
Contact for anything on this page: info@bio-swiss.com. Post to the registered office is forwarded, so email is faster.
BIO-SWISS Sàrl in Val-d'Illiez, Switzerland, develops the formulas. It is not a party to your order and does not receive your order data, except where a product-quality or safety question about a batch needs it, and then only what that question needs.
This shop runs on Shopify, which hosts the pages, the basket and the checkout. The ambassador programme's application form and portal are hosted separately and are described in section 09.
The shop uses cookies and similar technologies, set through Shopify. Those that are strictly necessary for the basket, the checkout, security and your language and currency are set without consent. Analytics and marketing cookies — set by Shopify and, where they are connected, by our sales channels such as Facebook and Instagram — are set only if you accept them in the cookie banner. You can change your choice at any time through “Cookie preferences” at the foot of every page. When an ambassador signs in to the separately hosted portal, it sets one strictly necessary session cookie (__Host-bs_amb) for up to 14 days.
Lawful basis: strictly necessary cookies — our legitimate interest in running the shop (UK GDPR Article 6(1)(f)) and the PECR exemption for services you request; all other cookies — your consent (Article 6(1)(a), PECR regulation 6).
Like any website, the host keeps short-lived technical logs of requests, such as IP address, browser type, the page asked for and the time, so that the site can be delivered and protected against abuse. Shopify keeps these logs for the shop, and Vercel Inc. for the ambassador portal; both process them for us.
Lawful basis: our legitimate interest in running a secure website (UK GDPR Article 6(1)(f)).
Your answers to the formula finder, including any health or pregnancy answer, are processed in your own browser and are never sent to us or stored by us. The result link contains only the name of the suggested product.
The basket and checkout are provided by Shopify on this site; payment is taken by the payment provider you choose at checkout. The sections below cover what happens to the details you give there.
For each use, the lawful basis is given beside it.
Name, billing and delivery address, email, phone number if you give one, the products, prices, discount codes and order history. We use it to take, pack, deliver and support your order, and to deal with returns, refunds and faults. Your name, delivery address and email address are needed to take and deliver an order; without them we cannot accept it.
Lawful basis: performing our contract with you (Article 6(1)(b)).
Card and wallet payments are processed by the payment provider at checkout. We see the payment status and the last digits of the card; we never see or store your full card number.
Lawful basis: performing our contract with you (Article 6(1)(b)).
Invoices, order totals and refund records are kept because tax and company law require them.
Lawful basis: legal obligation (Article 6(1)(c)).
A record of returns, faults, chargebacks and promotional-code use, so we can handle a claim fairly, apply our Terms and prevent fraud and repeated abuse.
Lawful basis: our legitimate interests in defending legal claims and preventing fraud (Article 6(1)(f)).
What you write to us and our replies, so we can answer you and keep a record of what was agreed.
Lawful basis: performing our contract, or our legitimate interest in answering you (Article 6(1)(b) and (f)).
If you tell us about a reaction, a medical condition or a medicine, we use it only to deal with your message, to investigate the batch and to meet our food-safety duties, and we share it with no one except where those duties or a legal claim require it.
Lawful basis: Article 6(1)(c) and (f), with Article 9(2)(f) where it concerns a legal claim; otherwise we ask for your explicit consent (Article 9(2)(a)) when you first write to us about a reaction, and we delete what you told us if you do not give it.
We send marketing emails only if you have opted in, for example by ticking the box at checkout. Every email has an unsubscribe link, and unsubscribing never affects an order.
Lawful basis: consent (Article 6(1)(a) and the Privacy and Electronic Communications Regulations 2003).
If you use someone's personal code, we record which code was used on the order so that we can credit the person whose code it is. We do not give that person your name or contact details.
Lawful basis: our legitimate interest in running the referral programme (Article 6(1)(f)).
We do not sell personal data and we do not share it for other companies' marketing. These are the people who handle it for us, or receive it because they have to.
Our online shop and checkout run on Shopify, which stores order and customer data for us. Shopify's own privacy policy covers what it does as a platform.
The provider that processes your payment at checkout receives what it needs to take the payment and to prevent fraud, and acts under its own privacy terms for that.
The carrier receives your name, delivery address and, where needed for delivery updates, your email or phone number.
Our email provider holds our correspondence with you. Shopify hosts this shop; Vercel Inc. hosts the ambassador portal and its server logs. For the ambassador programme, Supabase Inc. hosts the programme database and Resend Inc. sends the sign-in links and notification emails; both act on our instructions only.
Our accountants, lawyers and insurers where they need it to advise or act for us, and HMRC, a court, a local authority, the Food Standards Agency or the police where the law requires us to disclose it.
Some of the providers above process data outside the UK, for example in the European Economic Area, Switzerland, Canada or the United States.
Where personal data leaves the UK, the transfer relies on UK adequacy regulations (which cover the EEA, Switzerland and Canada, among others), on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or on the UK International Data Transfer Agreement or Addendum. Ask us and we will tell you which applies to a given provider.
We keep data only as long as the reason for it lasts.
Six years after your last order, because tax law requires us to keep transaction records and because we may need them to establish or defend a legal claim.
For as long as your query is open and then for up to two years, unless the message is part of an order or claim record, in which case it follows that record.
Until you unsubscribe. After that we keep only your email address on a suppression list, so that we do not email you again.
For the short period set by our hosting provider for security and operation.
An unsuccessful or withdrawn application: 12 months from the decision. An ambassador's account, the orders attributed to their code, commission and payout records: six years after participation ends, because tax law requires transaction records to be kept.
Email info@bio-swiss.com. It is free, and we reply within one month, or tell you within that month if we need longer because a request is complex.
You can ask for a copy of your data, for it to be corrected, erased or restricted, or for a copy in a portable format, and you can object to any use based on our legitimate interests. You can withdraw consent to marketing at any time, and an objection to direct marketing is always upheld.
Where the law requires or allows us to keep a record despite a request, for example tax records or a record needed for a claim, we tell you which record and why.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
If you apply to the ambassador programme, or take part in it, BIO SWISS LTD is the controller of the data below. The fuller notice is section 10 of the Ambassador Programme Terms.
From the application form: your name, email address, the channel you promote on and its audience size, your region, whether you trade as an individual, sole trader or company, and a company number where you give one, plus anything you write in the free-text field. After approval: your bank details for payouts, your code, the orders attributed to it (order number, date, items, amount and status — never the buyer's name or contact details), your commission and what we have paid you.
To assess your application and, if we approve it, to run the programme and pay you (Article 6(1)(b): steps you asked for before a contract, then the agreement itself); to keep the tax and accounting records the law requires (Article 6(1)(c)); and to detect misuse of codes and fraud (Article 6(1)(f), our legitimate interest in running an honest programme).
Supabase Inc. (the programme database), Resend Inc. (sign-in links and notification emails), Vercel Inc. (hosting) and Shopify (the shop platform, from which we read the orders placed with your code). Transfers outside the UK are protected as described in section 05.
As set out in section 06: 12 months for an unsuccessful application, six years after participation ends for an ambassador's records.
The same rights as in section 07. Signing in to the portal uses one strictly necessary cookie, described in section 02.
We make no decisions about you by automated means that have legal or similarly significant effects. The formula finder is a guide that runs in your browser and decides nothing about you.
Our products are not intended for anyone under 18, and we do not knowingly collect personal data from children.
Access to customer data is limited to the people who need it, and the platforms we use encrypt data in transit. If a breach puts your rights at high risk, we will tell you without undue delay.
If we change this policy, the new version is published here with its date. A change does not reduce your rights over data we already hold without telling you first.
Questions about your data, or a request under your rights: info@bio-swiss.com.
Welcome to Bio Swiss
Leave your e-mail and get the code straight away.
You are on the list
Use it at checkout. We have also sent it to your inbox.