Privacy Policy

The Fasting Vault Last updated: [DATE OF PUBLICATION] Version: 1.0

1. About this policy

This policy explains how The Fasting Vault collects, uses, stores, and protects your personal data, and the rights you have over that data. It applies to thefastingvault.com and to any products, newsletters, and services we provide through that website.

We have written this policy in plain English. We follow the UK GDPR (as amended by the Data Protection Act 2018 and the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003.

2. Who we are

The Fasting Vault is operated by The Limitless Space Limited, a company registered in England and Wales (company number 12763894), trading as "The Fasting Vault."

The Limitless Space Limited is what UK data protection law calls the "controller" of your personal data. That means we decide what your data is collected for and how it is used.

You can contact us at:

Email: info@thefastingvault.com
Registered office: 77 Wilkins Road, Oxford, OX4 2JB

If you have a question about how we use your data, please email us first. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office at ico.org.uk/concerns.

3. What personal data we collect

We collect the following categories of personal data:

  
      Where you give it to us
      What we collect
    
      Contact form
      Your name, email address, and the contents of your message
    
      When you buy a product
      Your name, email address, billing address, and payment details (payment details are handled by Stripe — we do not see or store your card number)
    
      When you create a customer account, place an order, or abandon a cart
      Account login details, order history, download access logs, and any abandoned-cart contact details you have provided at checkout
    
      When you visit the website
      Technical data including IP address, browser type, device type, pages viewed, referring page, and approximate location — where you have consented to analytics cookies

Where you give it to us	What we collect
Contact form	Your name, email address, and the contents of your message
When you buy a product	Your name, email address, billing address, and payment details (payment details are handled by Stripe — we do not see or store your card number)
When you create a customer account, place an order, or abandon a cart	Account login details, order history, download access logs, and any abandoned-cart contact details you have provided at checkout
When you visit the website	Technical data including IP address, browser type, device type, pages viewed, referring page, and approximate location — where you have consented to analytics cookies

Children. Our products are not designed for children. As a matter of policy, we do not knowingly collect personal data from anyone under the age of 18. The age at which a child can consent to information society services under UK law is 13 (Data Protection Act 2018 section 9). If you believe a child under 18 has provided personal data to us, please email us at info@thefastingvault.com and we will delete it.

Special category data. We do not deliberately collect special category data, such as data about your health, biometrics, or genetics. You may sometimes give us special category data voluntarily — for example, by telling us about a medical condition in a message through our contact form. Where you do, our lawful basis under Article 9 of the UK GDPR is your explicit consent (Article 9(2)(a)), which you give by sending the message after reading this notice. We use that information only to answer you, we do not share it, and we delete the message after 12 months unless you ask us to keep it for longer.

4. How we use your data and our lawful basis

Under UK GDPR we must have a lawful basis for each use of your personal data. Our uses and the bases we rely on are set out below.

  
      Why we use your data
      Lawful basis
      Notes
    
      To send you our newsletter
      Consent (Article 6(1)(a))
      You opt in. You can withdraw consent at any time by clicking "unsubscribe" in any email we send you.
    
      To respond to a message you send through the contact form
      Legitimate interest (Article 6(1)(f)) — responding to your enquiry
      We have a documented Legitimate Interests Assessment on file. We will not use your contact-form data to send you marketing.
    
      To process and deliver an order, manage your customer account, and provide customer support for that order
      Contract (Article 6(1)(b))
      We need this data to perform the contract you have entered into with us.
    
      To send abandoned-cart reminders (where you provided your email at checkout but did not complete the order)
      Legitimate interest (Article 6(1)(f)) — recovering pending orders
      LIA on file. You can opt out at any time using the link in any abandoned-cart email.
    
      To keep accounting and tax records of orders
      Legal obligation (Article 6(1)(c))
      HMRC requires us to keep accounting records, generally for six years.
    
      To understand how the website is used and improve it (analytics)
      Consent (Article 6(1)(a))
      We only collect this after you say yes to analytics cookies. You can change your mind at any time using the Cookie settings link in the footer.
    
      To protect the website from fraud and abuse
      Legitimate interest (Article 6(1)(f)) — keeping our service secure
      This covers essential security logging. LIA on file.

Why we use your data	Lawful basis	Notes
To send you our newsletter	Consent (Article 6(1)(a))	You opt in. You can withdraw consent at any time by clicking "unsubscribe" in any email we send you.
To respond to a message you send through the contact form	Legitimate interest (Article 6(1)(f)) — responding to your enquiry	We have a documented Legitimate Interests Assessment on file. We will not use your contact-form data to send you marketing.
To process and deliver an order, manage your customer account, and provide customer support for that order	Contract (Article 6(1)(b))	We need this data to perform the contract you have entered into with us.
To send abandoned-cart reminders (where you provided your email at checkout but did not complete the order)	Legitimate interest (Article 6(1)(f)) — recovering pending orders	LIA on file. You can opt out at any time using the link in any abandoned-cart email.
To keep accounting and tax records of orders	Legal obligation (Article 6(1)(c))	HMRC requires us to keep accounting records, generally for six years.
To understand how the website is used and improve it (analytics)	Consent (Article 6(1)(a))	We only collect this after you say yes to analytics cookies. You can change your mind at any time using the Cookie settings link in the footer.
To protect the website from fraud and abuse	Legitimate interest (Article 6(1)(f)) — keeping our service secure	This covers essential security logging. LIA on file.

5. Suppliers we share your data with — and where they are based

We use a small number of trusted suppliers ("processors") to run our website and deliver our products. Each of them processes your personal data only on our instructions and under a written contract that meets UK GDPR requirements.

The table below lists each supplier, what they do, the country they are based in, and the safeguard we rely on under UK GDPR Articles 44 to 49 to protect your data when it leaves the United Kingdom. We check that each US supplier is on the active US Data Privacy Framework list at dataprivacyframework.gov before we rely on the UK-US Data Bridge for that supplier.

Supplier	What they do for us	Country	Transfer safeguard	Their privacy policy
Squarespace, Inc.	Hosts our website, runs the contact form, processes orders, and provides our content management system	United States	UK-US Data Bridge (UK Extension to the EU-US Data Privacy Framework)	squarespace.com/privacy
[PAYMENT PROCESSOR — e.g. Stripe, Inc.]	Processes card payments securely on our behalf	[Country]	[UK-US Data Bridge if US-based and listed; otherwise IDTA via their DPA]	[Link to their privacy policy]
[EMAIL PLATFORM — e.g. Kit or MailerLite]	Sends our newsletter and stores subscriber email addresses	[Country — USA for Kit, EU for MailerLite]	[UK-US Data Bridge if US; EEA adequacy regulations if EU]	[Link to their privacy policy]

You can ask us for a copy of the safeguards in place for any specific transfer by emailing us at the address in section 2.

We will not sell your personal data. We will not share your personal data with anyone for their own marketing purposes.

We may disclose your personal data if we are required to do so by law, by a court order, or by a public authority acting within its powers.

6. How long we keep your data

We keep your personal data only for as long as we need it.

  
      Data
      Retention period
    
      Newsletter subscriber data
      Until you unsubscribe, plus 30 days for processing the removal
    
      Contact form messages
      12 months from the date of your message
    
      Order records (name, billing address, order details, invoice data)
      Six years from the end of the tax year in which the order was placed, to meet HMRC requirements
    
      Website analytics data
      Up to 26 months in Google Analytics, or up to 3 years in Squarespace Analytics (whichever applies to the cookie). After that we delete it. Anonymous, aggregated stats may be kept for longer.
    
      Marketing emails sent to you
      24 months for engagement reporting, then deleted
    
      Customer account data
      Until you ask us to close the account, plus six years for the parts of the data we have to keep under HMRC rules

Data	Retention period
Newsletter subscriber data	Until you unsubscribe, plus 30 days for processing the removal
Contact form messages	12 months from the date of your message
Order records (name, billing address, order details, invoice data)	Six years from the end of the tax year in which the order was placed, to meet HMRC requirements
Website analytics data	Up to 26 months in Google Analytics, or up to 3 years in Squarespace Analytics (whichever applies to the cookie). After that we delete it. Anonymous, aggregated stats may be kept for longer.
Marketing emails sent to you	24 months for engagement reporting, then deleted
Customer account data	Until you ask us to close the account, plus six years for the parts of the data we have to keep under HMRC rules

When the retention period ends, we delete the data securely, or we anonymise it so it can no longer identify you.

7. Your rights

You have the following rights over your personal data under UK GDPR:

The right to be informed — through this policy.
The right of access — you can ask us for a copy of the personal data we hold about you.
The right to rectification — you can ask us to correct inaccurate data.
The right to erasure — you can ask us to delete your personal data. This right applies where the data is no longer needed for the purpose we collected it; you withdraw the consent we were relying on; you object and we have no overriding reason to continue; the data has been used unlawfully; or we have to delete it to meet a legal duty. It does not apply where we have to keep the data to meet a legal duty of our own (for example, HMRC accounting rules).
The right to restrict processing — you can ask us to stop using your data in certain circumstances.
The right to data portability — you can ask us to send a copy of your data, in a structured machine-readable format, to you or to another controller. This applies where our basis is consent or contract.
The right to object — you can object to us using your data where our basis is legitimate interest. We will stop unless we can show a compelling reason to continue that outweighs your objection. You have an absolute right to object to direct marketing — we will stop immediately and will not need a reason.
Rights related to automated decision-making and profiling — we do not use automated decision-making or profiling that produces legal effects or significantly affects you.
The right to withdraw consent — where our lawful basis is consent, you can withdraw your consent at any time. This will not affect any processing we have already carried out on the basis of your earlier consent.
The right to lodge a complaint with the Information Commissioner's Office — at any time, at ico.org.uk/concerns or on 0303 123 1113.

To exercise any of these rights, please email us at info@thefastingvault.com. We will respond within one month of receiving your request, as required by UK GDPR.

8. Cookies and similar technologies

We use cookies and similar technologies on this website. The details are set out in our separate Cookies Notice.

9. Security

We take appropriate technical and organisational measures to protect your personal data from accidental loss, misuse, unauthorised access, disclosure, alteration, and destruction. Our suppliers are contractually required to do the same.

Card payments are processed by our payment processor on its own secure systems. We do not store your full card number on our systems.

10. Data breaches

If there is a personal data breach that is likely to put your rights at high risk, we will tell you about it promptly, explain what happened, and tell you what to do. We will also report serious breaches to the Information Commissioner's Office within 72 hours of becoming aware of them, as required by UK GDPR.

11. Changes to this policy

We may update this policy from time to time. If we make a material change we will tell newsletter subscribers by email and update the "Last updated" date and version number at the top of this page.

12. Contact and complaints

If you have any questions, comments, or complaints about how we handle your personal data, please email us at info@thefastingvault.com in the first instance.

You also have the right to contact the Information Commissioner's Office at any time:

Website: ico.org.uk/concerns
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF